# Comparison

| Feature | Bascule | Teleport | Boundary | StrongDM |
|---------|---------|----------|----------|----------|
| License | Apache 2.0 | AGPL / Commercial | MPL / Commercial | Commercial |
| Agents required | No | Yes | Yes | Yes |
| Control plane | No | Required | Required | SaaS |
| Container sessions | Native | Via agents | No | No |
| AI Agent Identity | Native (Entra Agent ID) | No | No | No |
| Binary size | ~7MB | ~150MB | ~100MB | N/A (SaaS) |
| Auth | SSH keys, OIDC, Certs, Agent ID | OIDC, SAML, GitHub | OIDC, LDAP | SAML, OIDC |
| Session recording | Via SessionHandler | Built-in | Built-in | Built-in |
| Kubernetes | Any (pod) | Requires agent | Requires worker | SaaS |
| Extensibility | SessionHandler trait | Plugin system | No | No |
| Proxy mode | Built-in | Built-in | Built-in | SaaS |
| Config | Single TOML file | Complex YAML | Complex HCL | Web UI |

## When to choose Bascule

- You want a lightweight SSH proxy without a control plane
- You need ephemeral container sessions per connection
- You need AI agent identity (Entra Agent ID) alongside human SSH
- You want to extend the proxy with custom policy via a Rust trait
- You want Apache 2.0 licensing without AGPL constraints
- You want a single binary under 10MB

## When to choose Teleport

- You need a full access management platform (SSH + K8s + DB + Web)
- You need built-in session recording with search
- You need desktop application access
- You have a large team and need role-based access at scale
- AGPL licensing is acceptable for your use case

## When to choose Boundary

- You're fully invested in the HashiCorp ecosystem
- You need dynamic credential injection
- You need multi-hop proxy chains
- MPL licensing works for your organization