Kong vs Hoppscotch

Agent access

1. ai-native userPoint an agent at llms.txt or agent-oriented docs

   weight 2 · round to Hoppscotch
   Kong✓fullprobed8/10

   A live probe confirms Kong serves a working llms.txt at developer.konghq.com/llms.txt (HTTP 200) describing its documentation set for Gateway, Konnect, AI Gateway, and Mesh, directly matching the story of pointing an agent at an agent-oriented docs entrypoint. Missing for 10: no evidence of a more extensive llms-full.txt or additional per-product agent-doc indexes, and no independent (non-probe) commentary confirming real-world agent usage of this file.

   • [probe] “PROBE llms.txt: HTTP 200 at https://developer.konghq.com/llms.txt # developer.konghq.com > Kong's developer documentation for Kong Gateway,…”

   proof ↗⚑ flag

   Hoppscotch✓fullprobed9/10

   A direct probe confirms llms.txt is live at docs.hoppscotch.io/llms.txt returning HTTP 200 with structured documentation content, and the docs also expose agent-oriented resources like an official MCP server and CLI overview pages that an agent could consume. Missing for 10: no independent/community confirmation of an agent actually consuming llms.txt in practice.

   • [probe] “PROBE llms.txt: HTTP 200 at https://docs.hoppscotch.io/llms.txt # Hoppscotch Documentation > Find user guides, quickstarts, tutorials, use …”
   • [probe] “official MCP server documented at https://docs.hoppscotch.io/documentation/clients/mcp-server/overview”
   • [probe] “official CLI documented at https://docs.hoppscotch.io/documentation/clients/cli/overview”
   • [claimed-docs] “It hands the host your collections, requests, environments, and teams, so an agent can read and change them for you.”

   proof ↗⚑ flag

2. ai-native userRun the product headlessly / in CI for automation

   weight 2 · round drawn
   Kong✓fullclaimed8/10

   Kong Gateway supports headless/CI operation via DB-less declarative config, decK and kongctl CLI tools for API Lifecycle Automation (APIOps), a RESTful Admin API, and Docker-based deployment—all enabling fully automated, non-interactive pipelines. missing for 10: independent hands-on CI pipeline example or third-party case study demonstrating actual CI/CD integration in production.

   • [claimed-docs] “decK is a command line tool that facilitates API Lifecycle Automation (APIOps) by offering a comprehensive toolkit of commands designed to o…”
   • [github] “Sophisticated deployment models like Declarative Databaseless Deployment and Hybrid Deployment (control plane/data plane separation) without…”
   • [github] “Advanced routing, load balancing, health checking - all configurable via a RESTful admin API or declarative configuration.”
   • [github] “there is also a docker installation procedure if you’d prefer to run the Kong Gateway in DB-less mode.”
   • [github] “:8001 - configure Kong using Admin API or via [decK](https://github.com/kong/deck)”
   • [claimed-docs] “decK | Kong Docs”
   • [claimed-docs] “kongctl | Kong Docs”
   • [claimed-docs] “You can use the quickstart script to get an instance of Kong Gateway running almost instantly”

   proof ↗⚑ flag

   Hoppscotch✓fullprobed8/10

   Hoppscotch ships an official CLI (hopp) explicitly designed to run API tests, automate monitoring, and manage collections from the terminal or automated systems, including CI-friendly JUnit report generation for collection runs — directly enabling headless/CI automation. missing for 10: independent third-party CI pipeline examples/case studies confirming real-world CI usage beyond vendor docs.

   • [claimed-docs] “Use the Hoppscotch CLI to run API tests, automate monitoring, and manage collections from your terminal.”
   • [claimed-docs] “The hopp test command now has the ability to generate a JUnit Report for collection runs in the CLI.”
   • [claimed-docs] “With the command-line interface (CLI) you can interact with the Hoppscotch platform using a terminal, or through an automated system. This e…”
   • [probe] “official CLI documented at https://docs.hoppscotch.io/documentation/clients/cli/overview”

   proof ↗⚑ flag

3. ai-native userPlug MCP servers into this product so it can use their tools

   weight 3 · round to Kong
   Kong~partialclaimed4/10

   Kong's AI Gateway positions itself as an 'MCP Traffic Gateway' that can govern, secure, and observe traffic to/from MCP servers, and its Catalog can inventory MCP servers alongside APIs and agents (kong-docs-65, kong-docs-22, kong-gh-6). However, the evidence centers on Kong auto-generating/exposing MCP servers from REST APIs and proxying/governing MCP traffic between agents and servers, not on Kong itself acting as an MCP client that plugs in external MCP servers to consume their tools directly. Missing for 10: clear documentation of Kong itself invoking/using tools from a connected MCP server (client-side tool use), independent/hands-on confirmation of this workflow, and detail on how a user 'plugs in' an arbitrary third-party MCP server for Kong's own use.

   • [claimed-docs] “MCP Traffic Gateway”
   • [claimed-docs] “Catalog as one inventory across APIs, API packages, AI Models, MCP servers, and agents”
   • [github] “MCP traffic governance, MCP security and MCP observability in addition to MCP autogeneration from any RESTful API.”
   • [claimed-docs] “Auto-discover APIs and compose endpoints into MCP tools”
   • [claimed-docs] “Auto-generate MCP servers that leverage composed MCP tools. One-click deploy to Kong AI Gateway infrastructure.”
   • [claimed-docs] “AI Gateway acts as a control and observability layer for A2A traffic, enabling you to route agent-to-agent requests, extract task metadata, …”

   proof ↗⚑ flag

   Hoppscotch—none0/10

   Evidence only shows Hoppscotch exposing itself AS an MCP server (agents can connect to Hoppscotch to read/change collections, requests, etc.), which is the reverse of the story — Hoppscotch acting as an MCP client that consumes other servers' tools. No evidence of Hoppscotch connecting to or ingesting external MCP servers to use their tools.

   • [claimed-docs] “It hands the host your collections, requests, environments, and teams, so an agent can read and change them for you.”
   • [claimed-docs] “It hands the host your collections, requests, environments, and teams, so an agent can read and change them for you. It also sends real HTTP…”
   • [probe] “official MCP server documented at https://docs.hoppscotch.io/documentation/clients/mcp-server/overview”

   proof ↗⚑ flag

4. ai-native userConnect an agent via an official MCP server

   weight 3 · round to Kong
   Kong✓fullprobed8/10

   Kong documents an official Kong Konnect MCP Server (kong-docs-66, kong-probe-3) plus dedicated MCP gateway docs for connecting agents (kong-docs-3, kong-docs-65) and MCP auto-generation/tool composition (kong-docs-53, kong-docs-54). This is first-party documentation of an official MCP server, not just client-side MCP consumption. missing for 10: independent/hands-on third-party verification of the MCP server working end-to-end, and more detail on setup/connection steps beyond marketing copy.

   • [claimed-docs] “Kong Konnect MCP Server”
   • [probe] “official MCP server documented at https://developer.konghq.com/konnect-platform/konnect-mcp/”
   • [claimed-docs] “Gain control and visibility over AI agent infrastructure with AI Gateway-driven MCP capabilities”
   • [claimed-docs] “MCP Traffic Gateway”
   • [claimed-docs] “Auto-discover APIs and compose endpoints into MCP tools”
   • [claimed-docs] “Auto-generate MCP servers that leverage composed MCP tools. One-click deploy to Kong AI Gateway infrastructure.”
   • [github] “MCP traffic governance, MCP security and MCP observability in addition to MCP autogeneration from any RESTful API.”

   proof ↗⚑ flag

   Hoppscotch✓fullprobed7/10

   Hoppscotch documents an official MCP server (docs-10, docs-22, probe-3) that exposes collections, requests, environments, and teams to an agent and can execute real HTTP requests, directly matching the story. Missing for 10: independent/hands-on community verification of the MCP server's behavior and any deeper docs on setup/auth scopes beyond the overview page.

   • [claimed-docs] “It hands the host your collections, requests, environments, and teams, so an agent can read and change them for you.”
   • [claimed-docs] “It hands the host your collections, requests, environments, and teams, so an agent can read and change them for you. It also sends real HTTP…”
   • [probe] “official MCP server documented at https://docs.hoppscotch.io/documentation/clients/mcp-server/overview”

   proof ↗⚑ flag

5. ai-native userUse an official CLI

   weight 2 · round to Hoppscotch
   Kong~partialprobed6/10

   Kong ships official CLIs (decK for declarative APIOps and kongctl for Konnect/Gateway management) documented at developer.konghq.com/deck and /kongctl, which can be scripted/automated by AI-native or agentic workflows. However, there's no evidence these CLIs are explicitly designed or marketed for AI-native/agentic use (e.g., no agent-specific CLI features, no mention of LLM/agent integration in the CLI docs themselves — that capability is described separately for AI Gateway proxying other tools' CLI traffic, not Kong's own CLI being agent-oriented). missing for 10: explicit agentic/AI-native design goals for decK/kongctl, independent hands-on verification of CLI use by AI agents.

