Awesome AI Gateway

Pick one in ~10 seconds, understand why, and check every number yourself. A decision tree over 220+ gateways, a handbook that explains how they actually work (and fail), and a reproducible cost benchmark plus dated evidence behind every claim — including what we exclude and why. CC0, no vendor money, no affiliate links.

💸 Built the hard way: I burned $788 on AI coding in a single day — one flagship model ate 78% of it, just because I'd defaulted everything to the priciest option. So I mapped the whole gateway landscape. → full story in Why this exists below · the full comparison

Languages: English · 简体中文

  🧭 Pick one       🌍 State of the space       📖 Learn how they work       📊 Verify the numbers       🚀 Live site  

Contents

• Which gateway should I use
  • ✅ Why trust this list
• 🌍 State of the landscape (2026)
• ⚡ 10-second answers
• 📖 Learn: how AI gateways work
• 🔥 Top gateways (by stars)
  • 🩺 Maintenance signal — what the star count hides
• 💰 Cost-first: cheapest multi-model access
  • 💳 Minimum top-up and credit expiry
  • 🆓 Free tiers that still work — the verified-limits table
• 🔓 Self-hosted open source
• 🏢 Enterprise & compliance
• 🌐 First-party gateways (cloud & model vendors)
• 🇨🇳 China ecosystem
• 🤖 MCP & agent gateways
• 🔧 More by capability (cross-cutting)
  • 🧠 Smart routing & model selection
  • 💾 Prompt caching through a gateway — the money question
  • 📊 Observability & cost tracking
  • 🚢 Kubernetes-native & inference infra
  • 🖥️ Local desktop gateways
• Quick comparison
• The requirements map
• How to choose safely
  • 🔒 Who sees your prompts? — the data-retention matrix
  • 🔐 Supply-chain security — who signs their releases, and what actually got hacked
  • 🧰 Companion tools — verify what you picked
  • Community relay watch-list
• 📊 Latest evaluations
• 📰 What's new
• 🚀 Recent releases (auto-updated)
• 📚 Essential reading
• Guides & comparisons
• FAQ
• Glossary
• Why this exists
• Who maintains this — and the conflict of interest
• 🔌 Use the data — it's an API
• 🔗 Related lists
• Star history

Which gateway should I use

⚡ Fast answer — one sane default per need (alternatives in each linked section):

Do you want to self-host?
│
├─ NO — hosted, minimal ops
│   ├─ Cheapest access to many models ──────────▶ OpenRouter · Vercel AI Gateway (0% markup)
│   ├─ Free control plane over your own keys ───▶ Cloudflare AI Gateway
│   ├─ EU data residency matters ───────────────▶ Requesty · Eden AI · nexos.ai
│   └─ Already on one cloud ────────────────────▶ AWS Bedrock · Azure APIM · Vertex AI
│
└─ YES — self-hosted / open source
    ├─ Python stack, broadest features ─────────▶ LiteLLM
    ├─ Raw performance (Go/Rust/TS) ────────────▶ Bifrost (0.62 ms measured) · Portkey Gateway (2.65 ms; fidelity 1/3)
    ├─ Built-in evals + observability ──────────▶ LiteLLM · Bifrost · Helicone (maintenance mode)
    ├─ Multi-user keys + budgets + admin UI ────▶ LiteLLM · new-api   (family / small team)
    ├─ CN models + CNY billing ─────────────────▶ new-api · one-api · GPT-Load
    ├─ Enterprise K8s, audit, guardrails ───────▶ Kong · Higress · APISIX · Envoy AI Gateway
    └─ Governing AI agents & MCP traffic ───────▶ agentgateway · Lunar.dev

✅ Why trust this list

• ✅ Independent — no vendor money, no affiliate links, CC0. Unlike affiliate-driven relay "rankings," nobody pays to appear here.
• ✅ Reproducible, not asserted. Every cost cell is computed from open pricing data by a unit-tested script; stars refresh daily via CI.
• ✅ Honest about risk. We disclose CVEs, label archived/stale projects, and exclude gray-market relays — with the research to back it.

Why this matters: the same task can cost 100× more depending on the model behind your gateway. An AI gateway sits between your code and LLM providers — one endpoint, one key, many models — handling routing, failover, caching, rate limits, cost tracking and guardrails, so you change a base_url instead of rewriting your app. Pick the gateway here, then the evaluation set shows which model to route to.

⭐ Found this useful? Star it — that's how the next engineer choosing a gateway finds it. CC0, no signup, no tracking, no vendor money.

🌍 State of the landscape (2026)

The standalone AI gateway is being squeezed from both ends. Underneath, hyperscalers now ship routing and spend caps natively; above, the coding-agent wave produced a faster-growing class of gateway that most round-ups miss. The part that consolidated is the independent middle — a company whose entire product was the gateway.

Not a collapse — the same year, LiteLLM ⭐ 61.8k kept compounding, Bifrost ⭐ 9k won on measured overhead, Envoy AI Gateway reached v1.0 (Jun 23) as the first CNCF-backed production-stable option, and the coding-agent tier plus token-compression proxies became the fastest-growing categories in this list.

Three things that changes for you: check the last commit before the feature matrix; prefer code you can keep over a control plane you cannot; and if your traffic already lives in one cloud, that cloud's native gateway is now a real answer.

📉 The full picture — the consolidation evidence, the six-check evaluation standard, and three dated predictions with their disproof conditions: LANDSCAPE.md

⚡ 10-second answers

The questions people actually ask (sourced from real threads) — answered first:

📖 Learn: how AI gateways work

The list tells you which gateway; these chapters teach you how they work and why they fail — same evidence bar (dated, sourced, reproducible). Chapter map + reading order: HANDBOOK.md.

• 📕 The compatibility surface - Why gateways break Claude Code: three wire protocols field-by-field, five translation failure modes each anchored to a verified GitHub issue, the measured fidelity results, and a 10-minute self-test for your own gateway.
• 📗 Routing & model selection: the research landscape - Cost-aware cascades, learned routers, ensembling and self-routing — with the honest counter-evidence on when routing doesn't pay.
• 📘 Observability: what to measure and why - The OTel GenAI conventions, the metric tiers that separate instrumented from blind, and silent model drift.
• 📙 Anatomy of an AI gateway - The request lifecycle read from seven gateways' source at pinned commits: where the cache, the budget check and the retry boundary actually sit, why metering rarely survives a crash, and the six conditions under which you shouldn't run a gateway at all.
• 📕 Failover & reliability - What actually happens when a provider fails mid-request: only one of six gateways retries by default, what a client sees when the stream dies after the first token, whether a retry can be billed twice, and three providers' incompatible 429 contracts.
• 📗 Caching economics - Reads are 0.1× but writes are 1.25–2×, so caching loses money below a 21.7% hit rate — the formula, the four providers' non-portable rules, semantic-cache false hits with receipts, and a 30-second self-test.
• 📘 Virtual keys, budgets & metering - How a gateway counts your money: what a virtual key really scopes, pre-spend reservation vs post-hoc metering under concurrency, how streamed and reasoning and cached tokens get mis-counted, and what spend disappears when the process dies.
• 📕 MCP & agent gateways - Why agent traffic is not completion traffic: six properties change at once, MCP went stateless on 2026-07-28, tool-level authorization and secret brokering, and the DNS-rebinding CVE class that hit five codebases.
• ✅ All eight chapters are live — the map and reading order live in HANDBOOK.md, linked above.

🔥 Top gateways (by stars)

Every project in the list that clears the last row here, sorted by stars — a fast orientation. Archived projects are held back (TensorZero went read-only in June 2026) so the table stays things you can actually adopt today. Stars auto-refresh daily; full context (features, license, caveats) is in each linked section. ⚠️ flags a project whose coding-subscription / account-pool routing can carry provider-ToS or account-ban risk.

Hosted leaders (SaaS, no GitHub stars): OpenRouter (~340 models, ~5.5% fee) · Vercel AI Gateway & Cloudflare AI Gateway (0% markup) → Cost-first.

Stars measure popularity, not fitness for your need — that's what the category sections and the evidence-based scorecard are for.

🩺 Maintenance signal — what the star count hides

Stars are cumulative; they never go down when a project stops shipping. Every tracked repo below is either archived or has taken no commit in six months. Refreshed daily from the GitHub API, same pass as the star counts — so this cannot go stale while the stars stay current.

A quiet repo is not automatically a bad pick — a stable proxy may simply be finished, and a listed project may have moved its work elsewhere. It is a question to ask before you depend on it, not a verdict.

💰 Cost-first: cheapest multi-model access

🎯 Pain point: "I want many models for the least money and zero ops."

Where the line is: stolen-quota / reverse-engineered access is excluded from this list outright; transparent resellers are listed — but flagged New & unverified and folded below until an independent fidelity check passes.

Start here — the options with a track record:

• OpenRouter - The dominant model marketplace: ~340 models (live API count) behind one OpenAI-compatible API, pay-as-you-go with automatic failover; ~5.5% fee when buying credits. $113M Series B (May 2026), ~8M users. Stripe agreed to acquire it on 2026-08-19 (terms undisclosed; closing not independently confirmed) — OpenRouter says the product, API and roadmap do not change, which is the right thing to hold it to rather than to assume.
• Vercel AI Gateway - Hundreds of models at provider list price (0% markup), $5/month free credits, zero-data-retention option; pairs naturally with the AI SDK.
• Cloudflare AI Gateway - Free control plane in front of your own provider keys: caching, dynamic routing, unified billing, and dollar-denominated spend limits (2026 beta).
• Requesty - EU-friendly OpenRouter alternative: 400+ models, sub-20ms failover, ~5% markup.
• Eden AI - Unified API for 500+ models plus vision/OCR/speech; EU-based, ~5.5% platform fee.
• Helicone AI Gateway (cloud) - Passthrough billing at 0% markup with observability bundled. Acquired by Mintlify (2026-03) and in maintenance mode — fine to use today, but weigh the roadmap risk.
• GPT-Load ⭐ 7.2k - High-performance Go proxy that rotates pools of API keys across channels to maximize quota usage.
• freellmapi ⭐ 39.1k - OpenAI-compatible proxy (MIT) that stacks the free tiers of 28 LLM providers behind one /v1 endpoint — smart routing, automatic failover, per-key quota tracking, encrypted key storage. ⚠️ Stacking provider free quotas behind one endpoint can carry provider-ToS / account-ban risk — the repo itself says "personal experimentation only" — and the operator sells a paid live-catalog subscription ($19/yr; the router itself stays MIT, self-hosted, on your own keys).
• freelm ⭐ 9 - MIT router you embed as a Python or TypeScript library or run as a local OpenAI-compatible endpoint (freelm serve), pooling the official free tiers of Gemini, Groq, OpenRouter, Cloudflare Workers AI and others with your own keys, with per-model quota tracking and failover that races a slow provider against the next one. ⚠️ Pooling provider free tiers can carry provider-ToS and quota-exhaustion risk. (Source reviewed 2026-10-22).
• AIMLAPI - One OpenAI/Anthropic-compatible endpoint fronting 400+ models (chat, image, video, audio, embeddings); prepaid, OpenRouter-style aggregator.
• Novita AI - Unified API to 200+ open-source models (DeepSeek/Qwen/Llama…) with load balancing, autoscaling and failover; also a GPU cloud.
• Glama Gateway - OpenAI-compatible gateway to 100+ models with consolidated billing, caching and logging (OSS core glama-ai/lightport).

