Teleport alternatives: JumpServer, Warpgate, Boundary, Pomerium

Teleport is an access platform: it puts certificates, roles and recording in front of Linux and OpenSSH servers, Kubernetes, databases, web and TCP apps, Windows desktops and cloud consoles. Subnomic covers part of that (servers, Kubernetes, databases and internal apps) and adds hosting: static sites, S3-compatible storage, a container registry and an assistant that works across them. The list below compares the tools people most often weigh against it, then Teleport and Subnomic in detail.

The short answer

An open-source bastion you run yourself: JumpServer for the widest protocol list, Warpgate for a single binary with no client software.
Identity-based access with workers that dial out: HashiCorp Boundary.
Web apps and MCP servers behind single sign-on: Pomerium.
A private network rather than a gateway: Tailscale.
Access with rules on each command, plus hosting in the same workspace: Subnomic.

The alternatives

JumpServer

An open-source privileged access management platform, in its own words.

Reaches SSH, RDP, VNC, databases, Kubernetes and websites; Oracle and SQL Server are Enterprise only.
A bastion that connects to your assets, through gateway servers for networks it cannot reach directly.
Self-hosted, GPL-3.0. Community is free for up to 5,000 assets, with session recording and audit; Enterprise is quoted.
Its repository says the V3 Community Edition reaches end of life on 31 December 2026.

Fits: a team that wants a full open-source PAM on its own servers, Windows included.

Warpgate

A bastion for SSH, HTTPS, Kubernetes, databases and RDP/VNC that needs no client-side software.

Reaches SSH, HTTPS, RDP, VNC, Kubernetes, PostgreSQL and MySQL targets.
One binary on a bastion host hands each connection to its target; nothing is installed on targets, though SSH targets trust Warpgate’s key.
Self-hosted, Apache-2.0, no paid plan documented.
Replays SSH, Kubernetes, RDP and VNC sessions; databases get query logs.

Fits: a small team that wants a light, self-hosted bastion where people keep using ssh and psql.

HashiCorp Boundary

Identity-based access to servers, databases and applications.

Reaches TCP, SSH, RDP, HTTPS, Kubernetes and databases.
Workers carry the sessions; in a multi-hop setup each worker connects outbound to the one above it, so targets need only outbound connectivity.
HCP Boundary is managed, Boundary Enterprise self-managed; the source is under the Business Source License 1.1.
Session recording for SSH and RDP, on HCP Plus and Enterprise.

Fits: organisations already on HashiCorp tools that want just-in-time network access tied to identity.

Pomerium

An open-source identity-aware proxy built around zero trust.

Reaches web apps, TCP services (SSH, RDP, Postgres, MySQL, Redis) and the Kubernetes API, and proxies MCP servers on all plans.
A proxy you run, with a network route to what it protects; Pomerium Zero adds a managed control plane.
Core is Apache 2.0; Zero Personal is free for personal use.
SSH session recording and playback are Enterprise only.

Fits: putting internal web apps and MCP servers behind single sign-on.

StrongDM

A zero trust privileged access management platform, now part of Delinea.

Reaches SSH, RDP, Kubernetes, many databases, websites and cloud consoles.
Gateways, usually exposed to the internet, with relays that dial out to them; or proxy clusters behind your load balancers.
Commercial; no published price, a free trial.
Replays sessions; an MCP Gateway proxies MCP servers as part of its Secure AI offering.

Fits: enterprises that want a managed PAM with a long list of database and cloud targets.

Tailscale

A private network between your devices, rather than a gateway in front of them.

Devices connect across NAT and firewalls without port forwarding; Tailscale SSH is on all plans.
Free for up to 6 users with unlimited devices.
Replayable recordings move to Tailscale PAM, in beta and sold separately.

Fits: people who need the network itself, so every TCP tool works.