   • [claimed-docs] “decK is a command line tool that facilitates API Lifecycle Automation (APIOps) by offering a comprehensive toolkit of commands designed to o…”
   • [claimed-docs] “decK | Kong Docs”
   • [claimed-docs] “kongctl | Kong Docs”
   • [probe] “official CLI documented at https://developer.konghq.com/deck/”

   proof ↗⚑ flag

   Hoppscotch✓fullprobed8/10

   Hoppscotch ships an official CLI (hopp) documented for running API tests, automating monitoring, managing collections from the terminal, and generating JUnit reports, corroborated by a probe confirming the official docs page. missing for 10: independent/hands-on community confirmation of CLI usage and more detail on full command coverage.

   • [claimed-docs] “Use the Hoppscotch CLI to run API tests, automate monitoring, and manage collections from your terminal.”
   • [claimed-docs] “The hopp test command now has the ability to generate a JUnit Report for collection runs in the CLI.”
   • [claimed-docs] “With the command-line interface (CLI) you can interact with the Hoppscotch platform using a terminal, or through an automated system. This e…”
   • [probe] “official CLI documented at https://docs.hoppscotch.io/documentation/clients/cli/overview”

   proof ↗⚑ flag

6. ai-native userDrive the product through a documented public API

   weight 3 · round drawn
   Kong✓fullprobed8/10

   Kong exposes a documented public Admin API for configuring the gateway (kong-gh-5, kong-gh-10), a directory of OpenAPI specs for Kong's APIs (kong-docs-9), and RESTful proxying of any API with extensibility via plugins (kong-docs-44), giving AI-native users a clear, documented programmatic surface to drive the product. missing for 10: a live discoverable OpenAPI/swagger machine-readable spec at the docs root (probe found 404s at common openapi.json paths), and independent/hands-on confirmation of API-driven automation beyond vendor docs.

   • [github] “Advanced routing, load balancing, health checking - all configurable via a RESTful admin API or declarative configuration.”
   • [github] “:8001 - configure Kong using Admin API or via [decK](https://github.com/kong/deck)”
   • [claimed-docs] “Directory of OpenAPI specifications for various Kong APIs.”
   • [claimed-docs] “Kong Gateway runs in front of any RESTful API and can be extended through modules and plugins.”
   • [claimed-docs] “Tools for managing Konnect and Kong Gateway”
   • [probe] “PROBE openapi: all candidate paths 404 (https://developer.konghq.com/openapi.json, https://developer.konghq.com/swagger.json, https://develo…”

   proof ↗⚑ flag

   Hoppscotch✓fullprobed8/10

   Hoppscotch documents a first-party MCP server that lets an agent read and modify collections, requests, environments, and teams and send real HTTP requests, plus a CLI for terminal/automated interaction (running tests, managing collections) — both are officially documented programmatic interfaces suited to AI-native/agentic use. Missing for 10: a general public REST/OpenAPI API for the platform itself (probe found openapi.json/swagger.json all 404), so agentic access is limited to the MCP/CLI surface rather than a broader documented API.

   • [claimed-docs] “It hands the host your collections, requests, environments, and teams, so an agent can read and change them for you.”
   • [claimed-docs] “It hands the host your collections, requests, environments, and teams, so an agent can read and change them for you. It also sends real HTTP…”
   • [claimed-docs] “Use the Hoppscotch CLI to run API tests, automate monitoring, and manage collections from your terminal.”
   • [claimed-docs] “With the command-line interface (CLI) you can interact with the Hoppscotch platform using a terminal, or through an automated system. This e…”
   • [probe] “official MCP server documented at https://docs.hoppscotch.io/documentation/clients/mcp-server/overview”
   • [probe] “official CLI documented at https://docs.hoppscotch.io/documentation/clients/cli/overview”
   • [probe] “PROBE openapi: all candidate paths 404 (https://docs.hoppscotch.io/openapi.json, https://docs.hoppscotch.io/swagger.json, https://docs.hopps…”

   proof ↗⚑ flag

7. ai-native userIssue scoped/least-privilege API credentials for an agent

   weight 2 · round to Kong
   Kong~partialprobed6/10

   Kong Gateway's core auth plugins (JWT, OAuth2, ACLs, API keys) and Vaults for secret storage provide the building blocks for scoped, least-privilege credentials per consumer, and AI Gateway/Konnect docs mention defining entitlements for agent/MCP/tool consumption, suggesting credential scoping applies to agent traffic too. However, there is no dedicated, documented workflow specifically for 'issuing scoped credentials to an AI agent' — the evidence is generic auth/authz plus general entitlement language rather than a concrete agent-credential-issuance feature or example. missing for 10: a first-party doc/example showing scoped API-key/OAuth-scope issuance specifically for an agent identity, and independent/hands-on confirmation of least-privilege enforcement in agent/MCP contexts.

   • [github] “Authentication and authorization for APIs using methods like JWT, basic auth, OAuth, ACLs and more.”
   • [claimed-docs] “Vaults allow you to securely store and then reference secrets from within other entities”
   • [claimed-docs] “Vaults allow you to securely store and then reference secrets from within other entities, ensuring that secrets aren't visible in plaintext …”
   • [claimed-docs] “Define entitlements, meter, and bill against agent context consumption for everything from the agent to the LLM to the MCP server to MCP too…”
   • [github] “MCP traffic governance, MCP security and MCP observability in addition to MCP autogeneration from any RESTful API.”
   • [probe] “official MCP server documented at https://developer.konghq.com/konnect-platform/konnect-mcp/”

   proof ↗⚑ flag

   Hoppscotch—none0/10

   Hoppscotch's MCP server docs describe granting an agent full read/write access to all collections, requests, environments, and teams, with no mention of scoped, least-privileged, or permission-limited credentials for agents. No evidence describes issuing restricted API keys/tokens specifically for AI agent use.

   • [claimed-docs] “It hands the host your collections, requests, environments, and teams, so an agent can read and change them for you.”
   • [claimed-docs] “It hands the host your collections, requests, environments, and teams, so an agent can read and change them for you. It also sends real HTTP…”
   • [probe] “official MCP server documented at https://docs.hoppscotch.io/documentation/clients/mcp-server/overview”

   proof ↗⚑ flag

8. ai-native userBuild against official SDKs

   weight 2 · round drawn
   Kong—none0/10

   Evidence shows Kong offers CLIs (decK, kongctl), Admin/OpenAPI API directories, and Kong Manager UI, but no evidence of official client SDKs (e.g., language-specific libraries) for building against Kong Gateway/AI Gateway/Konnect APIs.

   • [claimed-docs] “Directory of OpenAPI specifications for various Kong APIs.”
   • [claimed-docs] “decK | Kong Docs”
   • [claimed-docs] “kongctl | Kong Docs”
   • [probe] “PROBE openapi: all candidate paths 404 (https://developer.konghq.com/openapi.json, https://developer.konghq.com/swagger.json, https://develo…”

   proof ↗⚑ flag

   Hoppscotch—none0/10

   Evidence shows Hoppscotch offers a CLI, an MCP server, and AI-assisted scripting features, but there is no mention of official client SDKs (e.g., language libraries for programmatically building or extending Hoppscotch) anywhere in the docs or GitHub feature list.

   ⚑ flag

9. ai-native userSubscribe to events via webhooks

   weight 2 · round drawn
   Kong—none0/10

   Kong is an API/AI gateway product; the evidence covers proxying, MCP, LLM routing, logging, and OpenTelemetry metrics, but there is no mention of webhook subscription or event-driven notification delivery to AI-native consumers.

   ⚑ flag

   Hoppscotch—none0/10

   Hoppscotch is an API client/testing tool; nothing in the evidence shows any webhook subscription or event-notification mechanism for AI agents—the closest agentic features (MCP server, CLI) let an agent send requests and manage collections but do not provide a way to subscribe to incoming events. No evidence of webhook support at all.

   • [claimed-docs] “It hands the host your collections, requests, environments, and teams, so an agent can read and change them for you.”
   • [claimed-docs] “It hands the host your collections, requests, environments, and teams, so an agent can read and change them for you. It also sends real HTTP…”
   • [claimed-docs] “With the command-line interface (CLI) you can interact with the Hoppscotch platform using a terminal, or through an automated system. This e…”

   proof ↗⚑ flag

Agentic features

1. ai-native userGet AI-generated insights and suggestions from my data inside the product

   weight 2 · round to Hoppscotch
   Kong—none0/10

   Kong's evidence focuses on AI Gateway/MCP traffic management (routing LLM calls, semantic security, observability plugins) but none of it shows Kong itself analyzing a user's own API/traffic data to generate AI insights or suggestions inside the product (e.g., an AI copilot summarizing gateway usage or recommending config changes). This is a plausible feature for a management platform like Konnect, so the axis applies, but no evidence supports it.