💡 Squeeze more from any gateway: enable semantic caching (Bifrost, Zuplo; Kong's ai-semantic-cache is Enterprise), set spend limits (Cloudflare, Zuplo, Pydantic/Logfire), and route easy prompts to cheap models (see Smart routing).

💳 Minimum top-up and credit expiry

Operator documentation checked 2026-10-22; this is a terms comparison, not an independent billing test. “Not stated” means absent from the pages reviewed. Prepaid balances, monthly budgets and BYOK provider bills are different products. Sources and review dates travel with every row; data and curation contracts are public.

🆓 Free tiers that still work — the verified-limits table

One of the most-asked questions in the ecosystem, and the internet's answers are mostly stale. Every row below was re-verified against the provider's own docs (machine-readable, verified 2026-07-09, CI-enforced ≤30-day re-review). "Unpublished" means the provider now hides the numbers behind a login — we say so instead of quoting third-hand figures.

Retired: GitHub Models was fully retired on 2026-07-30 — the playground, model catalog, inference API and BYOK are all gone (GitHub's notice; the inference endpoint now returns HTTP 410). github.com/marketplace/models still answers 200, so clicking around will not tell you. GitHub points new projects at Azure AI Foundry.

Trial credits ≠ free tiers (they expire): NVIDIA build.nvidia.com (1,000 requests at signup, +4,000 with a business email — staff-forum figures; prototyping-only license) and Alibaba Cloud Model Studio international (per-model quotas, hard 90-day expiry, Singapore region). Recently discontinued — ignore stale listicles: Together AI killed its -free models (now $5 minimum prepaid, "does not currently offer free trials"), Moonshot/Kimi requires a $1 top-up to start, and xAI's much-cited data-sharing credits are no longer documented on any public page. Full evidence per row: data/free_tiers.json. A wrong row is a bug — report it.

🔓 Self-hosted open source

Pain point: "My keys, my infra, no per-token middleman fee."

• LiteLLM ⭐ 61.8k - The default choice: Python SDK + proxy server speaking OpenAI format to 100+ providers (local Ollama included), with virtual keys, budgets, load balancing and guardrails; the admin UI / virtual keys need a Postgres database.

• Portkey Gateway ⭐ 13.2k - Fast TypeScript gateway (1,600+ models, 50+ guardrails) that also powers Portkey's commercial LLMOps platform.

• CLIProxyAPI ⭐ 55.9k - Go gateway that wraps coding-agent CLI subscriptions (Claude Code, Codex, Gemini, Grok, Antigravity) into OpenAI/Gemini/Claude/Codex-compatible APIs with multi-account pools, round-robin load balancing and a management API; one of the highest-starred OSS gateways in the space. BYO accounts — but routing OAuth coding-tier subscriptions through an API can violate provider ToS, so weigh account-ban risk. Companion: CPA-Manager-Plus ⭐ 3.9k — a self-hosted management panel + observability dashboard for it (requests, usage, cost, quota, failures, account health); the same ToS caveat applies.

• 9router ⭐ 31.2k - MIT self-hosted BYOK local proxy that auto-routes across 40+ providers with subscription→cheap→free fallback, multi-account load balancing and token compression; cost-first and very popular. Two cautions, and the security one is the bigger: 19 published advisories — 6 critical, 11 high, 12 of them in July 2026 alone — clustered on unauthenticated access to the proxy and the provider keys it holds, and three carry no recorded fix, two of those critical (see the supply-chain matrix below). Run it on a network you control, pinned to the newest release. Separately, its free/OAuth coding-tier routing (Claude Code, Codex, Kiro) carries provider-ToS/account-ban risk.

• OmniRoute ⭐ 79.6k - MIT self-hosted TypeScript gateway: one endpoint to 231+ providers (50+ free), plugging Claude Code / Codex / Cursor / Cline / Copilot into free Claude/GPT/Gemini with stacked token compression (15–95% savings), 17 routing strategies, smart auto-fallback and MCP/A2A. A 2026 breakout of the coding-agent "token-saver" wave — genuine code (not a relay farm), but its free/OAuth coding-tier routing carries provider-ToS/account-ban risk.

• Chat Nio (CoAI) ⭐ 9.3k - Multi-tenant "one-stop" gateway with a built-in admin + credit/subscription billing panel over 200+ models / 35+ providers, priority-based load balancing and model caching — the same commercial-panel genre as the new-api / one-api / VoAPI entries here.

• TensorZero ⭐ 11.7k - Archived June 2026 ⚠️ (company wound down; repo read-only, Apache-2.0 code + community forks remain). Rust gateway unified with observability, evals, experimentation and optimization.

• Bifrost ⭐ 9k - Go gateway from Maxim AI claiming ~50x LiteLLM throughput; adaptive load balancing, cluster mode, MCP support, a built-in web UI, and documented Ollama support for local models — zero-config start via npx or Docker.

• Otari ⭐ 719 - Mozilla AI's self-hosted gateway (Apache-2.0, Python): one OpenAI- and Anthropic-compatible endpoint over 40+ providers via any-llm, with virtual keys, per-user/per-key budgets enforced before a request runs, and /v1/usage spend tracking; single-Docker start, optional hosted platform (otari.ai). Launched April 2026 and one of July's fastest risers.

• Traceloop Hub ⭐ 232 - High-scale gateway written in Rust from the Traceloop team (OpenLLMetry / OTel-for-LLMs); OpenTelemetry-native observability built in.

• Helicone ⭐ 6.2k - Observability-first platform (YC W23) with a Rust ai-gateway ⭐ 639.

• Plano ⭐ 7.1k - AI-native proxy and data plane for agents (formerly Arch Gateway / archgw).

• AxonHub ⭐ 5.4k - Go gateway: call 100+ LLMs from any SDK behind one OpenAI/Anthropic-compatible endpoint, with built-in failover, load balancing, cost control and end-to-end tracing. BYOK self-hosted.

• Manifest ⭐ 7.6k - Self-hosted TypeScript router (MIT): one OpenAI-compatible /auto endpoint (plus /v1/messages for Anthropic clients) over 300+ models / 31+ providers, mixing API keys, local models (Ollama/LM Studio) and coding-tier subscriptions with complexity/header-based routing, cost tracking, budgets and failover. BYO accounts — routing OAuth coding-tier subscriptions through an API can carry provider-ToS risk.

• LLM Gateway ⭐ 1.7k - Open-source OpenRouter alternative: route, manage and analyze requests across providers.

• APIPark ⭐ 1.8k - Cloud-native LLM API management and distribution platform.

• Pydantic AI Gateway ⭐ 193 - BYOK gateway with cost caps and OTel; ⚠️ repo archived, now folded into Pydantic Logfire.

• OptiLLM ⭐ 4.3k - Optimizing inference proxy that boosts accuracy via test-time compute techniques.

• aisuite ⭐ 16.4k - Andrew Ng's unified multi-provider client. A library rather than a deployable proxy — fits when you don't want network hops.

• Shepherd Model Gateway (SMG) ⭐ 660 - Engine-agnostic gateway in Rust: one OpenAI/Anthropic-compatible endpoint over vLLM/SGLang/TRT-LLM + cloud providers, with KV-cache-aware routing and WASM plugins.

• RelayPlane ⭐ 209 - MIT, local-first proxy (npm): six providers behind one endpoint (Anthropic, OpenAI, Google, xAI, OpenRouter, local Ollama) with per-request cost attribution and hard daily/hourly budget caps.

• SentryNode Gateway ⭐ 0 - Open-core (Apache-2.0) AI proxy for cost governance / FinOps routing: adaptive model routing, budget caps and audit logging. Early-stage; the public repo currently ships a demo scaffold.

• GoModel ⭐ 1.3k - Lightweight single-binary Go gateway (open-source LiteLLM alternative) exposing one OpenAI/Anthropic-compatible API across 18+ providers with caching, guardrails and usage/cost tracking; fast-growing, though its throughput-vs-LiteLLM figures are vendor-run.

• OpenGateLLM ⭐ 216 - Production-grade open-source GenAI gateway from France's Etalab (powers the government's "Albert" assistant): one OpenAI-compatible API over self-hosted + provider models, with auth, rate limits and usage tracking. Distinct public-sector / EU-sovereignty angle.

• TokenHub ⭐ 1.4k - Private enterprise AI gateway (Apache-2.0) with role-based workspaces for users, team leaders and administrators — from astaxie, creator of the beego framework.

• dario ⭐ 576 - Local OpenAI- and Anthropic-compatible proxy (MIT) that brings a Claude Pro/Max subscription to Cursor, Cline, Aider and the Agent SDK, with session-affinity routing, multi-account pooling and drift detection. ⚠️ Routing OAuth coding-tier subscriptions through an API carries provider-ToS / account-ban risk (same cohort as CLIProxyAPI).

• Aurora Gateway ⭐ 41 - Go single-binary gateway that auto-discovers providers from environment variables, with provider pools, exact/semantic/prompt caching, guardrails, audit logging and usage analytics (Apache-2.0). Early-stage (launched mid-2026, single maintainer); its headline speed-vs-LiteLLM figures are vendor-run.

• headroom ⭐ 77.4k - Apache-2.0 context-compression layer shipping as a library, a drop-in local proxy (headroom proxy) and an MCP server: it shrinks tool outputs, logs, files and RAG chunks reversibly before they reach the model. Not a multi-provider router — reach for it when the bill is driven by context size rather than model choice, and pair it with a router. Its 15–20% (coding agents) / 60–95% (JSON) savings figures are the project's own.

• OpenRelay ⭐ 2.3k - MIT local proxy that auto-discovers the AI quota you already own — Claude Desktop/Code, Kiro, Copilot, Cursor, Windsurf, Codex, Gemini CLI — alongside 45 direct API or local endpoints, then lets any tool draw on any of them. BYO accounts, no resold quota. ⚠️ Routing coding-tier subscriptions through an API carries provider-ToS / account-ban risk (same cohort as CLIProxyAPI).

