Comparison
Feature comparison
Section titled “Feature comparison”| Feature | Stoma | Kong | KrakenD | Express Gateway |
|---|---|---|---|---|
| Runtime | Any (CF Workers, Deno, Bun, Node.js) | Container / VM | Container / VM | Node.js |
| Language | TypeScript | Lua / Go | Go | JavaScript |
| Configuration | TypeScript (type-safe) | YAML / Admin API | JSON | YAML / JSON |
| Type safety | Full (compile-time) | None | None | None |
| Bundle size | Lightweight (tree-shakeable) | 100MB+ image | 80MB+ binary | 50MB+ node_modules |
| Service Bindings | Yes (Cloudflare Workers) | N/A | N/A | N/A |
| Custom policies | TypeScript middleware (factory function) | Lua plugins | Go plugins | Express middleware |
| Status | Active | Active | Active | Unmaintained |
| Cold start | Sub-millisecond (Workers), fast (Bun/Deno) | N/A (always-on) | N/A (always-on) | Seconds |
| Admin UI | Programmatic (admin routes) | Dashboard + Admin API | Dashboard | Admin UI |
| Plugin ecosystem | npm (compatible with Hono middleware) | Kong Hub (large ecosystem) | Community plugins | npm |
| gRPC support | No | Yes | Yes (transcoding) | No |
| GraphQL federation | No | Via plugin | Built-in | No |
What Stoma does well
Section titled “What Stoma does well”Type-safe configuration. Your gateway configuration is a TypeScript object. Typos, missing fields, and type mismatches are caught at compile time, not at deployment time. Policies are TypeScript functions that your editor can autocomplete and your CI can type-check.
No extra infrastructure. Stoma is a library, not a service. There is no container to manage, no proxy to deploy, no admin API to secure. The gateway lives in your codebase and deploys through your existing pipeline — whether as a standalone Cloudflare Worker, a Node.js server, a Bun process, or embedded in your application.
Multi-runtime. Stoma uses standard Web APIs (fetch, Request, Response,
crypto.subtle) with no runtime-specific dependencies. Cloudflare Workers
users get additional features like Service Bindings and KV-backed stores,
but the full policy engine, URL proxying, and handler upstreams work on
every runtime.
Minimal surface area. One peer dependency (Hono), zero runtime-specific code. Policies are plain middleware functions. Custom policies require no framework-specific abstractions — if you can write middleware that takes (context, next), you can write a Stoma policy.
Composable policies. Policies are merged, deduplicated by name, and sorted
by priority. Global policies apply everywhere. Route-level policies override
globals. The skip function enables conditional bypass. No YAML anchors or
inheritance hierarchies. See the Policy System for
details.
When to use something else
Section titled “When to use something else”You need a GUI admin panel and plugin marketplace. Kong offers a dashboard, a large plugin ecosystem, and an Admin API for runtime configuration changes. If your team manages API gateway configuration through a GUI rather than code, Kong is a better fit.
You need gRPC transcoding or GraphQL federation. KrakenD has built-in gRPC transcoding and GraphQL composition. Apollo Router is purpose-built for GraphQL federation. Stoma operates at the HTTP layer and does not parse or transform protocol-specific payloads.
You want a standalone reverse proxy. Stoma is a library, not a standalone reverse proxy. While you can deploy a Stoma gateway as its own service (e.g., a standalone Cloudflare Worker), it does not provide infrastructure-level features like Envoy (connection pooling, TCP proxying, TLS termination). If you need those capabilities, a dedicated proxy like Caddy, Nginx, or Envoy is designed for that role.
You need runtime configuration changes without redeployment. Kong and KrakenD support dynamic configuration via admin APIs. Stoma’s configuration is defined in TypeScript and compiled at build time. Changes require a redeployment (which on Cloudflare Workers takes seconds, but it is still a deployment).
You need protocol-level features. WebSocket upgrades, TCP proxying, HTTP/2 server push, and similar protocol-level capabilities are handled by the underlying runtime, not by Stoma. If you need fine-grained control over these protocols, a dedicated proxy like Envoy is more appropriate.