   • [github] “60+ AI features like AI observability, semantic security and caching, semantic routing and more.”
   • [claimed-docs] “AI Gateway addresses these challenges with a high-performance control plane that secures, governs, and observes AI-native systems end to end…”
   • [claimed-docs] “AI Gateway can export OpenTelemetry (OTLP) metrics for generative AI, MCP, and A2A traffic through an OpenTelemetry AI Policy.”
   • [claimed-docs] “Konnect lets you catalog, connect to, and monitor the status of all API Gateway control planes (CPs) and data plane nodes (DPs) in one place…”

   proof ↗⚑ flag

   Hoppscotch~partialclaimed5/10

   Hoppscotch docs explicitly reference AI features including renaming API requests, generating structured request payloads, and scripting for pre-request/test logic, which count as AI-generated suggestions inside the product. However, evidence does not show deeper 'insights' from data (e.g., analyzing response data, anomaly detection, test result summarization) beyond these request-authoring helpers, and there's no independent/hands-on corroboration of these AI features' quality. missing for 10: evidence of AI-generated insights from response/test data (not just request scaffolding), independent user validation of AI feature usefulness.

   • [claimed-docs] “These include renaming of API requests, generation of structured request payloads, and scripting capabilities for pre-request logic and test…”

   proof ↗⚑ flag

2. ai-native userDelegate tasks to a built-in AI assistant inside the product

   weight 3 · round to Hoppscotch
   Kong—none0/10

   Kong's evidence describes AI Gateway/MCP governance features for routing and securing AI traffic, but nothing shows Kong itself embedding a built-in assistant that a user delegates tasks to within the product UI (e.g., Konnect). Missing for 10: any documented in-product AI assistant/chat feature, evidence of task delegation to it, and independent confirmation of its use.

   • [claimed-docs] “Connectivity and governance layer for modern AI-native applications”
   • [claimed-docs] “Gain control and visibility over AI agent infrastructure with AI Gateway-driven MCP capabilities”
   • [github] “60+ AI features like AI observability, semantic security and caching, semantic routing and more.”

   proof ↗⚑ flag

   Hoppscotch~partialclaimed5/10

   Docs mention built-in AI features (auto-renaming requests, generating structured request payloads, and scripting for pre-request/test logic), showing some in-product AI delegation of specific tasks, but there's no evidence of a general-purpose conversational AI assistant that a user can delegate broader tasks to. Missing for 10: detailed documentation of assistant scope/UI, examples of multi-step task delegation, and independent/hands-on corroboration of these AI features in use.

   • [claimed-docs] “These include renaming of API requests, generation of structured request payloads, and scripting capabilities for pre-request logic and test…”

   proof ↗⚑ flag

3. ai-native userOperate the product with natural-language commands

   weight 2 · round drawn
   Kong~partialprobed6/10

   Kong ships an official Konnect MCP Server (kong-docs-66, kong-probe-3), which lets AI-native users operate Kong Konnect via natural-language commands through an MCP client, and Kong also documents AI Gateway support for AI CLIs/agent traffic (kong-docs-58). However, this NL control is scoped to Konnect cloud management rather than the core Gateway, documentation is thin (a one-line stub), and there's no independent/hands-on evidence of the breadth or reliability of natural-language operation. Missing for 10: detailed docs on supported commands/scope, independent user validation, and NL support for the open-source Gateway itself (not just Konnect).

   • [claimed-docs] “Kong Konnect MCP Server”
   • [probe] “official MCP server documented at https://developer.konghq.com/konnect-platform/konnect-mcp/”
   • [claimed-docs] “AI Gateway can proxy requests from AI command-line tools to LLM providers. This gives you centralized control over AI traffic: log all reque…”

   proof ↗⚑ flag

   Hoppscotch~partialprobed6/10

   Hoppscotch ships an official MCP server that hands an AI agent read/write access to collections, requests, environments and teams and lets it send real HTTP requests, effectively letting a natural-language-driven agent operate the product (hoppscotch-docs-10, hoppscotch-docs-22, hoppscotch-probe-3). There's also a docs page on in-app 'AI features' covering request renaming, payload generation, and script generation, suggesting some native NL-assisted actions (hoppscotch-docs-23). However, the MCP path requires an external AI client/agent rather than a built-in chat interface, and the AI-features doc is only a single thin line with no concrete examples or independent corroboration. Missing for 10: a first-party in-app natural-language command bar/chat demonstrated end-to-end, richer documentation/examples of the AI features, and independent/hands-on confirmation that these NL capabilities work as described.

   • [claimed-docs] “It hands the host your collections, requests, environments, and teams, so an agent can read and change them for you.”
   • [claimed-docs] “It hands the host your collections, requests, environments, and teams, so an agent can read and change them for you. It also sends real HTTP…”
   • [claimed-docs] “These include renaming of API requests, generation of structured request payloads, and scripting capabilities for pre-request logic and test…”
   • [probe] “official MCP server documented at https://docs.hoppscotch.io/documentation/clients/mcp-server/overview”

   proof ↗⚑ flag

Api quality

1. ai-native userExplore an interactive API reference with runnable examples

   weight 2 · round drawn
   Kong~partialprobed5/10

   Kong provides a Dev Portal that lets users browse/search API documentation and try API operations, and has an OpenAPI directory for its own APIs, which supports interactive exploration with runnable examples; however, the probe for standard OpenAPI/Swagger UI endpoints on the docs site 404'd, and there's no direct evidence of a live 'try it out' interactive console with runnable examples specifically for AI-native users. missing for 10: independent/hands-on confirmation of a runnable 'try it now' console, explicit AI-native tailoring of the interactive reference, and successful OpenAPI/swagger endpoint discovery.

   • [claimed-docs] “It enables developers to browse and search API documentation, try API operations, and manage their own credentials.”
   • [claimed-docs] “Dev Portal APIs allow you to publish APIs using OpenAPI or AsyncAPI specifications and Markdown documentation.”
   • [claimed-docs] “Directory of OpenAPI specifications for various Kong APIs.”
   • [probe] “PROBE openapi: all candidate paths 404 (https://developer.konghq.com/openapi.json, https://developer.konghq.com/swagger.json, https://develo…”

   proof ↗⚑ flag

   Hoppscotch~partialclaimed5/10

   Hoppscotch's Embed feature lets users create a mini-version of Hoppscotch embeddable in HTML pages so an audience can interact with API requests, which is a form of interactive, runnable API reference, and OpenAPI import can seed collections for such a reference. However there is no evidence of a dedicated 'API reference/documentation' generator with narrative docs plus embedded runnable examples (like Swagger UI or Postman's published docs), nor independent corroboration of the Embed feature in practice. Missing for 10: auto-generated narrative API reference pages, publishing/sharing workflow for such references, hands-on validation of the Embed feature.

   • [claimed-docs] “Embed: Create a mini-version of Hoppscotch that you can embed in an HTML page, allowing your audience to interact with your API request.”
   • [claimed-docs] “Use tags as folders when importing from OpenAPI.”
   • [claimed-docs] “You can enter the API endpoint and choose the HTTP method according to your needs from the dropdown menu. Once it is configured, click on th…”

   proof ↗⚑ flag

2. ai-native userDownload a machine-readable API spec (OpenAPI or equivalent)

   weight 2 · round to Kong
   Kong~partialprobed6/10

   Kong docs explicitly reference a 'Directory of OpenAPI specifications for various Kong APIs' (developer.konghq.com/api/), and Dev Portal supports publishing OpenAPI/AsyncAPI specs, indicating machine-readable specs exist and are downloadable. However, a direct probe for standard OpenAPI file locations (openapi.json, swagger.json, etc.) returned 404s, showing the spec isn't trivially discoverable at conventional endpoints. Missing for 10: a confirmed, directly downloadable OpenAPI/AsyncAPI file link or independent verification that the /api/ directory serves raw machine-readable spec files.

   • [claimed-docs] “Directory of OpenAPI specifications for various Kong APIs.”
   • [claimed-docs] “Dev Portal APIs allow you to publish APIs using OpenAPI or AsyncAPI specifications and Markdown documentation.”
   • [probe] “PROBE openapi: all candidate paths 404 (https://developer.konghq.com/openapi.json, https://developer.konghq.com/swagger.json, https://develo…”

   proof ↗⚑ flag

   Hoppscotch—none0/10

   A direct probe for OpenAPI/Swagger specs at the Hoppscotch docs domain returned 404 on all candidate paths, and no other evidence shows a downloadable machine-readable spec of Hoppscotch's own API surface (the only OpenAPI-related mention is about importing external OpenAPI specs into Hoppscotch, not exposing one).

   • [probe] “PROBE openapi: all candidate paths 404 (https://docs.hoppscotch.io/openapi.json, https://docs.hoppscotch.io/swagger.json, https://docs.hopps…”
   • [claimed-docs] “Use tags as folders when importing from OpenAPI.”

   proof ↗⚑ flag

3. ai-native userTest against a sandbox environment without touching production data

   weight 1 · round to Hoppscotch
   Kong—none0/10

   Kong's evidence covers DB-less/declarative deployments, Konnect control-plane/data-plane separation, and a Docker quickstart script, but none of this documents a dedicated 'sandbox environment' or test/staging mode explicitly isolated from production data for AI-native testing — the closest hint is Dev Portal's 'try API operations' feature (kong-docs-21), which is not framed as a sandbox against production. Missing for 10: explicit sandbox/staging environment documentation, mock/test data isolation for AI agent calls, and any first-party guidance on safely testing AI Gateway/MCP flows without touching production traffic.