• Paritok ⭐ 1.5k - Apache-2.0 compression gateway for coding agents: fronts any BASE_URL agent (Claude Code, Cursor, Codex, OpenHands) and compresses conversation context with an open-weights 4B code model, to fit more turns in the same window. Same niche as headroom, different mechanism — a learned model rather than content-aware rules. Early-stage (repo opened 2026-07); its 25%→85% savings curve is vendor-run.

• copilot-api ⭐ 1.1k - MIT gateway that re-exposes a GitHub Copilot subscription (plus Codex and OpenCode Go) as OpenAI- and Anthropic-compatible APIs for any client. ⚠️ Same provider-ToS / account-ban risk as the other subscription-wrapping proxies here.

• CliRelay ⭐ 1k - MIT Go gateway aimed at coding CLIs: one OpenAI/Claude/Gemini/Codex-compatible endpoint plus a multi-tenant web console with request logs and per-tenant spend quotas — the part most single-user coding proxies omit once you have to hand keys to a team.

• Swobu ⭐ 20 - Local-first Go gateway (single binary, AGPL-3.0) that terminates OpenAI, Anthropic Messages and remote-MCP client traffic and routes it across providers, regions, accounts and local engines (Ollama, LM Studio, vLLM) with failover; clients point at one workspace endpoint and name a route, and the stated goal is to preserve tools, reasoning and session state across a switch. BYOK — no resold quota. Early-stage (still on 1.0 release candidates, single maintainer).

• Unified AI System ⭐ 10 - Apache-2.0 local-first Node.js gateway and MCP server for Codex/Cursor/Cline: explicit provider/model selection, streaming chat, fifteen governed MCP tools (v0.8.0 roster, checked 2026-10-22) and prompt enhancement that runs without calling a provider. Starts with no credentials against a fake provider, which makes it cheap to try. Early-stage public preview — fallback candidates are reported but not yet executed automatically.

• Token Efficiency ⭐ 0 - MIT Python/Vue gateway bundling prompt-token compression, semantic caching, a multi-tenant portal and cost analytics over OpenAI/Anthropic/MiniMax/GLM/Kimi/DeepSeek; ships docker-compose and Grafana dashboards. Early-stage (repo opened 2026-08, single maintainer); its compression/savings figures are vendor-run, and a hosted edition shares the name.

• OrcaRouter Lite ⭐ 1.4k - MIT self-hosted Python/FastAPI gateway: BYOK across OpenAI, Anthropic, Google, Groq, Together and Fireworks behind one OpenAI-compatible endpoint, with automatic failover, streaming, a model="auto" mode that picks by cost/latency/quality, and a local analytics dashboard that emits no telemetry. Can optionally add the vendor's hosted service as one more upstream.

• Ollama Herd ⭐ 27 - MIT self-hosted router (Python) that routes to machines you own rather than to hosted providers: nodes are discovered on the LAN over mDNS with no config file, and each request is scored on memory fit, thermal state, queue depth and which models are already resident, so it avoids cold-loading a model that is warm elsewhere. Serves OpenAI-, Ollama- and Anthropic-compatible APIs plus image generation, speech-to-text and embeddings; there are no provider keys to manage because there is no provider.

• TrustGate ⭐ 16 - Go/Apache-2.0 agent gateway from NeuralTrust with separate Admin/Proxy/MCP planes, multi-provider OpenAI-compatible routing, consumer auth and policy plugins (rate/token limits, semantic cache); stronger on governance and MCP aggregation than on breadth of provider coverage. Early-stage by star count, but the three-plane split is a real architectural choice rather than a rename.

• Company AI Hub ⭐ 0 - Apache-2.0 TypeScript gateway for Codex and OpenAI-compatible clients that injects centrally approved Agents, Skills and Prompts server-side, with immutable review snapshots of employee submissions and a web admin console. Early-stage (opened 2026-08, single maintainer) and currently proxies one configured upstream provider — the governance model is the point, not provider breadth.

• Agnos ⭐ 4 - Self-hosted control plane (MIT, Python/FastAPI) that runs LiteLLM, Bifrost or Portkey as a swappable, stateless translation engine behind one OpenAI-compatible endpoint: provider keys stay in its own encrypted vault and are injected per request rather than held in the translator, with auth, per-workspace budgets, CEL guardrails, cost tracking and one audit log across engines. Early-stage (2026, single maintainer); the "bring your own control plane, contain the gateway" split is the differentiator, not provider breadth.

• Kaeso ⭐ 1 - MIT self-hosted Rust gateway with a TypeScript console: one OpenAI-/Anthropic-compatible endpoint in front of the user's own provider keys, with organizations, virtual keys, limits and request logs. Early-stage, single maintainer. Operator-documented; not independently evaluated (source reviewed 2026-10-22).

• App AI Gateway ⭐ 0 - Apache-2.0 TypeScript gateway for iOS apps on Cloudflare Workers, also offered as a hosted service: holds provider keys server-side, checks Apple App Attest, and applies per-user/app budgets before forwarding requests. Early-stage and Apple-only. Operator-documented; not independently evaluated (source reviewed 2026-10-22).

• cliproxy-rs ⭐ 43 - Rust rewrite of CLIProxyAPI that reads the same config.yaml and credential files, serves the same Management API, and lets Codex CLI use Chat Completions providers such as DeepSeek, GLM, Kimi and OpenRouter with your API keys; inspect current protocol coverage before use. ⚠️ Its optional own-account sign-ins carry the same provider-ToS / account-ban risk as CLIProxyAPI. (Source reviewed 2026-10-22).

• stuntd ⭐ 73 - Apache-2.0 local Python proxy for typed LLM decisions, including Chat Completions, Messages, SystemOne and Decisions formats: trains per-decision heads on a frozen encoder, answers locally above a configured confidence threshold and falls back to the provider otherwise. Early-stage; learning/agreement claims are operator-reported, not independently benchmarked here. (Source reviewed 2026-10-22).

• PrivAiTe ⭐ 54 - BSD-3 Python proxy that replaces PII with reversible placeholders before a request leaves the machine, tool-call arguments and multimodal text included, then restores the real values in the reply; native Claude Code and Codex routes, detection runs locally (Presidio + an ONNX model), no telemetry. Early-stage and single-maintainer; the recall figures are the project's own, but the harness and corpus are public and rerunnable. (Source reviewed 2026-10-22).

• AISIX AI Gateway ⭐ 204 - Apache-2.0 Rust gateway maintained by API7.ai, with OpenAI-compatible endpoints, an Anthropic-compatible Messages endpoint, declarative self-hosting, model routing and failover, guardrails, Prometheus metrics, and OTLP/HTTP trace export. (Source reviewed 2026-10-22).

• GPROXY ⭐ 266 - AGPL-3.0 Rust gateway accepting OpenAI Chat/Responses, Anthropic Messages and Gemini formats, with credential pools, user/team/organization quotas and an operator console. Early-stage; own-account OAuth subscription channels carry provider-ToS/account-ban risk. (Source reviewed 2026-10-22).

• ⚠️ Stale but historically notable: BricksLLM ⭐ 1.2k (PII masking, per-key limits; inactive since early 2025), Glide ⭐ 160 (inactive since 2024).

🏢 Enterprise & compliance

Pain point: "Audit logs, PII redaction, RBAC, on-prem, and the EU AI Act."

⚠️ The EU AI Act deadline moved — check which half applies to you before you buy on urgency. The Digital Omnibus (Regulation (EU) 2026/1744, in force 2026-07-27) pushed the Annex III high-risk obligations — the ones that mandate Article 12 event logging, the reason most teams shop for an auditable gateway — from 2026-08-02 to 2027-12-02, and AI embedded in Annex I regulated products to 2028-08-02. What did start on 2026-08-02 is Article 50 transparency: disclosing AI interaction, marking synthetic content, labelling deepfakes. Those are application-layer duties your gateway mostly cannot discharge for you. Verified 2026-08-12.

⚖️ Coverage honesty: of the vendors below, only Kong and Apache APISIX carry scores in the 5-axis scorecard — the rest are listed for coverage, not evaluated (mostly closed-source platforms our evidence rubric can't independently verify). Treat their capability descriptions as vendor claims; the identity/governance paywalls we could verify are in the SSO-tax table.

Who paywalls SSO / SCIM / RBAC / audit logs? Six of nine vendors gate SSO behind an enterprise tier — Cloudflare is the only one shipping it free on every plan, and Vercel the only one with a sticker price for the tax ($300/month). Full tier-by-tier matrix, primary-sourced: the SSO-tax table (machine-readable).

