Warpgate vs. Teleport§
Warpgate and Teleport both give you audited, authenticated access to internal infrastructure — but they sit at very different points on the spectrum. Teleport is a large, agent-based identity platform; Warpgate is a lightweight, transparent bastion that runs from a single binary and works with the clients you already have. For most teams that simply need secure, audited access to their servers, databases and desktops, Warpgate gets you there with a fraction of the moving parts — and none of it behind a paywall.
Note
Teleport is an actively developed product and its capabilities and edition boundaries change over time. Treat the details below as a good-faith orientation, last verified July 2026, and check the Teleport documentation for its current feature set.
At a glance§
| Warpgate | Teleport | |
|---|---|---|
| Footprint | A single Rust binary + a database (SQLite or PostgreSQL) | A cluster of services (Auth, Proxy) plus a backend |
| Agents on targets | None — nothing is installed on your servers | Typically a Teleport agent per resource (agentless SSH via CA is possible) |
| Client software | None — users keep their normal ssh, mysql, psql, kubectl, browser or RDP/VNC client |
tsh CLI, the Teleport Connect desktop app, and the web UI (standard clients work through a local proxy) |
| Selecting a target | A special username / the web UI | tsh / resource labels / the web UI |
| Protocols | SSH, HTTP(S), MySQL, PostgreSQL, Kubernetes, RDP, VNC | SSH, Kubernetes, databases, web & TCP apps, Windows desktop (RDP) |
| Authentication | Password, SSH public key, OTP (TOTP), SSO via OIDC (Google, Microsoft, Apple or any custom provider), client certificates, in-browser approval | Short-lived certificates, MFA (TOTP / WebAuthn), SSO (GitHub in the open-source edition; SAML/OIDC require Enterprise) |
| Self-service / JIT access | Tickets and self-service ticket requests with admin approval — included | Access Requests with approval workflows — Enterprise |
| Session recording | Every protocol (see below) | SSH, Kubernetes and Windows desktop; databases/apps as audit events (see below) |
| In-browser access | SSH, RDP, VNC and HTTP (see below) | SSH, Windows desktop, web apps and Kubernetes (see below) |
| Language | Rust | Go |
| Licensing | Apache-2.0, fully self-hosted, no paid tier | Community Edition free only for companies under 100 employees and under $10M annual revenue (v16+ binaries are commercially licensed); many features require Enterprise / Cloud |
Philosophy§
Warpgate is a transparent proxy. Users connect with the tools they already have — Warpgate sits in the middle, authenticates them, applies access control and records the session. Nothing is installed on the targets and there's no dedicated client to distribute. The whole thing is one binary and one database, and every feature is in the open-source build.
Teleport is a platform. It brings its own cluster, certificate authority, per-resource agents, CLI and a broad surface of features (identity governance, device trust, machine identity and more). That reach is genuinely powerful for large organisations — at the cost of more infrastructure to run, a client to roll out, and an Enterprise licence for much of the governance tooling. There's also a hard commercial line: since v16, Teleport's Community Edition is licensed for free use only by companies with fewer than 100 employees and less than $10M in annual revenue — cross either threshold and even the base product requires a paid edition. Warpgate has no such boundary: every feature is free at any size, forever.
Session recording§
Warpgate records every protocol it proxies and replays them from the Admin UI. Teleport records its interactive protocols and captures database/app activity as structured audit events.
| Protocol | Warpgate | Teleport |
|---|---|---|
| SSH | ✅ terminal replay (+ per-command audit log, v0.27) | ✅ terminal replay |
| Kubernetes | ✅ API calls + exec/attach replay |
✅ exec replay |
| RDP | ✅ video | ✅ video |
| VNC | ✅ video | ❌ (VNC not supported) |
| MySQL / PostgreSQL | ✅ query log | audit-log query events |
| HTTP / web apps | ✅ session log | audit-log request events |
Browser-based access§
Both offer a browser client for some protocols. Warpgate additionally proxies HTTP targets natively — reaching a web target is just opening it in your browser.
| Protocol | Warpgate | Teleport |
|---|---|---|
| SSH | ✅ web terminal | ✅ web terminal |
| RDP | ✅ web desktop | ✅ web desktop |
| VNC | ✅ web desktop | ❌ |
| HTTP / web apps | ✅ native (Warpgate is an HTTP proxy) | ✅ App Access |
| Kubernetes | ❌ (CLI via generated kubeconfig) |
✅ web exec terminal |
| MySQL / PostgreSQL | ❌ (native DB client) | ❌ (CLI / Teleport Connect) |
Self-service and just-in-time access§
Warpgate ships just-in-time access in the open-source build:
- Tickets — scoped, single- or limited-use access secrets for a specific target.
- Ticket requests — users request access to a target from the portal; an admin approves it (or you allow it automatically), with per-target limits on duration and number of uses.
Teleport's equivalent, Access Requests (just-in-time role elevation with approval workflows), lives in its Enterprise tier.
When Warpgate is the better choice§
- You want a bastion running in the next hour, from a single binary, with no agents and no cluster to operate.
- You want users to keep using standard clients (OpenSSH,
psql,kubectl, mstsc, a browser) with nothing extra to install. - You value a small, auditable, Apache-2.0 codebase where every feature — SSO, MFA, session recording, ticket requests, clustering — is in the free build.
- Your access needs are well covered by SSH, HTTP, MySQL, PostgreSQL, Kubernetes, RDP and VNC.
When to reach for Teleport§
- You need the full breadth of an identity platform: many database engines, application access, device trust and identity governance.
- You're standardising a large or heavily regulated organisation on a single certificate-based identity fabric, and are prepared to run its agent/cluster architecture and pay for the Enterprise features.
Summary§
If you want a comprehensive, agent-based identity platform and the budget and operations team to match, Teleport is built for that. If you want a compact, self-hosted, transparent gateway that works with the clients you already use, records everything it proxies, and doesn't ask you to call sales — that's Warpgate.
Ready to try it?