Meerkat is an authentication proxy and API gateway that puts access control in front of the internal applications your teams build. It replaces the oauth2-proxy, Keycloak and Kong usually assembled around them: sign-in, access rules, organisations, routing, quotas, audit. One image, zero dependency.
And it is fast: measured next to Kong, APISIX and Traefik, each on the same CPU, with the figures kept current by the CI.
Your services receive requests that are already authenticated, carrying a signed token with an identity, roles and an organisation. They stop shipping a login page, a role model and a user table, and go back to being the thing you actually sell.
Weighing it against what you would otherwise assemble? The case for Meerkat does the arithmetic: eight products or one, thirty-eight pods or one, and what the same foundation costs in licences and in engineering days.
Install the gateway, then Prometheus, then Grafana, then write YAML for everything: that is the pattern Meerkat exists to break. Traffic figures, audit trail, quota rules and service health are screens in the console, and the whole gateway is one binary with embedded storage.
Accounts, roles, groups, organisations and the sign-in pages are in the gateway, not beside it. Your corporate directory - OpenID Connect, GitHub, and with Enterprise SAML, LDAP or Active Directory - signs people in, and in Enterprise its groups can grant roles.
A broker's console, a database UI, a dashboard: any application that speaks OpenID Connect signs its people in through the gateway, which becomes their OpenID provider - no Keycloak beside it. The route decides who gets in and the roles the tokens carry, and a sign-in can be tried for anyone before they try it. Enterprise.
Passkeys as a first factor, an authenticator app that remembers a browser you trust, and a password policy that is a setting rather than a rewrite.
The account button, the navigation portal, light and dark mode and the per-role CSS are added to the pages the gateway serves. Your application gets them whatever it is written in, and it ships no library for it.
Eleven predicates decide that a request is for a route, thirty-four filters transform it, and a change applies on the next request. There is no configuration file to redeploy.
The control plane exposes an MCP endpoint. An assistant reads the installation and changes it under exactly the rules a human gets - read-only stays read-only. And it drives your own APIs: it reads a route's OpenAPI, then calls the service through the gateway, as any role, to do the job or prove a rule.
docker run -p 8080:8080 -p 9090:9090 \
-e MEERKAT_ADMIN_PASSWORD=choose-one softwarity/meerkat8080 is what your users reach, 9090 is the admin console. From there, Quick start puts one of your own services behind it in about five minutes.
The community edition is the whole gateway for one organisation on one instance - in production, in a company, commercially, at no cost. It is source-available under the Functional Source License: read the code, change it, ship it inside your own product; two years after each release, that version becomes plain Apache 2.0.
Enterprise is what you need once the installation grows: several organisations, SAML, LDAP and Active Directory, the OpenID provider of your other tools, several gateways behind one entry point. Never a security primitive - TLS, two-factor, passkeys, the vault and the audit trail are free and stay free. Team is Enterprise for a cluster of a known size, and the evaluation edition is Enterprise with a notice on it, free, to try all of it first.
plug, Softwarity's developer tunnel, is published on its own and runs beside any edition; the Enterprise image carries its agent, so the gateway knows who is plugged in.