• Kong AI Gateway ⭐ 44.3k - Mature API gateway with AI plugins: semantic caching/routing, prompt guard, token rate-limiting; Konnect for managed control plane.
• Apache APISIX ⭐ 17.2k - Cloud-native API + AI gateway with ai-proxy / ai-proxy-multi plugins.
• Envoy AI Gateway ⭐ 2.3k - CNCF-aligned GenAI access on Envoy Gateway, backed by Tetrate and Bloomberg.
• kgateway ⭐ 5.7k - CNCF API/AI gateway, the base of Solo.io's commercial Gloo AI Gateway.
• TrueFoundry AI Gateway - Enterprise gateway with routing, guardrails and RBAC, deployable into your K8s/VPC.
• nexos.ai - Enterprise AI gateway/orchestration from the Nord Security founders (€30M Series A, Oct 2025).
• Tyk AI Studio - AI governance suite: budgets, model catalogs, guardrails on Tyk's gateway.
• Gravitee Agent Mesh - LLM Proxy, MCP Proxy and A2A support inside Gravitee APIM.
• WSO2 AI Gateway - Egress management for LLM traffic: model routing, semantic caching, guardrails.
• F5 AI Gateway - Containerized AI traffic gateway; data-leakage detection via the LeakSignal acquisition (announced Jul 2025).
• IBM API Connect AI Gateway - AI Gateway capability inside IBM API Connect: policy enforcement, masking and audit for LLM traffic (its dedicated docs line has since moved to the standalone DataPower Interact Gateway below).
• IBM DataPower Interact Gateway - Standalone gateway built on the DataPower Nano Gateway governing LLM and MCP traffic at runtime: an MCP gateway exposing existing APIs as agent-discoverable MCP tools, plus governed endpoints to external LLM providers (announced Jul 2026).
• MuleSoft AI / Omni Gateway - Governs LLM, MCP and agent traffic alongside classic APIs.
• Lunar.dev ⭐ 505 - Egress consumption gateway repositioned around MCP/agent governance.
• KrakenD AI Gateway - High-performance, stateless Go API gateway (krakend/krakend-ce ⭐ 2.7k) with an AI proxy + prompt-security layer.
• Broadcom Layer7 AI Gateway - LLM traffic governance, threat protection and quotas on the mature Layer7 API platform.
• Cequence AI Gateway - API-security-first AI gateway: discovery, guardrails and threat protection for LLM/agent traffic.
• Axway Amplify AI Gateway - Centralized control plane on Axway's Amplify platform governing LLM/MCP/agent traffic with business-logic model routing, RBAC, spend caps, prompt-injection controls and RAG integration, from a 10× Gartner MQ API-management Leader.
• Red Hat Connectivity Link - Kubernetes-native gateway (built on the Kuadrant project, successor to 3scale) unifying AI gateway, API management and multicluster connectivity; powers OpenShift AI Models-as-a-Service as the front door governing external and self-hosted LLM endpoints.
• Sensedia AI Gateway - Gartner-recognized APIM vendor's agnostic AI gateway governing LLMs, MCP servers and AI agents with multi-model routing, guardrails, cost controls and observability across a multi-cloud control plane.
• Ambassador Edge Stack - Envoy-based, Kubernetes-native API gateway (OSS core emissary-ingress ⭐ 4.5k) whose AI Gateway layer adds LLM-provider routing, token rate-limiting and fallback — a peer to Kong/Tyk/APISIX in the API-vendor cohort.
• shim ⭐ 9 - Open-core Python gateway (Apache-2.0 core, source-available ee/ under the Elastic License 2.0) that applies policy without translating payloads: an OpenAI request leaves as OpenAI, an Anthropic request as Anthropic. Placeholder masking of PII and provider secrets (email, phone, card, IBAN, Turkish TCKN/VKN, AWS keys, GitHub tokens) restored on the return path, RPM/TPM admission, a checked-in price catalog as model allow-list, and per-request cost attribution. Alpha; the community build keeps no request history, and stored audit evidence, roles and budgets sit in the source-available ee/ layer. Hosted service at getshim.tech.
• AI Gateway HQ - Hosted gateway built around the enterprise procurement question rather than the routing one: it fronts your own OpenAI, Anthropic and Gemini credentials (BYOK inference is billed by the provider, no percentage fee on top) or an optional prepaid managed Bedrock that hard-stops at zero, and decides caller / allowed-model / remaining-budget before committing money. Workload-scoped keys, health-based failover, policy simulation, and OIDC + SAML + SCIM with built-in roles on the Company tier. Published pricing rather than "contact us": free evaluation workspace, Flex at $0.10/1,000 requests with no monthly base, Company $499/mo, Portfolio $1,500/mo base. New and unverified (self-submitted).
• TrustRoute - Hosted OpenAI-compatible Swiss gateway with CHF billing, workload rules controlling which requests may leave Switzerland, and an operator-documented audit trail and subprocessor reporting. Provider cost plus 5%. Vendor-submitted, not evaluated; jurisdiction and compliance behavior need contractual and runtime verification. (Source, checked 2026-10-22).
• Standard Compute - Company/team/key rules restrict inference to listed Europe or US provider endpoints, with failover inside that list and rejection when no allowed endpoint exists. Vendor-submitted, not evaluated. This is inference-location control: the vendor gateway and OpenRouter may process requests outside the selected region, so it is not end-to-end residency. (Source, checked 2026-10-22).
• INFRO - Hosted BYOK control plane on the customer's own provider accounts: OpenAI-compatible routing, failover, budgets before the provider call, model policy and estimated provider cost per request. Software subscription with no markup on provider spend, self-serve signup and a 14-day checkout trial. New & unverified (founder-submitted). (Source, checked 2026-10-22).
• Dome Systems - Hosted model broker placing model connections and pools behind caller authorization, routing and an audit trail, alongside its MCP gateway. Vendor-submitted, not evaluated. (Source, checked 2026-10-22).

🌐 First-party gateways (cloud & model vendors)

Pain point: "We're already committed to one cloud — give us the native path."

• AWS Bedrock - Multi-model access via the unified Converse API, cross-region inference, and AgentCore Gateway for tools/MCP.
• Azure API Management — GenAI gateway - Token limits, semantic caching and load balancing in front of Azure OpenAI / AI Foundry.
• Google Apigee + Vertex AI - LLM gateway patterns on Apigee with Vertex Model Garden as the managed hub.
• Cloudflare AI Gateway — See Cost-first; the strongest free first-party option.
• Vercel AI Gateway — GA, 0% markup, ZDR option; the default for Next.js/AI SDK shops.
• Databricks Unity AI Gateway - Mosaic AI Gateway folded into Unity Catalog, adding agent + MCP governance.
• Tencent Cloud AI Gateway - Tencent's first-party cloud-native intelligent gateway bundling LLM + MCP + Agent gateways with protocol conversion, cost/performance-based routing, and unified access to Hunyuan + third-party models.

🇨🇳 China ecosystem

Pain point: "Domestic models (Qwen/DeepSeek/GLM/Kimi), CNY payment, key distribution & billing for teams."

• new-api ⭐ 50.5k - The most active one-api fork, now a "unified AI model hub": protocol conversion, multi-user key distribution and billing behind a polished admin UI, Rerank/Realtime endpoints. Not China-only — the panel fronts OpenAI-compatible, Claude and Gemini channels too, a fit for any family or small team wanting per-user keys and budgets. AGPL-3.0.
• one-api ⭐ 37.2k - The original LLM API management & distribution system (OpenAI/Azure/Claude/Gemini/DeepSeek/Doubao…); development has slowed.
• Higress ⭐ 9.6k - Alibaba's AI-native gateway on Envoy/Istio, first-class Tongyi/DeepSeek support; hosted version at higress.ai.
• GPT-Load ⭐ 7.2k - Smart API-key rotation multi-channel proxy in Go.
• one-hub ⭐ 2.9k - Fork of one-api with better non-OpenAI function calling and stats.
• simple-one-api ⭐ 2.3k - Single binary adapting Qianfan/Spark/Hunyuan/MiniMax/DeepSeek to the OpenAI interface.
• Octopus ⭐ 2.7k - Personal LLM API aggregation gateway unifying multiple providers behind one endpoint, with load balancing and OpenAI/Anthropic protocol conversion (Go + Next.js).
• Veloera ⭐ 1.6k - Newer relay platform in the one-api/new-api lineage.
• uni-api ⭐ 1.3k - Lightweight single-config unified API manager, no frontend.
• CrossLink ⭐ 481 - Unified LLM proxy gateway (Apache-2.0) with load balancing, failover, rate limiting, budget management, content auditing, caching and an MCP gateway layer.
• APIPark ⭐ 1.8k - China-origin, cloud-native AI & API gateway with an open developer portal.
• VoAPI ⭐ 1.1k - Polished new-api-lineage relay/billing panel (Go), focused on UI and operations.
• done-hub ⭐ 810 - Fork of one-api/new-api with richer billing and channel management.
• sub2api ⭐ 44.6k - Go relay platform that pools Claude/OpenAI/Gemini/Antigravity subscription accounts (OAuth, session keys, API keys) behind one OpenAI/Anthropic-compatible endpoint, adding cost-sharing "carpool" billing (Stripe/Alipay/WeChat), key distribution and per-token rate limits. One of 2026's fastest-rising China-ecosystem relays — but account-pooling sits adjacent to the resold-relay category this list excludes; BYO accounts and vet before use.
• AIHelms ⭐ 1k - GPL-3.0 enterprise AI-asset governance platform (FastAPI + Vue3): a unified gateway over OpenAI/Azure/Claude/DeepSeek with token scheduling, internal-vs-external dual pricing, cost attribution, SSO, audit logging and centralized MCP-tool/skill distribution. Governance-first rather than throughput-first — closer to the enterprise-compliance section than to the relay panels above.
• Bella OpenAPI ⭐ 240 - MIT gateway from Lianjia/Beike that goes past chat completion: text embedding, ASR, TTS and image generation behind one API, with billing, rate limiting and resource management. Its distinguishing claim is provenance — the capabilities come out of a large operator's own production stack.
• AI Proxy ⭐ 564 - Self-hosted Go gateway from the Sealos team that accepts OpenAI/Claude/Gemini protocols, converts between them, and adds multi-channel routing, load balancing, rate limiting, multi-tenant isolation, and a caching/web-search/reasoning plugin layer.
• metapi ⭐ 3.3k - Self-hosted "router of routers": aggregates your accounts across new-api/one-api/OneHub/DoneHub/Veloera/AnyRouter/sub2api into one key, with cost/balance/utilization-weighted smart routing, channel cool-down/retry, model auto-discovery and OpenAI⇄Claude conversion (TypeScript, MIT). Routing software only — vet the upstream relays it points at.
• Volcengine AI Gateway - ByteDance's cloud AI gateway: unified access, routing and governance for Doubao + third-party models.
• AIWave - Hosted OpenAI-compatible gateway for Chinese model routes specifically: nine provider families (DeepSeek, GLM, Kimi, ERNIE, MiniMax, Qwen, Doubao, StepFun, MiMo) behind one key and a single USD balance, which is the unusual part — the domestic panels in this section almost all settle in CNY. Publishes a dated rate card (standard x1 / VIP x0.9) and a per-request charge ledger itemising fresh input, cache-hit input and output, so a bill can be reconciled line by line. New and unverified (self-submitted) — confirm model fidelity with canary_check.py before relying on it in production.

⚠️ This list deliberately excludes reverse-engineered / resold "free-api" relays — and not on principle alone. Two 2026 measurement studies found systematic fraud across the relay population: Real Money, Fake Models measured model-identity failures in 45.8% of fingerprint tests and output divergence up to 47%; Your Agent Is Mine caught routers injecting malicious code and exfiltrating planted API keys. The precise boundary: stolen-quota / reverse-engineered access is excluded outright, while transparent resellers are listed but flagged New & unverified in Cost-first until independently fidelity-checked. If you're forced to vet one anyway, use the canary-diff test in How to choose safely.

• OpenCSG - Hosted OpenAI-compatible Chinese-model gateway with an unauthenticated catalog publishing CNY-per-million-token pricing, explicit currency fields and upstream repository paths where available. New & unverified; submitted by a referral-code holder (interest disclosed, no referral link included). Catalog visibility does not verify served-model identity. (Source, checked 2026-10-22).

🤖 MCP & agent gateways

Pain point: "Agents call tools now — govern MCP traffic like you govern APIs." The newest category (2025–2026).