   • [claimed-docs] “It enables developers to browse and search API documentation, try API operations, and manage their own credentials.”
   • [claimed-docs] “The script creates a Control Plane in Konnect and deploys a local Data Plane using Docker. All licensing is handled automatically by Konnect…”
   • [claimed-docs] “You can use the quickstart script to get an instance of Kong Gateway running almost instantly”
   • [github] “there is also a docker installation procedure if you’d prefer to run the Kong Gateway in DB-less mode.”

   proof ↗⚑ flag

   Hoppscotch~partialprobed3/10

   Hoppscotch supports environment/variable management (including secret variables) and the MCP server exposes environments/collections to agents so a sandbox environment could in principle be selected, but there is no explicit feature or documentation describing isolation, safety checks, or a dedicated 'sandbox vs production' mode that prevents an agent from touching production data — the MCP docs even note it 'sends real HTTP requests.' Missing for 10: explicit sandbox-environment safeguard/isolation feature, documentation of environment-scoped access control for agents, and independent evidence confirming this prevents production impact.

   • [claimed-docs] “Secret variables in environments.”
   • [claimed-docs] “Request variables.”
   • [claimed-docs] “It hands the host your collections, requests, environments, and teams, so an agent can read and change them for you. It also sends real HTTP…”
   • [probe] “official MCP server documented at https://docs.hoppscotch.io/documentation/clients/mcp-server/overview”

   proof ↗⚑ flag

4. ai-native userRely on versioned APIs with a documented deprecation policy

   weight 2 · round drawn
   Kong—none0/10

   While Kong publishes OpenAPI spec directories for its various APIs (kong-docs-9) and has extensive product documentation, no evidence in the pack describes API versioning conventions or any documented deprecation policy for Kong's own APIs (Admin API, Konnect API, AI Gateway API, etc.). The OpenAPI probe even returned 404s, and no changelog/deprecation-notice pages are cited.

   • [claimed-docs] “Directory of OpenAPI specifications for various Kong APIs.”
   • [probe] “PROBE openapi: all candidate paths 404 (https://developer.konghq.com/openapi.json, https://developer.konghq.com/swagger.json, https://develo…”

   proof ↗⚑ flag

   Hoppscotch—none0/10

   No evidence of API versioning scheme or documented deprecation policy for Hoppscotch's own APIs/products; changelog shows feature releases but no version numbers or deprecation notices. Missing for 10: versioning scheme documentation, deprecation policy, migration guides, version support timeline.

   ⚑ flag

1. ai-native userPerform bulk operations across many items at once

   weight 2 · round drawn
   Kong~partialclaimed6/10

   decK and kongctl provide declarative, bulk configuration management (sync entire API/gateway state from files) and the Admin API allows scripted bulk changes, which supports AI-native automation across many entities (routes, services, plugins) at once. However, evidence doesn't show bulk operations specifically framed for AI-native workflows (e.g., bulk operations on AI Models, MCP tools, or catalog entries) beyond general declarative config sync. missing for 10: explicit bulk operation APIs/examples for AI-specific entities (LLMs, MCP servers, agents), independent hands-on validation of bulk operation performance/reliability at scale.

   • [claimed-docs] “decK is a command line tool that facilitates API Lifecycle Automation (APIOps) by offering a comprehensive toolkit of commands designed to o…”
   • [claimed-docs] “decK | Kong Docs”
   • [claimed-docs] “kongctl | Kong Docs”
   • [github] “:8001 - configure Kong using Admin API or via [decK](https://github.com/kong/deck)”
   • [claimed-docs] “Tools for managing Konnect and Kong Gateway”

   proof ↗⚑ flag

   Hoppscotch~partialclaimed6/10

   The CLI can execute an entire collection of requests in one command with JUnit reporting, and the MCP server lets an agent read/change collections, requests, environments, and teams programmatically, both of which support automation-style bulk actions across many items. However, there's no explicit documentation of a dedicated bulk-edit/bulk-delete/bulk-update operation spanning many items at once (e.g. batch renaming, batch parameter changes) beyond running/exporting collections. missing for 10: explicit bulk edit/update/delete API or UI across many requests/items simultaneously, independent hands-on confirmation of large-scale automation runs.

   • [claimed-docs] “Use the Hoppscotch CLI to run API tests, automate monitoring, and manage collections from your terminal.”
   • [claimed-docs] “The hopp test command now has the ability to generate a JUnit Report for collection runs in the CLI.”
   • [claimed-docs] “With the command-line interface (CLI) you can interact with the Hoppscotch platform using a terminal, or through an automated system. This e…”
   • [claimed-docs] “It hands the host your collections, requests, environments, and teams, so an agent can read and change them for you. It also sends real HTTP…”
   • [claimed-docs] “It hands the host your collections, requests, environments, and teams, so an agent can read and change them for you.”

   proof ↗⚑ flag

2. ai-native userDefine rules that trigger actions automatically on events

   weight 3 · round to Kong
   Kong~partialclaimed5/10

   Kong's plugin architecture (rate-limiting, DLP/safety policies, logging, transformations) lets users define declarative rules that automatically trigger actions on gateway request/response events, and AI Gateway policies (e.g., blocking toxic content) act as automated triggers on AI traffic events. However, there's no evidence of a generic, user-authored event-trigger/automation framework (e.g., 'when X happens do Y' rules across arbitrary events) beyond the fixed set of built-in plugins/policies. Missing for 10: a flexible custom event-trigger rule engine, documentation of arbitrary event types beyond traffic/API-call lifecycle, and independent evidence of this automation working end-to-end.

   • [github] “Plugins for enforcing traffic controls, rate limiting, req/res transformations, logging, monitoring and including a plugin developer hub.”
   • [claimed-docs] “Apply safety and DLP policies to prevent toxic content and remove personally identifiable information. This can be an important part of best…”
   • [claimed-docs] “Rate Limiting - Plugin”
   • [claimed-docs] “The core of AI Gateway is the ability to serve AI Models from various AI Model Providers via a provider-agnostic API.”

   proof ↗⚑ flag

   Hoppscotch—none0/10

   Hoppscotch offers pre-request/test scripts (gh-5) and a CLI for scheduled/automated test runs (docs-8, docs-21), but there is no evidence of a rules engine or event-triggered automation (e.g., 'when X happens, do Y') as described in the story.

   ⚑ flag

3. ai-native userVersion, review, and roll back my automations

   weight 1 · round to Kong
   Kong~partialclaimed4/10

   Kong's decK tool is described as enabling 'API Lifecycle Automation (APIOps)' with a toolkit to 'orchestrate and automate' configuration processes, which implies config-as-code that could be version-controlled and reapplied, but the evidence never explicitly describes diffing, review workflows, or rollback of automations. kongctl is also mentioned only by name with no detail. missing for 10: explicit documentation of versioning/diff review, rollback commands or history, and confirmation this applies to AI agent 'automations' rather than just gateway config.

   • [claimed-docs] “decK is a command line tool that facilitates API Lifecycle Automation (APIOps) by offering a comprehensive toolkit of commands designed to o…”
   • [claimed-docs] “decK | Kong Docs”
   • [claimed-docs] “kongctl | Kong Docs”
   • [claimed-docs] “Tools for managing Konnect and Kong Gateway”

   proof ↗⚑ flag

   Hoppscotch—none0/10

   No evidence Hoppscotch offers versioning, review workflows, or rollback for automations/scripts/collections; a GitHub issue explicitly requests git-friendly storage/sync as an unmet feature, indicating this capability doesn't exist today.

   • [community] “Would be nice to sync storage over git. My team runs into this problem with Postman and any other web request UI out there - that the web re…”

   proof ↗⚑ flag

Scripting

1. developerScript pre-request and post-response logic to chain requests and massage data

   weight 2 · round to Hoppscotch
   Kong~partialclaimed4/10

   Kong's plugin architecture includes request/response transformation plugins (kong-gh-3) that let developers modify ('massage') request and response data, which partially supports the scripting/data-massaging part of the story. However, there is no evidence of an explicit scripting mechanism (e.g., pre-function/post-function or serverless script plugins) or of chaining multiple requests together in sequence. Missing for 10: documented custom-script (pre/post function) plugin capability, explicit request-chaining support, and independent confirmation of these features in practice.

   • [github] “Plugins for enforcing traffic controls, rate limiting, req/res transformations, logging, monitoring and including a plugin developer hub.”
   • [claimed-docs] “Rate Limiting - Plugin”

   proof ↗⚑ flag

   Hoppscotch~partialclaimed6/10

   GitHub feature list explicitly confirms pre-request scripting ('Snippets of code... executed before the request is sent'), and the AI-features doc mentions 'scripting capabilities for pre-request logic and test cases', implying post-response test scripts exist too. However, no dedicated documentation details post-response script syntax, variable-setting APIs, or examples of chaining/massaging data across requests. missing for 10: explicit post-response/test-script documentation, examples of setting/reading environment variables between chained requests, independent hands-on confirmation of scripting workflow.

