Teleport is an open-source tool that provides identity and access management (IAM), access control and zero trust access to servers, databases, cloud applications, Kubernetes clusters, Git repositories, Model Context Protocol (MCP) servers, and web applications. It also provides access control and security for artificial intelligence models and computing environments, including large language models and agentic AI. It can eliminate the need for VPNs by providing a single gateway to access computing infrastructure via SSH, Remote Desktop Protocol, HTTPS, Kubernetes, and cloud consoles via a built-in proxy.
History Teleport began as an open-source library used by the Gravity project to enable secure software deployments into restricted and regulated environments. Gravitational was a member of the 2015 Y Combinator cohort, and Teleport was originally released in June 2016. Teleport was open sourced as a standalone tool by Gravitational Inc. in 2016. It is currently deployed in production by Samsung, NASDAQ, IBM, Ticketmaster, Epic Games and others. It has been publicly audited by technology security companies like Cure 53 and Doyensec. Teleport 3.0 was released in October 2018 and introduced Kubernetes integration. Version 4.0 was released in 2019 and included support for IoT infrastructure and products. In December 2023, Teleport announced a change in the license of their source code from the previously used Apache 2.0 License to the AGPLv3 license. Teleport 18.0.0 and 18.1.0 were released in July 2025, introducing cross-system identity activity traceability, per-session multi-factor authentication for databases, and automated access request reviews. 18.1.0 introduced support for MCP servers and database access, allowing MCP clients like Claude Desktop to execute queries in protected databases. Teleport 18.2.0, released in September 2025, introduced Al-generated summaries for SSH, Kubernetes and database session logs. The open-source version of Teleport is known as Teleport Community and remains available for download on company's GitHub. Gravitational Inc also offers a commercial version of Teleport (Teleport Enterprise) for securing enterprise development environments. Teleport is used by more than 500 organizations globally, including three of the top five largest financial services firms and three of the top ten largest software companies in the world.
Architecture Teleport is written in Go programming language and runs on UNIX-compatible operating systems, including Linux, macOS, and several BSD variants. Teleport consists of two executables: tsh (command line client) and teleport (server daemon). The teleport server daemon can run in the following modes:
Node: In this mode, the daemon is providing SSH and Kubernetes access to the server it is running on. Proxy: In this mode, the daemon is acting as an identity-aware proxy for all protocols supported by Teleport. Currently, this includes SSH, HTTPS, and Kubernetes API. Auth Server: In this mode, the daemon acts as a certificate authority that all other daemons must authenticate with. The auth server is issuing certificates for users and for servers and stores the audit log.
Features Teleport provides the following features, as detailed on GitHub:
Access Proxy Teleport proxy provides SSH and HTTPs access to servers, applications, and Kubernetes clusters across multiple data centers, cloud providers, and edge devices. The proxy is identity-aware, and only allows certificate-based authentication by integrating with an identity provider such as Okta, GitHub, Microsoft Entra ID, Active Directory, and others.
Audit and Session Recording Teleport collects an audit trail of system events across all servers it is installed on and stores them in an audit log for compliance purposes. Auditable events include authentication attempts, file transfers, network connections, and file system changes made during an SSH session. The audit log can be stored on an encrypted file system or a cloud data store. Hardware security modules can also be used to encrypt session recordings prior to uploading them to storage. Teleport records interactive user sessions for SSH and Kubernetes protocols and stores them in the audit log. Stored sessions can be replayed via a built-in session player. Teleport uses eBPF for the low latency kernel level session recording. Al Session Summaries, released in Teleport 18.2.0, allows administrators to generate and view session recording summaries during review of shell and database sessions.
Just-in-Time (JIT) Access Teleport users can request a one-time elevation of permissions to complete a privileged task. These elevated privileges are granted through certificates that expire automatically. Requests can be approved or denied via chat ops tools such as Slack, Mattermost, PagerDuty, Discord, or custom workflows via the Teleport API.
MCP and AI Access Teleport places identity-aware policy enforcement between MCP clients and servers. This is used to ensure all tool invocations are authenticated, authorized, and auditable to protect proprietary systems or sensitive data sources from unauthorized access or security threats such as prompt injection. Short-lived certificates ensure that bots and agents are not left unattended with API keys or access tokens.
Passwordless Authentication Teleport uses identity-based cryptography to issue cryptographic identities to users, machines, workloads, devices, and protected resources involved in infrastructure access. These identities are tied to a biometric or comparable attribute, such as a Trusted Platform Module or secure enclave for Apple hardware. This provides passwordless access to resources like servers, databases, Kubernetes clusters, and internal web apps without usernames, passwords, private keys, or other exploitable secrets.
Principle-of-Least-Privilege (PoLP) Teleport is used to enforce the principle of least privilege uniformly across distributed and complex computing environments such as multicloud, hybrid cloud, containerized, or remote on-premises infrastructure. This also includes LLM, MCP, and AI agent infrastructure.
… excerpt ends here. Continue reading the full article.