• agentgateway ⭐ 5.5k - Linux Foundation proxy for agentic traffic (LF Projects, per its own CHARTER — not a CNCF-hosted project): MCP governance and agent-to-agent (A2A) communication.
• TrustGate ⭐ 16 - Self-hosted Go gateway whose MCP plane aggregates upstream MCP servers behind one endpoint, sharing the tenancy, auth and policy model of its LLM proxy — one governance surface for both traffic types rather than two.
• Lunar.dev MCPX ⭐ 505 - Gateway for managing MCP server consumption.
• Tetrate Agent Router Service - Managed Envoy AI Gateway fleet: LLM + MCP gateway with guardrails (~5% fee).
• Zuplo AI Gateway - Programmable policies: USD spend limits, prompt-injection detection, secret masking, MCP support.
• NetFoundry MCP/LLM Gateways - Zero-trust gateways for AI deployments (launched June 2026).
• AWS AgentCore Gateway — Tool/MCP gateway inside Bedrock AgentCore.
• IBM ContextForge ⭐ 4.7k - MCP gateway/registry federating many MCP servers behind one endpoint with auth, rate limits and observability.
• Docker MCP Gateway ⭐ 1.6k - Docker-maintained docker mcp CLI plugin that runs and federates MCP servers as containers behind one endpoint, with secret management, call interception and a deployment-time per-tool enable-list (identity-free — not per-caller authorization).
• MetaMCP ⭐ 2.7k - Aggregates MCP servers into one endpoint with middleware (auth, filtering) and a management UI.
• ToolHive ⭐ 2.3k - Go platform that runs MCP servers in isolated containers and fronts them with a unified, secured gateway (access policies, "virtual MCP" aggregation).
• Microsoft MCP Gateway ⭐ 890 - Microsoft-maintained reverse proxy + management layer for MCP servers: session-aware stateful routing and lifecycle management on Kubernetes.
• 1MCP ⭐ 522 - Unified MCP server (TypeScript) aggregating many MCP servers behind one endpoint, with HTTP access and CLI-based discovery for agents.
• mcpproxy-go ⭐ 398 - Local Go MCP proxy that federates multiple MCP servers behind one endpoint, with BM25 tool-search filtering, token reduction, and auto-quarantine/security scanning of new servers.
• MCPJungle ⭐ 1.3k - Self-hosted MCP registry + gateway for central tool governance in enterprises.
• Obot ⭐ 1.1k - Open-source agent platform with an MCP gateway for governing tool access.
• Director ⭐ 482 - Middleware to run, secure and observe MCP servers behind one connection.
• Lasso MCP Gateway ⭐ 396 - Security-first MCP gateway: plugin guardrails, secret masking, threat detection.
• Armorer Guard ⭐ 45 - Local Rust MCP proxy that wraps stdio servers and inspects tool-call arguments for prompt injection, credential leakage, exfiltration, and risky actions.
• fak ⭐ 42 - Security-first agent/MCP firewall: a single dependency-free Go binary (Apache-2.0) fronting any OpenAI/Anthropic/MCP backend, where a default-deny capability allow-list adjudicates every tool call and suspicious tool results are quarantined out of the model's context, plus bearer/x-api-key auth, an X-Trace-Id audit trail and Prometheus /metrics. New and early-stage.
• Archestra ⭐ 4.4k - Kubernetes-native MCP gateway with OAuth On-Behalf-Of user-delegated tool access, an A2A agent-to-agent gateway, and deterministic dual-LLM / "lethal trifecta" guardrails plus per-environment egress and cost limits, built for enterprise agent deployments ($13.5M funding).
• Unla ⭐ 2.2k - Lightweight Go MCP gateway that turns existing REST/gRPC APIs and MCP servers into standardized MCP endpoints with zero code changes, behind one gateway with multi-tenant sessions, OAuth, hot-reload config and a management UI.
• Jarvis Registry ⭐ 3.7k - Enterprise MCP/agent gateway fronting internal tools behind one authenticated MCP-over-SSE/HTTP endpoint with OAuth2/OIDC identity (Keycloak/Cognito/Entra), tool-level RBAC/ACL, agent orchestration, and OpenTelemetry/Prometheus observability.
• MCP Gateway & Registry ⭐ 1k - Enterprise MCP gateway + registry centralizing access to many MCP servers behind one OAuth-protected endpoint, with virtual MCP servers, semantic tool discovery, A2A agent discovery and fine-grained governance/audit; AWS-aligned.
• Nexus (Grafbase) ⭐ 436 - Rust AI router from Grafbase that aggregates MCP servers (STDIO/SSE/HTTP) and LLM providers behind one endpoint with context-aware fuzzy tool search, OAuth2/TLS security, rate limiting and OpenTelemetry.
• Pomerium ⭐ 5.1k - Identity-aware access proxy with MCP support: policy-based auth in front of MCP servers.
• Open Connector ⭐ 6.1k - Open-source auth gateway (Apache-2.0, OOMOL Lab) connecting AI agents to 1000+ SaaS providers through SDK, CLI, MCP, HTTP and OpenAPI — it governs agent→SaaS tool credentials and access rather than LLM completion traffic.
• toolport ⭐ 235 - Local-first MCP gateway (MIT): one port for every tool and every AI client, with lazy tool discovery (~90% token savings, per its docs), tool integrity checks + quarantine, and secrets kept in the OS keychain.
• Speakeasy MCP Gateway - Managed MCP gateway from the OpenAPI-tooling vendor, positioned as the distribution plane of an "AI control plane": OAuth 2.1 brokered through your existing IdP, access scoped per server, per tool and per team, policy enforced on every tool call, and unsanctioned shadow MCP servers blocked by default. Its published MoonPay case study is the reason it is here rather than in the long tail — 200+ MCP servers brought under one gateway via Okta, 60K+ agent sessions visible to the security team. Free tier; commercial above it.
• Aident Loadout - Hosted MCP endpoint and CLI brokering agent access to connected apps, with account connections, vault management and audit records. The hosted service is closed source; the client skill is MIT. Operator-documented; not independently evaluated (MCP setup, checked 2026-10-22).
• Omega MCP Router ⭐ 2 - Local stdio MCP router (Node) that fronts many upstream MCP servers behind one connection: tool schemas load from a disk cache, each upstream process starts only on the first call that needs it and closes after 15 idle minutes, and a session turns upstreams on or off through router__* meta-tools. Operator-documented; not independently evaluated (source reviewed 2026-10-22).
• Leanroute - Hosted LLM gateway that runs the MCP tool loop server-side: requests pass mcp_servers, and the gateway executes tool calls against a per-org allowlist with spend caps, for whichever model it routes to (GPT, Gemini, DeepSeek and others, not only Claude). New & unverified (self-submitted); not independently evaluated (source reviewed 2026-10-22).
• Dome Systems - Hosted agent operations platform whose gateway puts MCP and API tool calls and model calls on one governed path: authorization rules evaluated per call on tool arguments, per-agent identity with revocable credentials, and an exportable audit trail. Free tier; commercial above it. Operator-documented; not independently evaluated (source reviewed 2026-10-22).
• Intercis - Hosted policy proxy on OpenAI/Anthropic traffic that removes denied tool calls before the agent runtime receives them. Vendor-submitted, not evaluated. Its documented limits matter: streams are buffered before judgment, and provider-hosted tools, including hosted MCP calls, are observed rather than blocked. (Source, checked 2026-10-22).
• SandBase CLI ⭐ 184 - Apache-2.0 CLI and local MCP bridge connecting agents to SandBase's managed model/API catalog, with OAuth onboarding, discovery and tool execution. The client is open source; the hosted platform is a separate managed service, whose model fidelity is unverified here. (Source reviewed 2026-10-22).

🔧 More by capability (cross-cutting)

These cut across the need-based sections above — routing intelligence, observability, and Kubernetes infra that complement whichever gateway you picked.

🧠 Smart routing & model selection

Pain point: "Send each prompt to the cheapest model that can handle it."

💸 Routing a coding agent specifically (Claude Code / Codex / Cursor)? The dedicated deep-dive classifies claude-code-router, OmniRoute, 9router, CLIProxyAPI and sub2api by mechanism — BYO-key vs own-OAuth vs pooled accounts — with the actual ToS clauses and dated ban reports: Coding-agent routers (2026): savings vs. ban risk.

🧭 The theory behind these picks — cost-aware cascades, learned routers, multi-model ensembling, self-routing, and the benchmarks that test them (with the honest counter-evidence on when routing doesn't pay): the routing & model-selection chapter in 📖 Learn above is the dated, sourced research map, sibling of the observability chapter.

⚠️ The most common gateway failure isn't routing — it's translation. Across 2025–26 issue trackers, the single largest bug category on every major gateway is corrupted tool-call / thinking-block / streaming translation: Portkey's most-commented issue (#980, tool_use ids lost), OpenRouter's AI-SDK thinking-mode breakage (filed three times: #245), Claude Code erroring through LiteLLM (#13373) and new-api (#1854) — "claude code" appears in 465 LiteLLM issues (repo:BerriAI/litellm "claude code" is:issue, 2026-07-29 — a plain search without is:issue returns ~2,000 because it counts pull requests too). "OpenAI-compatible" is a spectrum, not a checkbox (LangChain's own compat issue). We measured it — pointing Claude Code at an OpenAI model, LiteLLM and Bifrost translate cleanly (3/3) while Portkey OSS doesn't offer the path (and the /v1/messages transport shifts across versions, so pin it). Before committing, still run your actual agent (tool calls + streaming + thinking) through the gateway, not just a hello-world completion.

• Not Diamond - SOTA model-routing intelligence; powers OpenRouter's Auto router.
• Martian - Pioneer commercial model router; Accenture partnership.
• Inworld Router - One API for 200+ models with real-time complexity-based routing and 0% markup (pass-through pricing); adds first-party realtime inference for open models. Research preview.
• RouteLLM ⭐ 5.6k - LMSYS's open router framework (research-grade; inactive since 2024 but still the canonical paper/code).
• OpenRouter Auto — One model id (openrouter/auto) that routes per-prompt.
• Unify - Early neural LLM router (company since pivoted to agents).
• Bifrost adaptive load balancing / Cloudflare dynamic routing — routing built into gateways themselves.
• Claude Code Router ⭐ 37.8k - Route Claude Code (and other agent CLIs) to any model/provider — DeepSeek, Qwen, local — by request type.
• opencodex ⭐ 17.8k - Universal provider proxy (MIT) for OpenAI Codex and Claude Code: translates Codex's Responses API to any provider (Claude, Gemini, Grok, DeepSeek, local Ollama) with streaming, tool calls, reasoning tokens and images intact — to Codex what Claude Code Router is to Claude Code. ⚠️ Its ChatGPT account-pool management sits in the same provider-ToS / account-ban-risk cohort as CLIProxyAPI.
• ClawRouter ⭐ 6.6k - Agent-native LLM router (TypeScript) with local sub-ms routing across 41+ models, built so autonomous agents can pay per call via x402/USDC with no signup or API key. The routing client is open-source — but its account-less hosted access (8 free models + crypto pay-per-use) is resold access: verify model fidelity with canary_check.py and prefer your own keys in production.
• workweave/router ⭐ 5.6k - Go router for agentic systems: routes each prompt to the right model in <50ms behind one OpenAI-compatible endpoint, pitched as a drop-in endpoint swap that cuts 40–70% of cost.
• UncommonRoute ⭐ 699 - MIT drop-in OpenAI proxy that routes by prompt difficulty; markets hard numbers (≈82% cost savings, 79.4% accuracy, 93.4% pass rate) and integrates with Claude Code / Cursor / Codex.
• OrcaRouter Lite ⭐ 1.4k - MIT self-hosted single-workspace router (BYOK, OpenAI-compatible) from Continuum AI with a managed hosted upgrade path; ranks at/near the top of the RouterArena leaderboard.
• RouterArena ⭐ 151 - Open evaluation framework + live leaderboard for LLM routers (standardized datasets, cost/quality metrics) — pick a router on data, in the spirit of this list's benchmarks.
• vLLM Semantic Router ⭐ 6.2k - Mixture-of-models router that picks a model per prompt by intent/complexity; a vLLM project.
• NVIDIA LLM Router ⭐ 355 - NIM-based blueprint routing each prompt to the best model by task and complexity.
• LLMRouter ⭐ 3k - Research framework for graph/learned cost–quality model routing.
• Orq.ai - Hosted routing control plane: 500+ models across 30+ providers with retries, fallbacks, caching and governance (BYOK).
• NadirClaw ⭐ 661 - Self-hosted, OpenAI-compatible router (Python) that sends simple prompts to cheap/local models and hard ones to premium, with a trained cascade verifier to cut API cost 40–70%.
• ngrok AI Gateway - Managed proxy routing to OpenAI/Anthropic/Google + local Ollama/vLLM/LM Studio, with automatic failover, key rotation, and CEL traffic-policy controls (PII redaction).
• Infere - Hosted prompt-complexity routing with balanced, cost-optimized and quality-optimized modes; prepaid operator submission, unverified (source reviewed 2026-10-22).