   • [github] “Snippets of code associated with a request that is executed before the request is sent.”
   • [claimed-docs] “These include renaming of API requests, generation of structured request payloads, and scripting capabilities for pre-request logic and test…”

   proof ↗⚑ flag

Access control

1. platform-engineerControl who can view or edit APIs and collections with roles and permissions

   weight 2 · round to Hoppscotch
   Kong—none0/10

   The evidence covers Dev Portal visibility settings (public/private), Vaults for secrets, and Catalog for API inventory, but nowhere describes role-based access control or granular view/edit permissions for APIs or collections. No mention of teams, roles, or RBAC constructs in Konnect or Gateway for collaborative access management.

   ⚑ flag

   Hoppscotch~partialclaimed4/10

   Hoppscotch has team collaboration features and an admin dashboard with 'enhanced user management' plus enterprise SSO/audit logs, implying some access-control capability, but there is no explicit documentation of granular roles/permissions for viewing vs editing specific APIs or collections. missing for 10: explicit role/permission model docs (e.g. viewer vs editor roles per collection), evidence of enforcement, independent confirmation of granular access control.

   • [github] “Helps you collaborate across your teams to design, develop, and test APIs faster.”
   • [claimed-docs] “Enhanced user management in admin dashboard.”
   • [claimed-docs] “You can manage your server configurations directly from the self-host admin dashboard.”
   • [claimed-docs] “SAML-based SSO, on-prem deployment, audit logs, and more.”

   proof ↗⚑ flag

Api catalog

1. platform-engineerPublish an internal catalog or portal where teams discover and consume our APIs

   weight 2 · round to Kong
   Kong✓fullclaimed8/10

   Kong ships a dedicated Dev Portal for publishing API docs (OpenAPI/AsyncAPI, Markdown) with public or authenticated visibility so teams can browse, try operations and self-manage credentials, plus a Catalog feature that acts as a platform-level inventory across APIs, API packages, AI Models, MCP servers and agents for org-wide discovery. This directly matches the platform-engineer story of publishing an internal catalog/portal for API discovery and consumption. missing for 10: independent/hands-on evidence of the Dev Portal or Catalog in real use (only first-party docs), and more detail on cross-team governance/workflow beyond the docs descriptions.

   • [claimed-docs] “It enables developers to browse and search API documentation, try API operations, and manage their own credentials.”
   • [claimed-docs] “Catalog as one inventory across APIs, API packages, AI Models, MCP servers, and agents”
   • [claimed-docs] “Catalog gives you a platform-level home for creating, describing, and governing them.”
   • [claimed-docs] “You need to know every API, AI Model, agent, and MCP server your org has built, without checking each team's tools individually”
   • [claimed-docs] “Dev Portal APIs allow you to publish APIs using OpenAPI or AsyncAPI specifications and Markdown documentation.”
   • [claimed-docs] “Public visibility without authentication”
   • [claimed-docs] “Private visibility with authentication enabled”
   • [claimed-docs] “Catalog is where these interfaces live instead: APIs, AI Models, and more. Instead of digging through individual products to find what alrea…”
   • [claimed-docs] “Compose API packages from existing operations to serve specific partners or use cases.”

   proof ↗⚑ flag

   Hoppscotch~partialclaimed4/10

   Hoppscotch offers an 'Embed' feature to expose a mini API-interaction UI in a page and team/collection sharing for collaboration, which can serve as a lightweight internal portal, but there is no dedicated catalog/discovery portal product (no API marketplace, search, or documentation-portal feature) documented. missing for 10: a dedicated API catalog/portal product, discovery/search across published APIs, and evidence of teams actually using it as an internal developer portal.

   • [claimed-docs] “Embed: Create a mini-version of Hoppscotch that you can embed in an HTML page, allowing your audience to interact with your API request.”
   • [github] “Helps you collaborate across your teams to design, develop, and test APIs faster.”
   • [claimed-docs] “You can add multiple requests to a collection and even create subfolders inside a collection to further organize your requests.”

   proof ↗⚑ flag

Collections

1. developerStore collections as plain text files in my repo and version them with git

   weight 3 · round to Kong
   Kong~partialclaimed6/10

   Kong's decK tool supports declarative configuration files (YAML/JSON) that represent Kong's gateway config as plain text, enabling APIOps-style workflows and 'Declarative Databaseless Deployment' which is commonly stored and versioned in git repos. However, the evidence never explicitly shows a 'collections' concept (like Postman-style API collections) or an explicit git-based workflow/example — it's inferred from decK's declarative config model. Missing for 10: explicit documentation of a 'collections' artifact, an explicit git-versioning workflow/example, and confirmation this applies beyond gateway config to broader workspace collections.

   • [claimed-docs] “decK is a command line tool that facilitates API Lifecycle Automation (APIOps) by offering a comprehensive toolkit of commands designed to o…”
   • [claimed-docs] “decK | Kong Docs”
   • [github] “Sophisticated deployment models like Declarative Databaseless Deployment and Hybrid Deployment (control plane/data plane separation) without…”
   • [github] “:8001 - configure Kong using Admin API or via [decK](https://github.com/kong/deck)”

   proof ↗⚑ flag

   Hoppscotch—none0/10

   There is no evidence Hoppscotch stores collections as plain-text files suitable for git version control; instead, community evidence explicitly shows this is a requested-but-unimplemented feature (an open GitHub issue asking Hoppscotch to make storage git-friendly) and a comparison noting Bruno supports directory-based storage while Hoppscotch does not let you point a workspace to a specific directory.

   • [community] “Would be nice to sync storage over git. My team runs into this problem with Postman and any other web request UI out there - that the web re…”
   • [community] “It has a clean UI and can be self-hosted. The downside is - Only one workspace is available when offline. You can't point your Workspace dat…”

   proof ↗⚑ flag

Offline

1. developerWork fully offline in a local workspace without a cloud account

   weight 2 · round to Hoppscotch
   Kong~partialclaimed5/10

   Kong Gateway supports declarative, DB-less deployment and Docker installation that can run entirely locally without Konnect (kong-gh-4, kong-gh-7, kong-gh-20), and decK/kongctl let you manage configuration as local files (kong-docs-67, kong-docs-68). However, the documented quickstart path explicitly creates a Konnect cloud control plane and ties licensing to it (kong-docs-45), and there's no dedicated 'local workspace' concept or explicit confirmation that all features work fully offline without any Konnect account. Missing for 10: a documented fully offline quickstart/workflow that never touches Konnect, and independent confirmation of offline usage without a cloud account.

   • [github] “Sophisticated deployment models like Declarative Databaseless Deployment and Hybrid Deployment (control plane/data plane separation) without…”
   • [github] “there is also a docker installation procedure if you’d prefer to run the Kong Gateway in DB-less mode.”
   • [github] “there is also a docker installation procedure if you’d prefer to run the Kong Gateway in DB-less mode”
   • [claimed-docs] “The script creates a Control Plane in Konnect and deploys a local Data Plane using Docker. All licensing is handled automatically by Konnect…”
   • [claimed-docs] “decK | Kong Docs”
   • [claimed-docs] “kongctl | Kong Docs”

   proof ↗⚑ flag

   Hoppscotch~partialcommunity6/10

   Hoppscotch offers a desktop app, installable PWA, and self-hosted deployment with login clearly optional (hoppscotch-docs-29, hoppscotch-docs-13, hoppscotch-comm-9), supporting local/offline use without a cloud account. However, hands-on community evidence shows real limits: 'Only one workspace is available when offline. You can't point your Workspace data to a specific directory like bruno does. Self-hosting login is not possible in the desktop app' (hoppscotch-comm-10), and installing self-hosted locally was reported as unclear/undocumented at one point (hoppscotch-comm-2, hoppscotch-comm-3). Missing for 10: multi-workspace offline support, directory-based local workspace storage, and clearer first-party docs/independent confirmation of a fully-featured offline-only workflow.

   • [claimed-docs] “Hoppscotch Desktop App is a cross-platform desktop application that helps you create and manage API requests.”
   • [claimed-docs] “No installation is required.”
   • [community] “Nice. Downloaded and installed. Clean UI (almost bordering on a rip-off of Postman.. but I guess familiarity helps users get going faster). …”
   • [community] “It has a clean UI and can be self-hosted. The downside is - Only one workspace is available when offline. You can't point your Workspace dat…”
   • [community] “Am I going crazy or is there no way to install this locally apart from a 'development' setup with git clone or docker?”

   proof ↗⚑ flag

Environments

1. developerSwitch requests between dev, staging, and prod using environment variable sets

   weight 3 · round to Hoppscotch
   Kong—none0/10

   Kong's evidence covers secrets storage via Vaults (including environment-variable-backed secrets) and multi-control-plane management via Konnect/decK, but there is no documented feature for developers to define and switch between named 'dev/staging/prod' environment variable sets when making requests, as in a client-testing workflow. Missing for 10: explicit environment/variable-set switching UI or config, evidence of per-environment variable collections, and any workflow tying such sets to request execution.