Teleport and Subnomic, side by side

	Teleport	Subnomic
How agents connect	Usually an SSH reverse tunnel from the agent to the Proxy Service; a direct mode where the proxy dials the agent also exists	One outbound TLS connection per agent; nothing listens on your side
What it reaches	Linux and OpenSSH servers, Kubernetes, databases, web and TCP apps, Windows desktops, AWS, Azure and Google Cloud consoles and CLIs	Linux servers (systemd, amd64), Kubernetes, Docker, PostgreSQL, MySQL, Redis, MongoDB, internal web apps
How you run it	Enterprise in Teleport's cloud, Enterprise self-hosted, or Community Edition self-hosted	Hosted only; the agents run on your machines
Free use	Community Edition, for organisations with fewer than 100 employees and less than US$10 million in annual revenue	A Free plan with no card and no expiry: a site, storage, a private registry and a service; servers start on Pro
Prices	Not published: billed on active users and protected resources, through a quote	Plan limits are published on each product page
Roles	Allow and deny rules, deny first, everything denied by default	Roles with named permissions, plus guardrails: regular expressions checked against a command, a query or a Kubernetes change before it runs
Session recording	Terminal output and desktop screens, Community included	Terminal, pod-shell and database sessions, on Team and Enterprise; database recordings keep the query, never the rows
Just-in-time access	Access Requests in Enterprise; Community can request roles from the CLI	Request, approve, expire, and break-glass, in Enterprise
AI and MCP	Proxies the MCP servers you enroll (stdio, SSE or Streamable HTTP) with per-role tool allowlists and audit events, in every edition; AI session summaries in Enterprise	Its own remote MCP server with about eighty infrastructure tools, scoped expiring credentials and a call log (Team and Enterprise), and Runa, an assistant inside the console
Hosting	None documented: no static sites, object storage or container registry	Static sites with previews and rollback, S3-compatible buckets, a private OCI registry that scans every push

Where Teleport is the better fit

You must run it yourself. Teleport can be self-hosted, with FIPS binaries and FedRAMP controls in its self-hosted Enterprise edition. Subnomic is a hosted service only.
Windows desktops and cloud consoles. Teleport reaches Windows desktops, with or without Active Directory, and AWS, Azure and Google Cloud consoles. Subnomic does neither.
Certificates for existing tools. Teleport issues short-lived certificates that ssh, database clients and kubectl use directly. Subnomic gives you a browser terminal and subnomic ssh, a database console in the browser, and kubectl through a generated kubeconfig, but not a way to point psql or DBeaver at a private database.
Fronting MCP servers you already run. Teleport enrolls any MCP server and puts roles and audit in front of it. Subnomic offers its own tools, not a proxy for yours.

Where Subnomic is the better fit

You also host things. A team that deploys a static site, keeps backups in a bucket and pushes images to a private registry gets those in the same workspace, under the same roles and the same activity log as server access.
Rules on the command, not only on the door. Guardrails read the statement itself: deny DELETE without WHERE, require approval for systemctl restart, refuse a Kubernetes delete in prod. The same rules apply to people, workflows, Runa and MCP clients, and an unattended caller treats require-approval as no.
No password for the database. The database is registered once with its credentials; people query it in the console with read or write permission and never see the password.
Published limits and a free start. Every plan's limits are on the product pages, and the Free plan has no size or revenue condition.

How the agents compare

Both agents dial out, so neither needs port 22 open to the internet. Teleport's agent joins with a token and keeps a reverse tunnel to the proxy; a server can also run Teleport's own SSH service or sit behind OpenSSH. Subnomic's host agent is a systemd service that opens one TLS connection and carries the terminal, metrics, database and app tunnels over it; a separate tunnel agent carries only databases and apps, and refuses to dial outside its allowlist, private ranges by default. The details are in Agents and SSH without a single open port.

Moving one server over

The two can run side by side. Install the Subnomic agent on one host (Servers & terminal), open a terminal from the console, write a guardrail, and compare the recording with what you have today. Servers and clusters start on Pro; guardrails and recording come with Team.

Sources

What this page says about other products is taken from their own pages, read on 12 November 2026. Plans and limits change; if one of these has, tell us and we will correct it.

Teleport alternatives, compared from their own docs