💾 Prompt caching through a gateway — the money question

🎯 Pain point: "Anthropic/OpenAI sell a ~90% cache-read discount — do I still get it through a router, and is it even worth it?"

Often no, and the failure is silent. This is one of the most-asked, worst-answered questions in the ecosystem — real users repeatedly discover their cache discount vanished in transit: native_tokens_cached stuck at 0 through OpenRouter in Zed (zed#52576), the OpenRouter AI-SDK provider shipping broken cache options (ai-sdk-provider#35), and a long tail of "caching doesn't work" threads — sometimes it works but the router simply doesn't report it. At production scale, only 28% of LLM calls show any cached input while system prompts eat 69% of input tokens — the largest unclaimed discount in most AI bills.

Verify it in 30 seconds — never trust vibes: send the same long-system-prompt request twice, then diff the usage fields:

OpenAI-style:    usage.prompt_tokens_details.cached_tokens   > 0 on the 2nd call?
Anthropic-style: usage.cache_read_input_tokens               > 0 on the 2nd call?

If the second call shows 0, you're paying full price at best — and if the gateway wrote the cache but never hit it, about a fifth more than full price on Anthropic 5m / OpenAI 5.6+, because the 1.25× write is billed either way (why). Switch the route (provider-direct, or a gateway that passes cache_control through) and re-test.

Two different "caches" — they stack:

1. 💵 Provider prompt caching (reads at 0.1× base input — 90% off — but writes cost 1.25–2×, so it only pays above a break-even hit rate: see caching economics) — the gateway must pass through cache headers/params and report back the usage fields. LiteLLM supports Anthropic cache_control passthrough; check any gateway against the test above.
2. 🗄️ Gateway-side response caching (exact or semantic) — Kong, Bifrost, Zuplo, Cloudflare AI Gateway serve repeated/similar requests from their own cache at ~$0; this stacks on top of provider caching. See the cache column in Quick comparison.

📊 Observability & cost tracking

Pain point: "Who spent what, on which model, and why did quality drop?"

🔎 How to evaluate a gateway's observability (table-stakes vs differentiating vs advanced, grounded in the OpenTelemetry GenAI conventions): see BENCHMARKS → Part 6. For the research landscape — theory, seminal papers, company writing, standards & open problems: see the observability survey.

• Helicone ⭐ 6.2k - Logs, costs, sessions, prompt experiments; one-line proxy integration.
• TensorZero ⭐ 11.7k - Archived June 2026 ⚠️ (repo read-only; Apache-2.0 code + community forks remain). Gateway + observability + evals in one Rust binary, data stays in your ClickHouse.
• Portkey - Full LLMOps suite over its OSS gateway: traces, budgets, prompt management.
• vLLora (ex-LangDB) ⭐ 811 - Agent debugging and observability from the LangDB team.
• Braintrust Proxy ⭐ 412 - Caching proxy wired into Braintrust evals.
• MLflow AI Gateway ⭐ 28.5k - Unified endpoints + governance inside the MLflow platform.
• Respan (ex–Keywords AI) - One endpoint to 250+ models with routing/fallback/caching, plus built-in observability and evals.
• claude-tap ⭐ 3.3k - MIT local intercepting proxy and trace viewer for coding-agent traffic (Claude Code, Codex CLI, Gemini CLI, Cursor CLI, OpenCode, Kimi, Pi, Hermes): the exact requests, responses and tool calls your agent sends. Wider agent coverage than ccglass; debugging-first rather than spend-first.
• ccglass ⭐ 842 - Local proxy + web dashboard (MIT) that shows exactly what your coding agent (Claude Code, Codex, Kimi) sends to the model.
• OrcaReplay ⭐ 280 - Apache-2.0 local proxy that keeps the verbatim bytes, so unlike the two viewers above it can serve the recording back: the same agent run re-executes with no provider called and nothing spent, or forks from any checkpoint onto other models with a verify command's exit code as the verdict. Answers "why did quality drop?" by re-running the work rather than charting it afterwards. Scope note from its own README: egress=blocked covers model-provider egress only — recorded tool calls still execute for real, so it is not a sandbox.
• Spendline - Hosted BYOK proxy attributing model costs to customers and workflows, with budgets checked before provider calls and invoice reconciliation. Public integration instructions repoint existing clients and add attribution headers. Vendor-submitted, not evaluated; homepage examples use sample data. (Source, checked 2026-10-22).
• Vessel ⭐ 8 - MIT local reverse proxy (single C#/.NET binary) that forwards Ollama, OpenAI-compatible and Anthropic traffic byte-for-byte and stores every request and response in local SQLite for search, replay across models and side-by-side comparison. Operator-documented; not independently evaluated (source reviewed 2026-10-22).
• ABTO - Hosted OpenAI-compatible gateway (OpenAI, Anthropic, Gemini, DeepSeek, Kimi) that splits end users across model/prompt options with sticky per-device assignment and reports per-call cost next to downstream product events (signup, purchase, retention), per feature; provider API keys are passed through per request and kept out of call logs. Operator-documented; not independently evaluated (source reviewed 2026-10-22).
• BytesBrains Cruise - Hosted OpenAI-compatible gateway that refuses calls once a project's spend cap is reached (429, message naming the project) and reports each response's lane, model and budget state in x-cruise-* headers. Operator-documented; not independently evaluated (source reviewed 2026-10-22).

🚢 Kubernetes-native & inference infra

Pain point: "Routing to self-hosted models (vLLM/Ollama) inside the cluster, GPU-aware."

• Gateway API Inference Extension ⭐ 792 - The Kubernetes standard for inference-aware routing.
• AIBrix ⭐ 5.2k - Cost-efficient control plane for vLLM on K8s (ByteDance-origin).
• llm-d ⭐ 4.9k - K8s-native distributed inference serving (Red Hat/Google/IBM-backed).
• Higress ⭐ 9.6k / Kong ⭐ 44.3k / Envoy AI Gateway ⭐ 2.3k - all implement inference-extension-style routing.
• Traefik Hub AI Gateway - LLM routing/security in Traefik's commercial runtime.
• Inference Gateway ⭐ 217 - Small cloud-native gateway unifying cloud + local (Ollama) providers.
• Olla ⭐ 320 - Lightweight Go proxy + load balancer for LLM infra: intelligent routing and automatic failover across inference backends (Ollama, vLLM, LM Studio, OpenAI-compatible).
• KServe ⭐ 6.1k - The standard model-inference platform on K8s; LLM serving with an inference-gateway / OpenAI-compatible runtime.
• GPUStack ⭐ 5.9k - Manage GPU clusters and serve LLMs behind one OpenAI-compatible endpoint.
• vLLM Production Stack ⭐ 2.7k - Reference K8s stack to serve vLLM at scale with a KV-cache-aware routing layer.
• NVIDIA Dynamo ⭐ 8.4k - NVIDIA's datacenter-scale distributed inference framework whose Endpoint Picker (EPP) plugin for the Gateway API Inference Extension does KV-cache-aware, LLM-aware request routing at the gateway layer over vLLM/SGLang/TensorRT-LLM backends.
• llmaz ⭐ 315 - K8s-native inference platform fronting heterogeneous backends (vLLM, SGLang, TGI, llama.cpp, TensorRT-LLM) with Envoy AI Gateway-based model routing and token rate-limiting, Gateway-API inference-pool routing, and LLM-metric HPA plus Karpenter autoscaling. Maintained but slower cadence (still v0.1.x).

🖥️ Local desktop gateways

• OSW (One Switch) ⭐ 197 - Local desktop gateway for the OpenAI-/Anthropic-compatible channels you already have keys for, with priority failover, request logs and rewrite rules. Source-available under PolyForm Noncommercial 1.0.0, not OSI open source; commercial use needs a separate license. (Source reviewed 2026-10-22).

Quick comparison

Stars auto-refresh daily. ✅ built-in · ➕ via plugin/paid tier · ❌ not available · n/d = not documented in the project's own docs.

¹ LiteLLM core is MIT; the repo contains a separately licensed enterprise directory.

💰 = paid tier only · Deploy weight (self-hosted rows, each from its own deploy docs — often the deciding factor on a home server): single process with SQLite/config-file state — Bifrost (npx or Docker, zero-config start), GPT-Load, new-api, one-api (SQLite default; MySQL/Postgres optional), Portkey OSS (Node/npx); needs external state — LiteLLM (Postgres required for virtual keys / budgets / admin UI), Kong (Postgres, or DB-less declarative config), APISIX (etcd, or standalone YAML mode), TensorZero (ClickHouse), Helicone (all-in-one Docker image bundling Postgres + ClickHouse + MinIO), Higress (Docker Compose or K8s). "Local (Ollama)" = the project's own docs name Ollama (or, where marked, a generic OpenAI-compatible/self-hosted backend path).

📂 Browse the raw data (machine-readable, CC0): models & pricing JSON · cost table CSV · gateway scorecard CSV. Every cost cell is regenerated from this data by a unit-tested script.

The full directory at a glance — browse the sections below by your need.