   • [claimed-docs] “Vaults allow you to securely store and then reference secrets from within other entities, ensuring that secrets aren't visible in plaintext …”
   • [claimed-docs] “You can add secrets to Vaults in one of the following ways: * Environment variables * Konnect Config Store * Supported third-party backend v…”
   • [claimed-docs] “decK | Kong Docs”
   • [claimed-docs] “The script creates a Control Plane in Konnect and deploys a local Data Plane using Docker. All licensing is handled automatically by Konnect…”

   proof ↗⚑ flag

   Hoppscotch~partialclaimed5/10

   Docs confirm the existence of an environments system (with secret variables and request variables that resolve within environments), implying multiple environment sets can be defined and swapped, but no direct evidence describes selecting/switching between dev/staging/prod environments or a dropdown UI for env selection. missing for 10: explicit documentation or screenshot of environment switcher UI, workflow for maintaining separate dev/staging/prod variable sets, and independent/community confirmation of this specific switching behavior.

   • [claimed-docs] “Secret variables in environments.”
   • [claimed-docs] “Request variables.”

   proof ↗⚑ flag

Secrets

1. platform-engineerKeep credentials out of shared files with masked secrets or an external vault integration

   weight 2 · round to Kong
   Kong✓fullclaimed8/10

   Kong Gateway's Vaults feature explicitly lets platform engineers store secrets outside plaintext config and reference them via environment variables, Konnect Config Store, or third-party vault backends (e.g., HashiCorp Vault), ensuring secrets aren't visible in plaintext throughout the platform. This directly matches the story of masking secrets and integrating with external vaults. Missing for 10: independent/hands-on validation of the vault integration beyond first-party docs, and more detail on which third-party backends are supported.

   • [claimed-docs] “Vaults allow you to securely store and then reference secrets from within other entities”
   • [claimed-docs] “Vaults allow you to securely store and then reference secrets from within other entities. This ensures that secrets aren't visible in plaint…”
   • [claimed-docs] “Vaults allow you to securely store and then reference secrets from within other entities, ensuring that secrets aren't visible in plaintext …”
   • [claimed-docs] “You can add secrets to Vaults in one of the following ways: * Environment variables * Konnect Config Store * Supported third-party backend v…”

   proof ↗⚑ flag

   Hoppscotch~partialclaimed6/10

   Hoppscotch docs explicitly list 'Secret variables in environments' as a changelog feature, directly matching the masked-secrets need, and self-host docs mention on-prem deployment and audit logs for enterprise-grade control. However, there is no evidence of an external vault integration (e.g., Vault, AWS Secrets Manager) or independent/hands-on confirmation of how secret variables are masked in shared collection files. Missing for 10: external vault/secret-manager integration, hands-on verification that secrets are excluded from exported/shared collection files, and independent corroboration beyond the vendor changelog.

   • [claimed-docs] “Secret variables in environments.”
   • [claimed-docs] “SAML-based SSO, on-prem deployment, audit logs, and more.”
   • [claimed-docs] “Self-host Hoppscotch on your own infrastructure with full data ownership.”

   proof ↗⚑ flag

Gateway ops

1. platform-engineerManage API infrastructure as declarative config and sync it from CI (GitOps/APIOps)

   weight 2 · round to Kong
   Kong✓fullclaimed8/10

   decK and kongctl are dedicated CLIs for declarative APIOps, explicitly designed for CI-driven sync of Kong config (declarative databaseless deployment, Admin API/decK configuration), which directly matches the GitOps/APIOps story. missing for 10: no explicit worked CI pipeline example (e.g., GitHub Actions) or independent case study confirming production GitOps workflows.

   • [claimed-docs] “decK is a command line tool that facilitates API Lifecycle Automation (APIOps) by offering a comprehensive toolkit of commands designed to o…”
   • [claimed-docs] “Tools for managing Konnect and Kong Gateway”
   • [claimed-docs] “decK | Kong Docs”
   • [claimed-docs] “kongctl | Kong Docs”
   • [github] “Sophisticated deployment models like Declarative Databaseless Deployment and Hybrid Deployment (control plane/data plane separation) without…”
   • [github] “:8001 - configure Kong using Admin API or via [decK](https://github.com/kong/deck)”
   • [github] “there is also a docker installation procedure if you’d prefer to run the Kong Gateway in DB-less mode”

   proof ↗⚑ flag

   Hoppscotch—none0/10

   Hoppscotch offers a CLI for running collections in CI (docs-8) and a self-host admin dashboard for server settings (docs-6), but there is no evidence of declarative, git-syncable configuration for API infrastructure/gateway routing—in fact a long-standing community request for git-friendly collection storage remains unresolved (comm-14), indicating this GitOps/APIOps capability is not delivered.

   • [claimed-docs] “Use the Hoppscotch CLI to run API tests, automate monitoring, and manage collections from your terminal.”
   • [claimed-docs] “You can manage your server configurations directly from the self-host admin dashboard.”
   • [community] “Would be nice to sync storage over git. My team runs into this problem with Postman and any other web request UI out there - that the web re…”

   proof ↗⚑ flag

Monitoring

1. platform-engineerMonitor API traffic with metrics, logging, and tracing integrations

   weight 2 · round to Kong
   Kong~partialcommunity7/10

   Kong ships built-in plugins for traffic controls, logging, and monitoring (kong-gh-3), Konnect provides status monitoring of control/data planes (kong-docs-46), and AI Gateway explicitly supports OpenTelemetry (OTLP) metrics export for AI/MCP/A2A traffic plus file/docker logs (kong-docs-61, kong-docs-69). However, a community GitHub issue reports a real production case where Kong logging failed to surface 404 errors during cache rebuilding (kong-comm-1, kong-comm-2), showing logging gaps in practice, and the evidence pack lacks explicit documentation of a dedicated distributed-tracing integration (e.g., Zipkin/Jaeger) beyond OTel metrics. missing for 10: explicit tracing plugin/integration docs, and stronger independent confirmation that logging reliably surfaces all traffic issues.

   • [github] “Plugins for enforcing traffic controls, rate limiting, req/res transformations, logging, monitoring and including a plugin developer hub.”
   • [claimed-docs] “Konnect lets you catalog, connect to, and monitor the status of all API Gateway control planes (CPs) and data plane nodes (DPs) in one place…”
   • [claimed-docs] “AI Gateway can export OpenTelemetry (OTLP) metrics for generative AI, MCP, and A2A traffic through an OpenTelemetry AI Policy.”
   • [claimed-docs] “By default, you can view AI Gateway logs at `/usr/local/kong/logs/error.log`. If you're running an AI Gateway data plane in Docker, you can …”
   • [community] “We have noticed in our Kong Gateway nodes times when common endpoints throw 404 route not found on a % of API calls... nothing in Kong loggi…”
   • [community] “To us the behavior points to cache rebuilding during new resource creation... production has not seen this issue with identical Kong configu…”

   proof ↗⚑ flag

   Hoppscotch—none0/10

   Hoppscotch is an API client/testing tool; evidence covers request building, collections, CLI testing, self-hosting, SSO, and audit logs, but nothing describes metrics export, logging pipelines, or tracing integrations for monitoring API traffic (e.g., no OpenTelemetry, Prometheus, or log-shipping integrations mentioned). This axis is plausible for a platform aimed at API teams, so absence of evidence yields 'none' rather than 'na'.

   • [claimed-docs] “With the command-line interface (CLI) you can interact with the Hoppscotch platform using a terminal, or through an automated system. This e…”
   • [claimed-docs] “SAML-based SSO, on-prem deployment, audit logs, and more.”
   • [claimed-docs] “SAML-based SSO, on-prem deployment, audit logs, and more. Hoppscotch Enterprise Edition is a self-hosted version of Hoppscotch Cloud with en…”

   proof ↗⚑ flag

1. ai-native userDo everything through the API that I can do in the UI

   weight 2 · round to Kong
   Kong✓fullclaimed7/10

   Kong Gateway's Admin API is the canonical configuration interface, with Kong Manager UI and decK/kongctl CLI explicitly built on top of it (kong-gh-10, kong-gh-11, kong-docs-67/68), implying API-UI parity by design, and Kong also publishes OpenAPI specs for its APIs (kong-docs-9). Missing for 10: an explicit first-party statement guaranteeing 100% UI/API feature parity (especially for Konnect SaaS UI features) and independent confirmation that no UI-only features exist.

   • [github] “:8001 - configure Kong using Admin API or via [decK](https://github.com/kong/deck)”
   • [github] “:8002 - access Kong's management Web UI ([Kong Manager](https://github.com/Kong/kong-manager)) on [localhost:8002](http://localhost:8002)”
   • [claimed-docs] “Directory of OpenAPI specifications for various Kong APIs.”
   • [claimed-docs] “decK | Kong Docs”
   • [claimed-docs] “kongctl | Kong Docs”
   • [claimed-docs] “Tools for managing Konnect and Kong Gateway”

   proof ↗⚑ flag

   Hoppscotch~partialprobed5/10

   Hoppscotch offers a CLI for running tests/monitoring/collection management and an MCP server that lets an agent read and modify collections, requests, environments, and teams and send real HTTP requests, giving substantial programmatic parity with core UI actions. However, there is no documented general-purpose REST/GraphQL API (probe found no OpenAPI/swagger spec), and features like team collaboration, SSO/admin settings, or UI-specific extras (themes, PWA, client certs) aren't shown as scriptable. Missing for 10: a documented public API covering full UI feature parity, evidence for automating admin/enterprise/team-collab features, and independent confirmation of CLI/MCP completeness.