The requirements map

Gateways get bought for nine distinct jobs. Find yours, jump straight to the evidence:

How common is each job? Survey-grounded. From the Amplify Partners 2026 AI Engineering Report (1,000+ engineers, with Notion & Vercel): 87% actively run multiple models together — routing is the default architecture, not the edge case (44% route by task type, 11% by cost). 75% adjust how ambitiously they use AI because of cost (40% say it regularly shapes ambition), and cost is the #2 most-monitored production metric after quality — which is why per-key cost attribution anchors the observability axis. 89% of agent-running teams now grant write permissions while guardrails stay primitive — the case for agent/MCP governance. And one number worth reading twice: only 20% put reliability in their top-3 selection criteria — yet peer-reviewed status-page measurements show the OpenAI and Anthropic APIs each fail about every 2 days (median MTBF 1.99 / 2.09 days) with ~1h median recovery, and only 6.15% of incidents get a postmortem (ICPE 2025); in production traffic, rate limits alone caused ~⅓ of all LLM errors (Datadog, Mar 2026). Engineers underweight failover until an event like the June-2026 Fable 5 pullout takes single-provider stacks offline for three weeks. Multi-provider routing is cheap insurance precisely because it's underpriced.

How to choose safely

Start by matching the gateway's trust level to your data's sensitivity — this one call decides most of the rest:

The mistake is using one trust tier for all your traffic. Sensitive prompts through a $0.50/M relay is how keys leak; throwaway prompts through a FedRAMP endpoint is how you overpay 100×. Match the tier to the data.

Then, whatever tier you're in:

1. 💰 Check the markup. Marketplaces charge 0–6% — for high volume, self-hosting or 0%-markup gateways (Vercel, Helicone cloud) pay for themselves fast.
2. 🔬 Verify model fidelity (canary-diff test). Some relays silently downgrade or quantize models — and quantization spread is normal even on mainstream infrastructure: OpenRouter's own docs list eight quantization levels (int4 → fp32) a provider may serve for the same open-weight model (that's why the quantizations filter exists), and Moonshot's official K2-Vendor-Verifier measures tool-call schema accuracy for the same K2 model ranging from 100% (first-party API) down to ~83% across third-party hosts. Send fixed "canary" prompts — a known-hard reasoning question plus a tokenizer/fingerprint probe — through the gateway and direct to the provider, then diff the outputs — scripts/canary_check.py automates exactly this (relay vs. official → a verdict you can attach to a watch-list report). 2026 research found model-identity failures in 45.8% of fingerprint tests (arXiv:2603.01919). Community monitors apiranking.com and rate.linux.do (browser-only) track relay authenticity/stability — usable as signal if you must vet one, but listing there is not endorsement, and this list includes none of them.
3. 🔒 Mind data flow. Every gateway sees your prompts. For sensitive data: self-host, or require ZDR (zero data retention) in writing.
4. ⚖️ License check before embedding. new-api is AGPL-3.0; LiteLLM has an enterprise-licensed directory; "open core" ≠ everything free.
5. 🩺 Project health. Star count ≠ maintenance. Check last release date — several once-popular gateways (BricksLLM, Glide, RouteLLM) are effectively unmaintained; this list labels them. Star counts can also be bought: brand-new "router/proxy 2026" repos increasingly show star-inflation patterns, so check the repo's created date against its star curve (and its issue/fork activity) before trusting a star-sorted GitHub search.
6. 🧮 Run the margin-floor check — it takes 30 seconds and it is the single most predictive test. Divide the relay's per-token price by the provider's own published list price for the same model. A reseller pays something close to list and needs margin on top, so the ratio tells you what you are looking at: 0.85–1.0 is an ordinary reseller margin and needs no explanation; 0.5–0.85 wants one; below ~0.3 there is usually no honest one, because no volume agreement on frontier APIs discounts that far. Below the floor, the money is coming from somewhere the price list doesn't mention — abused trial quota, compromised accounts, subscription-plan arbitrage, or the cheaper model you didn't ask for. Crucially, a legitimate below-floor price always comes with a stated mechanism, and the list's own entries show what that looks like: hosting open weights itself instead of reselling (Gonka Broker), or disclosing the subsidy and the reason for it (TierUp's transparent pre-PMF pricing). No stated mechanism + a sub-floor price + no named operating company = decline, regardless of how good the docs look. This is the test we apply to submissions, so applying it yourself gets you to the same answer we would reach.
7. 🚫 Avoid gray-market relays reselling reverse-engineered or stolen-quota access. Beyond account-ban risk, 2026 research caught relays serving poisoned models and exfiltrating planted secrets (Your Agent Is Mine) — and the most-visible relay "rankings" are often paid press releases or carry affiliate links. Account bans and data leaks are your risk, not theirs. Caught one swapping models, harvesting data, or vanishing with your balance? Report it — with evidence — and we'll build the community watch list together.
8. 🪤 Watch for the 2026 bait: "unlimited" plans that throttle. The scam vocabulary has moved upmarket — from fake relays to official-but-cheap subscription plans that are quietly speed-throttled into uselessness: "it's unlimited in practice because it's so slow there's no chance you'll spend your quota… the pay-as-you-go API is orders of magnitude faster than the subscription" (r/ClaudeCode on Z.ai's GLM coding plan, echoed here). Before buying any flat-rate plan: benchmark its throughput against the same vendor's pay-as-you-go API — a 10× speed gap is the tell.
9. 📦 Treat the gateway itself as supply chain. It sees every prompt and holds every provider key, so its own security posture is a buying criterion: in March 2026 LiteLLM's PyPI releases v1.82.7/.8 were backdoored via a CI-token compromise (quarantined in ~3h), and in June 2026 a LiteLLM RCE chain (CVE-2026-42271) entered CISA's KEV catalog — two different failure modes in one quarter, on the most-deployed OSS gateway. And in August 2026 Microsoft tied that same CVE chain to an actual campaign against AI gateways as a class (LiteLLM, a RAGFlow deployment, Kestra), whose objective was to steal provider credentials, persist, and resell the compute — so this is now an observed attack pattern, not a hypothetical. Practical hygiene: pin exact versions (never latest), watch the project's security advisories + KEV, patch the control plane fast, keep the admin UI off the public internet, and pre-vet any third-party relay with an audit tool like api-relay-audit ⭐ 887 (checks prompt injection, model substitution, tool-call rewriting, SSE anomalies). Per-gateway posture — who signs releases, ships SBOMs, and what got exploited — is in the supply-chain matrix below.

🔒 Who sees your prompts? — the data-retention matrix

The #1 trust question, with no neutral cross-vendor answer anywhere. Here's one, from primary sources (machine-readable, verified 2026-08-31). Self-hosted gateways are omitted — you own the data plane.

The two things everyone misses: (1) On every router, your real exposure is the upstream you route to, not the router's own policy — a "ZDR-by-default" router still hits non-ZDR (or training) providers unless you turn on a ZDR-only / no-training filter. (2) "We delete after 30 days" is not always binding — Azure quietly dropped its 30-day commitment, Vertex's Advanced-AI addendum can override ZDR outright, and OpenAI's going-forward court hold (now ended, 2025-09-26) showed how fast a deletion promise can be suspended by litigation. When it matters, get ZDR in the contract, and read the specific upstream endpoint's policy — not just the front-door marketing. Full evidence + source links per row: data/data_retention.json.

🔐 Supply-chain security — who signs their releases, and what actually got hacked

🔑 Your gateway holds every provider key and sees every prompt — it's the highest-value box in your AI stack, and in 2026 attackers stopped brute-forcing it and started shipping it to you pre-backdoored. Posture below is machine-checked from repos, registries and CVE.org (full evidence + incident record, verified 2026-07-28).

Read the advisory column correctly: many published advisories + fast fixes = a working disclosure process, not extra danger. The worst row here is the one with a single unpatched CVE on a dormant repo.

Three receipts that make this a buying axis, not paranoia:

• 🧾 2026-03-24 — the real LiteLLM package, backdoored on PyPI (v1.82.7/.8): a credential stealer with .pth persistence that ran on every Python start, exfiltrating SSH keys and cloud/CI secrets. Not a typosquat — the attackers stole the project's PyPI tokens through a compromised Trivy in its own CI (the TeamPCP campaign, which chained Trivy → npm worm → Checkmarx Actions → PyPI in one week). Pulled the same day (~40 min per the vendor, ~3 h per NHS England's timeline); the response — Mandiant forensics, rebuilt CI, cosign signing — set the disclosure bar for the category. (Datadog Security Labs)
• 🧾 The Shai-Hulud npm worms went after AI tooling camouflage-first: the Nov 2025 wave (796 packages) spoofed commits as the Anthropic Claude Code GitHub App and exfiltrated through a fake api.anthropic[.]com lookalike; the May 2026 wave hit Mistral AI and Guardrails AI packages, and OpenAI rotated code-signing certs after two employee devices were exposed. If your gateway's dependency tree touches npm, this is your blast radius. (Wiz)
• 🧾 Running a public relay is an attack, not just a business model: a 2026 measurement of 428 public relays caught 9 actively injecting malicious code into returned tool calls (two triggered only after 50 calls, or only in YOLO-mode agent sessions), 17 harvesting planted AWS credentials, and one draining a planted ETH key (Your Agent Is Mine) — the same lesson as the package incidents: verify, don't trust (that's what the canary-diff is for).

And one anti-receipt, because evidence cuts both ways: two "critical Kong auth-bypass CVEs" circulating in AI-generated blogspam (CVE-2026-29413/-29414) do not exist at CVE.org — this table counts registry-verified advisories only.

🧰 Companion tools — verify what you picked

This list tells you which gateway to start with; these open-source tools (authorship disclosed below) — help you prove it behaves before trusting it in production:

• 🧰 llm-gateway-bench (live dashboard) — black-box benchmark for any OpenAI-compatible gateway/relay: TTFT & throughput, success rate, price multiple, plus fidelity probes (model-echo, fake-streaming, usage inflation, context truncation). Test your own gateway with your own key and compare it to the best. Maintained by this list's author.
• 🧰 modelprobe - a tiny, dependency-free Go availability prober: point it at a base URL + key and it reports, per model, is it up and how fast. One static binary — drop it in CI or a cron on a $5 VM. Maintained by this list's author.
• 🧰 cocodot-llmprobe (hosted, Chinese UI) — smoke test for any OpenAI-compatible endpoint that needs only that endpoint's key: six fixed prompts with one checkable answer each (instruction, Base64, ~3.5k-char needle, reasoning, arithmetic, code), string-matched, no judge model; smoke subcommand, stdlib-only Python. Flags obviously wrong answers; cannot tell which model answered. MIT; by the cocodot relay's operator (disclosed). (Source reviewed 2026-10-22).
• 🧰 oneapi-key-monitor - MIT stdlib Python monitor combining gateway-pool quota checks with a live customer-key probe; opens the configured database read-only. Operator-maintained; adapt the database schema to your deployment and account for probe usage. (Source reviewed 2026-10-22).