   • [claimed-docs] “Use the Hoppscotch CLI to run API tests, automate monitoring, and manage collections from your terminal.”
   • [claimed-docs] “With the command-line interface (CLI) you can interact with the Hoppscotch platform using a terminal, or through an automated system. This e…”
   • [claimed-docs] “It hands the host your collections, requests, environments, and teams, so an agent can read and change them for you. It also sends real HTTP…”
   • [probe] “official MCP server documented at https://docs.hoppscotch.io/documentation/clients/mcp-server/overview”
   • [probe] “official CLI documented at https://docs.hoppscotch.io/documentation/clients/cli/overview”
   • [probe] “PROBE openapi: all candidate paths 404 (https://docs.hoppscotch.io/openapi.json, https://docs.hoppscotch.io/swagger.json, https://docs.hopps…”

   proof ↗⚑ flag

2. ai-native userExport all of my data in open formats and leave

   weight 3 · round to Kong
   Kong~partialclaimed6/10

   Kong's decK tool lets users declaratively dump and sync Gateway/Konnect configuration (routes, services, plugins) as open YAML/JSON files, and Kong explicitly touts 'databaseless deployment... without any vendor lock-in,' supporting a form of open, portable data export. However this only covers gateway configuration, not broader platform data (analytics, logs, catalog, dev-portal content), and there's no explicit documented full-account data export/deletion workflow. Missing for 10: a documented full data-export/account-closure process covering all Konnect/Catalog/Dev Portal data, and independent confirmation that decK exports are complete and lossless.

   • [claimed-docs] “decK is a command line tool that facilitates API Lifecycle Automation (APIOps) by offering a comprehensive toolkit of commands designed to o…”
   • [claimed-docs] “decK | Kong Docs”
   • [github] “Sophisticated deployment models like Declarative Databaseless Deployment and Hybrid Deployment (control plane/data plane separation) without…”
   • [claimed-docs] “Tools for managing Konnect and Kong Gateway”

   proof ↗⚑ flag

   Hoppscotch~partialclaimed5/10

   Hoppscotch is fully open-source (MIT) and can be self-hosted with 'full data ownership' (hoppscotch-docs-11, hoppscotch-docs-14, hoppscotch-docs-24), and its CLI/MCP server can read and manage collections, environments and requests in structured form (hoppscotch-docs-8, hoppscotch-docs-10, hoppscotch-docs-22), implying data is accessible outside the UI. However, there is no explicit documentation of a dedicated 'export' feature or open file format (e.g. JSON export of collections) for a user to take their data and leave, only import (cURL, OpenAPI) is explicitly evidenced. missing for 10: explicit export/download-my-data feature documentation, confirmation of an open interchange format for collections/environments, independent confirmation that self-hosted data is fully portable without vendor lock-in.

   • [claimed-docs] “Hoppscotch Community Edition is free and open-source. It is licensed under the MIT License.”
   • [claimed-docs] “Self-host Hoppscotch on your own infrastructure with full data ownership.”
   • [claimed-docs] “For full data ownership and control over your API development and testing, you can self-host Hoppscotch on your infrastructure.”
   • [claimed-docs] “Use the Hoppscotch CLI to run API tests, automate monitoring, and manage collections from your terminal.”
   • [claimed-docs] “It hands the host your collections, requests, environments, and teams, so an agent can read and change them for you.”
   • [claimed-docs] “It hands the host your collections, requests, environments, and teams, so an agent can read and change them for you. It also sends real HTTP…”
   • [github] “Import cURL”

   proof ↗⚑ flag

3. ai-native userRead the product's source under an open license

   weight 2 · round to Hoppscotch
   Kong~partialclaimed6/10

   The GitHub repo (Kong/kong) is publicly visible and used for docs, issues, and quickstart instructions, indicating the core gateway source is readable in the open, but no evidence pack item explicitly states the license (e.g., Apache-2.0) or confirms all components (AI Gateway, Konnect, plugins) are open-sourced rather than proprietary SaaS add-ons. missing for 10: explicit license statement/file, confirmation that AI Gateway/Konnect/enterprise pieces are also open-source, independent corroboration of license terms.

   • [github] “Let’s test drive Kong by adding authentication to an API in under 5 minutes.”
   • [github] “there is also a docker installation procedure if you’d prefer to run the Kong Gateway in DB-less mode.”
   • [github] “Let's test drive Kong by adding authentication to an API in under 5 minutes.”
   • [github] “there is also a docker installation procedure if you’d prefer to run the Kong Gateway in DB-less mode”

   proof ↗⚑ flag

   Hoppscotch✓fullcommunity8/10

   Hoppscotch's Community Edition source is publicly hosted on GitHub and documented as MIT-licensed, satisfying the 'read source under open license' story with an active, browsable repo (hoppscotch-docs-11, hoppscotch-gh-1..11). Missing for 10: no explicit clarification of licensing for the separate enterprise/self-host admin features, and community commentary notes it is 'open core' with some contributed functionality restricted (hoppscotch-comm-7, hoppscotch-comm-8), which is a scope caveat rather than a contradiction of the core MIT-licensed repo.

   • [claimed-docs] “Hoppscotch Community Edition is free and open-source. It is licensed under the MIT License.”
   • [github] “Import cURL”
   • [community] “I believe both Bruno and Hoppscotch are 'open core' with expensive paid plans for additional/enterprise functionality, and they limit commun…”
   • [community] “Going to leave this here for shady practices. A pull request was declined by the CEO since they were planning to build an OIDC feature into …”

   proof ↗⚑ flag

4. ai-native userSelf-host the core product

   weight 3 · round to Kong
   Kong✓fullclaimed9/10

   Kong Gateway is open-source (GitHub repo) and explicitly supports self-hosted deployment models including Docker, DB-less, and Hybrid deployments 'without any vendor lock-in', with admin API/decK for configuration and a quickstart script for local setup. This covers the core gateway/AI Gateway functionality, not just the SaaS Konnect offering. Missing for 10: no independent third-party confirmation of large-scale self-hosted production use, and some newer AI/MCP capabilities (Catalog, Konnect MCP Server) appear tied to the Konnect SaaS platform rather than self-hosted core.

   • [github] “Sophisticated deployment models like Declarative Databaseless Deployment and Hybrid Deployment (control plane/data plane separation) without…”
   • [github] “there is also a docker installation procedure if you’d prefer to run the Kong Gateway in DB-less mode.”
   • [github] “:8001 - configure Kong using Admin API or via [decK](https://github.com/kong/deck)”
   • [claimed-docs] “Kong Gateway runs in front of any RESTful API and can be extended through modules and plugins.”
   • [claimed-docs] “You can use the quickstart script to get an instance of Kong Gateway running almost instantly”
   • [github] “Kong runs natively on Kubernetes thanks to its official Kubernetes Ingress Controller.”

   proof ↗⚑ flag

   Hoppscotch✓fullcommunity8/10

   Hoppscotch documents a full self-host path (open-source MIT Community Edition, dedicated self-host getting-started guide, admin dashboard for server config, full data ownership) confirming the core product can run on a user's own infrastructure. Some older community comments note friction in the self-host setup process, but they don't contradict the current documented capability. Missing for 10: independent hands-on verification of a smooth current self-host deployment and more detail on infra requirements/scaling.

   • [claimed-docs] “Hoppscotch Community Edition is free and open-source. It is licensed under the MIT License.”
   • [claimed-docs] “SAML-based SSO, on-prem deployment, audit logs, and more.”
   • [claimed-docs] “Self-host Hoppscotch on your own infrastructure with full data ownership.”
   • [claimed-docs] “For full data ownership and control over your API development and testing, you can self-host Hoppscotch on your infrastructure.”
   • [claimed-docs] “SAML-based SSO, on-prem deployment, audit logs, and more. Hoppscotch Enterprise Edition is a self-hosted version of Hoppscotch Cloud with en…”
   • [claimed-docs] “You can manage your server configurations directly from the self-host admin dashboard.”
   • [community] “Am I going crazy or is there no way to install this locally apart from a 'development' setup with git clone or docker?”
   • [community] “I only wish they can provide a self-hosting step.”

   proof ↗⚑ flag

1. ai-native userChoose where my data is stored (region/residency)

   weight 2 · round to Hoppscotch
   Kong—none0/10

   Kong is self-hostable (Gateway can be deployed anywhere, giving implicit data-location control), but the evidence pack contains no explicit region/residency selection feature, no Konnect region options, and no documentation letting a user choose where data is stored.

   ⚑ flag

   Hoppscotch~partialclaimed6/10

   Hoppscotch supports self-hosting on your own infrastructure with 'full data ownership' and on-prem deployment (Enterprise), which indirectly lets users control where their data resides by choosing their own hosting location, rather than offering explicit region-selection within a managed cloud service. missing for 10: an explicit region/residency selector in the hosted Hoppscotch Cloud offering, and independent confirmation of data-location controls.

   • [claimed-docs] “Self-host Hoppscotch on your own infrastructure with full data ownership.”
   • [claimed-docs] “For full data ownership and control over your API development and testing, you can self-host Hoppscotch on your infrastructure.”
   • [claimed-docs] “SAML-based SSO, on-prem deployment, audit logs, and more. Hoppscotch Enterprise Edition is a self-hosted version of Hoppscotch Cloud with en…”
   • [claimed-docs] “SAML-based SSO, on-prem deployment, audit logs, and more.”

   proof ↗⚑ flag

2. ai-native userPrevent my data from being used to train AI models

   weight 3 · round drawn
   Kong—none0/10

   Kong's AI Gateway evidence covers traffic routing, semantic security/caching, observability, and MCP governance, but nothing in the pack addresses controlling or opting out of AI model training on user data. Missing for 10: any documented feature or policy for preventing data from being used in model training (e.g., zero-retention enforcement, provider opt-out headers, data-use contracts).

   • [claimed-docs] “Connectivity and governance layer for modern AI-native applications”
   • [github] “60+ AI features like AI observability, semantic security and caching, semantic routing and more.”
   • [github] “advanced AI traffic capabilities with multi-LLM support, semantic security, MCP traffic security and analytics”

   proof ↗⚑ flag

   Hoppscotch—none0/10

   No evidence in the pack addresses AI-training data usage, opt-out settings, or a privacy policy statement about model training; self-hosting for data ownership is documented but does not speak to whether cloud/AI features use data for training.

   ⚑ flag

3. ai-native userControl data retention and deletion

   weight 2 · round to Hoppscotch
   Kong—none0/10

   Kong's AI Gateway docs cover logging locations, DLP/PII redaction, and secrets vaulting, but there is no documented capability for AI-native users to set data retention windows or explicitly delete stored logs/request data. missing for 10: retention policy configuration, data deletion/purge mechanism, user-facing controls over stored AI traffic data.

   • [claimed-docs] “Apply safety and DLP policies to prevent toxic content and remove personally identifiable information. This can be an important part of best…”
   • [claimed-docs] “By default, you can view AI Gateway logs at `/usr/local/kong/logs/error.log`. If you're running an AI Gateway data plane in Docker, you can …”
   • [claimed-docs] “Vaults allow you to securely store and then reference secrets from within other entities, ensuring that secrets aren't visible in plaintext …”

   proof ↗⚑ flag

   Hoppscotch~partialclaimed4/10

   Hoppscotch offers self-hosting with 'full data ownership' and is open-source (MIT), which lets an organization control where data lives and effectively manage retention/deletion by owning the infrastructure. However, there is no explicit documentation of account/data deletion tools, configurable retention periods, or export/erasure APIs for the cloud-hosted version. Missing for 10: explicit data retention/deletion controls or APIs, documented GDPR-style erasure workflow, and independent confirmation that self-hosting alone satisfies deletion requirements.

   • [claimed-docs] “Self-host Hoppscotch on your own infrastructure with full data ownership.”
   • [claimed-docs] “Hoppscotch Community Edition is free and open-source. It is licensed under the MIT License.”
   • [claimed-docs] “SAML-based SSO, on-prem deployment, audit logs, and more.”

   proof ↗⚑ flag

4. ai-native userOpt out of telemetry and usage tracking

   weight 2 · round drawn
   Kong—none0/10

   No evidence in the pack addresses telemetry opt-out or usage tracking controls for Kong products; nothing documents a privacy/telemetry setting.

   ⚑ flag

   Hoppscotch—none0/10

   No evidence pack item addresses telemetry, analytics, or opt-out settings for Hoppscotch; self-hosting is mentioned as giving 'full data ownership' but that is distinct from an explicit telemetry opt-out control.

   ⚑ flag

Docs generation

1. developerGenerate and publish API documentation from my collections or specs

   weight 2 · round to Kong
   Kong✓fullclaimed7/10

   Kong's Dev Portal explicitly lets developers publish APIs using OpenAPI or AsyncAPI specifications plus Markdown documentation, with configurable public/private visibility, and lets consumers browse/search that documentation and manage credentials — directly matching the story of generating and publishing docs from specs. Missing for 10: explicit support for importing arbitrary 'collections' (e.g., Postman-style) rather than just OpenAPI/AsyncAPI specs, and independent/hands-on corroboration beyond first-party docs.

   • [claimed-docs] “Dev Portal APIs allow you to publish APIs using OpenAPI or AsyncAPI specifications and Markdown documentation.”
   • [claimed-docs] “It enables developers to browse and search API documentation, try API operations, and manage their own credentials.”
   • [claimed-docs] “Public visibility without authentication”
   • [claimed-docs] “Private visibility with authentication enabled”
   • [claimed-docs] “Directory of OpenAPI specifications for various Kong APIs.”

   proof ↗⚑ flag

   Hoppscotch—none0/10

   Hoppscotch offers OpenAPI import and an 'Embed' feature to share interactive requests, but there is no evidence of an actual documentation-generation/publishing feature from collections or specs; a community review explicitly notes 'Can't create documentation for a folder/request', directly indicating this capability is absent.

   • [claimed-docs] “Embed: Create a mini-version of Hoppscotch that you can embed in an HTML page, allowing your audience to interact with your API request.”
   • [claimed-docs] “Use tags as folders when importing from OpenAPI.”
   • [community] “It has a clean UI and can be self-hosted. The downside is - Only one workspace is available when offline. You can't point your Workspace dat…”

   proof ↗⚑ flag

Spec import export

1. developerDesign an API spec-first and export it as OpenAPI

   weight 2 · round drawn
   Kong—none0/10

   Kong's docs show it can import/publish existing OpenAPI specs (e.g., Dev Portal publishing APIs using OpenAPI/AsyncAPI, decK declarative config) but there is no evidence of a spec-first design/authoring workflow or an OpenAPI export feature for specs created within Kong. missing for 10: a spec-design/editor capability, evidence of generating/exporting an OpenAPI document from a user-authored spec.

   • [claimed-docs] “Dev Portal APIs allow you to publish APIs using OpenAPI or AsyncAPI specifications and Markdown documentation.”
   • [claimed-docs] “Directory of OpenAPI specifications for various Kong APIs.”
   • [claimed-docs] “decK is a command line tool that facilitates API Lifecycle Automation (APIOps) by offering a comprehensive toolkit of commands designed to o…”

   proof ↗⚑ flag

   Hoppscotch—none0/10

   Evidence shows Hoppscotch can import OpenAPI specs (e.g., using tags as folders when importing) but there is no mention of designing an API spec-first and exporting it as OpenAPI; the only OpenAPI-related capability documented is import, not export.

   • [claimed-docs] “Use tags as folders when importing from OpenAPI.”

   proof ↗⚑ flag

2. developerImport an OpenAPI spec to generate requests and collections

   weight 3 · round to Hoppscotch
   Kong~partialclaimed3/10

   Kong's Dev Portal can publish APIs from OpenAPI/AsyncAPI specs and lets developers 'browse and search API documentation, try API operations' (kong-docs-21, kong-docs-49), which is loosely analogous to generating requests from a spec, but there's no evidence of a Postman-like 'collections' concept or explicit request/collection generation workflow. missing for 10: explicit OpenAPI-import-to-request/collection generation feature, evidence of a collections concept, and any hands-on demonstration of this workflow.

   • [claimed-docs] “It enables developers to browse and search API documentation, try API operations, and manage their own credentials.”
   • [claimed-docs] “Dev Portal APIs allow you to publish APIs using OpenAPI or AsyncAPI specifications and Markdown documentation.”
   • [claimed-docs] “Directory of OpenAPI specifications for various Kong APIs.”

   proof ↗⚑ flag

   Hoppscotch~partialclaimed6/10

   Docs explicitly mention OpenAPI import ('Use tags as folders when importing from OpenAPI') implying native OpenAPI import into collections, alongside cURL import and collection/folder organization features. However, there's no detailed documentation on the full import workflow (e.g., generating requests from spec, handling auth/schemas) or independent/hands-on confirmation of fidelity. missing for 10: detailed OpenAPI import workflow docs, independent/hands-on validation of spec-to-collection accuracy.

   • [claimed-docs] “Use tags as folders when importing from OpenAPI.”
   • [github] “Keep your API requests organized with collections and folders. Reuse them with a single click.”
   • [github] “Import cURL”

   proof ↗⚑ flag

Contract testing

1. platform-engineerValidate live responses against the API contract to catch drift

   weight 2 · round drawn
   Kong—none0/10

   Kong is an API gateway/traffic management platform with plugins for routing, security, rate limiting, and AI/MCP governance, but there is no evidence of a contract-testing or response-validation-against-spec feature to catch API drift; this is a testing/mocking capability that a full lifecycle toolchain could offer but Kong's evidence pack shows no such capability.

   ⚑ flag

   Hoppscotch—none0/10

   Evidence shows Hoppscotch supports API testing scripts, CLI test runs with JUnit reports, and OpenAPI import for building requests/collections, but nothing describes validating live responses against an API contract (e.g., OpenAPI schema) to detect drift.

   ⚑ flag