Community relay watch-list

Built on evidence, not hearsay. Newer or unusually cheap relays we've listed but not yet independently fidelity-checked sit here as "vet before use." Run the canary-diff test and report your verdict to move an entry to ✅ verified or ⛔ confirmed-problematic. The script diffs across one or more models in a single pass (--model a,b) and adds a tokenizer/fingerprint probe — system_fingerprint mismatch and prompt_tokens divergence on identical prompts — an independent tell beyond text similarity. A passing canary from a project's own team is logged as self-reported — reaching ✅ verified takes an independent reproduction by someone unaffiliated.

Nothing is ⛔ confirmed-problematic yet — that status needs a reproducible canary verdict or a documented incident, never hearsay. | InferAll | Cost-first | ⚠️ Unverified — vet before use | Self-submitted hosted relay; public documentation reviewed 2026-10-22. Listing does not establish model identity, billing correctness or privacy behavior. | | Obscurify.ai | Cost-first | ⚠️ Unverified — vet before use | Self-submitted hosted relay; public documentation reviewed 2026-10-22. Listing does not establish model identity, billing correctness or privacy behavior. | | APIGOTO | Cost-first | ⚠️ Unverified — vet before use | Self-submitted hosted relay; public documentation reviewed 2026-10-22. Listing does not establish model identity, billing correctness or privacy behavior. | | Jev Agent | Cost-first | ⚠️ Unverified — vet before use | Self-submitted hosted relay; public documentation reviewed 2026-10-22. Listing does not establish model identity, billing correctness or privacy behavior. | | ModelRush | Cost-first | ⚠️ Unverified — vet before use | Self-submitted hosted relay; public documentation reviewed 2026-10-22. Listing does not establish model identity, billing correctness or privacy behavior. | | TopxAI | Cost-first | ⚠️ Unverified — vet before use | Self-submitted hosted relay; public documentation reviewed 2026-10-22. Listing does not establish model identity, billing correctness or privacy behavior. | | codai | Cost-first | ⚠️ Unverified — vet before use | Self-submitted hosted relay; public documentation reviewed 2026-10-22. Listing does not establish model identity, billing correctness or privacy behavior. | | DemonRoute | Cost-first | ⚠️ Unverified — vet before use | Self-submitted hosted relay; public documentation reviewed 2026-10-22. Listing does not establish model identity, billing correctness or privacy behavior. | | ZergRouter | Cost-first | ⚠️ Unverified — vet before use | Self-submitted hosted relay; public documentation reviewed 2026-10-22. Listing does not establish model identity, billing correctness or privacy behavior. | | deCloud | Cost-first | ⚠️ Unverified — vet before use | Self-submitted hosted relay; public documentation reviewed 2026-10-22. Listing does not establish model identity, billing correctness or privacy behavior. | | APIClaw | Cost-first | ⚠️ Unverified — vet before use | Self-submitted hosted relay; public documentation reviewed 2026-10-22. Listing does not establish model identity, billing correctness or privacy behavior. | | TideLink | Cost-first | ⚠️ Unverified — vet before use | Self-submitted hosted relay; public documentation reviewed 2026-10-22. Listing does not establish model identity, billing correctness or privacy behavior. | | Opper | Cost-first | ⚠️ Unverified — vet before use | Self-submitted hosted relay; public documentation reviewed 2026-10-22. Listing does not establish model identity, billing correctness or privacy behavior. | | AICraft | Cost-first | ⚠️ Unverified — vet before use | Self-submitted hosted relay; public documentation reviewed 2026-10-22. Listing does not establish model identity, billing correctness or privacy behavior. | | onomeo | Cost-first | ⚠️ Unverified — vet before use | Self-submitted hosted relay; public documentation reviewed 2026-10-22. Listing does not establish model identity, billing correctness or privacy behavior. | | Infere | Cost-first / Smart routing | ⚠️ Unverified — vet before use | Vendor-submitted prepaid routing gateway; public quickstart inspected 2026-10-22. Runtime fidelity, budget enforcement and savings not independently checked. |

📊 Latest evaluations

Vendor-run overhead harness: ENTERPILOT/ai-gateway-reproducible-benchmark compares GoModel, Bifrost, LiteLLM, Portkey, TensorZero and OmniRoute against a mock upstream on an AWS c7i.large. Published runs use 20,000 requests per variant and five trials at concurrency 10; keep concurrency, versions and carried-forward measurements separate when comparing results. The author maintains GoModel; this list inspected the harness and published results on 2026-10-22, but did not rerun the benchmark. Reproduction: clone the repository and run ./run.sh (provisions paid AWS resources).

A running digest of fresh model, pricing and gateway evals — newest first, every entry dated and sourced. This is the fast-moving signal layer; for our own reproducible cost tables and model scorecard, see the full evaluation set. Spotted a new eval worth tracking? Add it.

📰 What's new

Reverse-chronological, last ~3 months. Older items retire into the chapter or data file that carries their evidence — they are not deleted, just moved out of "new". Item review: 2026-09-14 · last prune: 2026-09-14.

• 2026-09-06 · LiteLLM turned the spend limit into a group-level primitive — v1.100.0 gives a model access group one shared budget enforced across every deployment in it, tracked in a per-window spend table with opt-in rollover of unused headroom. Its MCP plane hardened in the same window: RFC 7662 /introspect for session tokens, RS256-signed session tokens, and toolsets enforced against teams, orgs and users (MCP entitlements landed in v1.96.0, 2026-08-09). If your budget story is still "one master key and a dashboard," this is the shape the category has moved to. (release notes)
• 2026-09-03 · OpenAI shipped a model it classifies at the Critical cyber threshold — which is the clearest argument yet for the governance layer this list catalogues. GPT-6 Astra "meets our Critical threshold" for cybersecurity under the Preparedness Framework, meaning it can find unknown flaws and build exploits across well-protected systems without step-by-step human direction; OpenAI's own external-deployment safeguards include misalignment monitoring on all tool-using inference. Read the MCP/agent-gateway section as infrastructure rather than tooling from here on. (OpenAI Deployment Safety Hub)
• 2026-08-26 · Microsoft documented an active campaign against AI gateways as a class — not a theoretical risk, a monetization pattern. It ties three compromises (LiteLLM via CVE-2026-42271 chained with Starlette's CVE-2026-48710, a RAGFlow deployment, and Kestra via CVE-2026-49869) to one objective: steal provider credentials, persist, and resell the compute. Its mitigations map onto features in this list, so they double as a buying checklist: per-team virtual keys with spend limits instead of a shared master key, block egress to raw-IP hosts and non-standard ports, log DNS for out-of-band callbacks, and treat the gateway as Tier-0. Disclosure cadence across AI infrastructure went from roughly monthly in 2025 to roughly weekly in Q3 2026. (Microsoft Security Blog)
• 2026-08-19 · Stripe agreed to acquire OpenRouter — the consolidation trend reached the category's largest independent. Both sides announced it on Aug 19; neither disclosed terms, with press reporting north of $7B (Bloomberg, TechCrunch) versus the $1.3B May Series B. OpenRouter's commitment is unusually specific and worth holding it to: "same mission, same name, same product, same roadmap. If you build on OpenRouter today, nothing about your integration changes," with routing decisions "driven by one thing: what's best for you." It expected to close "in the coming weeks" — we have not independently confirmed closing as of 2026-09-14. What to actually watch, since neutrality is the product: whether non-Stripe payment rails and provider-neutral routing survive the first year. (Stripe, OpenRouter)
• 2026-08-07 · Cloudflare merged Workers AI and AI Gateway into one wallet — prepaid AI Gateway credits now pay for Workers AI inference under a single balance, and credit-funded frontier models (Kimi K2.6, Kimi K2.7-code, GLM-5.2) get 50 RPM per account per model versus 20 on standard Workers AI billing. Worth noting if you picked Cloudflare specifically as a free control plane in front of your own keys: it is now also a billing layer. (changelog)
• 2026-08-03 · agentgateway bridges both MCP protocol eras — v1.4/v1.4.1 support the 2026-07-28 stateless revision, detecting support via server/discover and federating a mix of legacy and new-era MCP servers behind one gateway. That mixed-fleet path is the practical migration route now that sessions, the initialize handshake and SSE resumability are gone. (announcement)
• 2026-08-02 · The EU AI Act deadline that drives gateway buying moved by 16 months — the Digital Omnibus (Regulation (EU) 2026/1744, in force 2026-07-27) pushed Annex III high-risk obligations, including the Article 12 event logging most audit-gateway shortlists exist to satisfy, from 2026-08-02 to 2027-12-02 (Annex I embedded systems to 2028-08-02). What started on schedule is Article 50 transparency — AI-interaction disclosure, synthetic-content marking, deepfake labelling — which is mostly an application-layer duty your gateway cannot discharge for you. (sourced in the Enterprise & compliance callout above)
• 2026-07-30 · OpenAI cut GPT-5.6 API prices — Luna $1/$6 → $0.20/$1.20 per M tokens (−80%) and Terra $2.50/$15 → $2/$12 (−20%); Sol unchanged at $5/$30. A frontier-family model at Luna's new rate resets the cheap end of a lot of routing maths — re-run your own numbers before trusting any cost table dated earlier, including the snapshot behind this one. (CNBC · OpenAI)
• 2026-07-28 · MCP went stateless — the biggest protocol break since it shipped. Spec revision 2026-07-28 removes protocol-level sessions and the Mcp-Session-Id header, deletes the initialize/notifications/initialized handshake (every request now carries its protocol version and capabilities in _meta), adds a mandatory server/discover RPC, replaces the HTTP GET stream and resources/subscribe with a single subscriptions/listen POST stream, and drops SSE resumability (Last-Event-ID and event IDs) — a broken stream now means starting over. Verified against the repo at the tagged commit on 2026-07-29: the new schema/2026-07-28/schema.ts contains zero references to InitializeRequest or sessionId, where 2025-11-25 had four. For anyone running an MCP gateway this is structural: session-affinity routing stops being necessary and stateless requests load-balance freely, but resumability is now the gateway's problem, not the protocol's. (changelog)
• 2026-07-28 · The July flagship wave rebased the whole scoreboard — Claude Opus 5 (Jul 24) takes the AA-Index top spot (60.7 on the v4.1 scale) and the SWE-bench Verified lead (96.0), Fable 5 settles in at Arena #1 (1508±6), Kimi K3 (Jul 16, weights on HF Jul 27) becomes the top open-weights model, and GPT-5.6 Sol/Terra/Luna (Jul 9), Grok 4.5 (Jul 8) and Gemini 3.6 Flash (Jul 21) fill out the month. Our scoreboard + cost tables are rebuilt on the v4.1 scale with single-source columns (see BENCHMARKS.md); the monthly pricing re-verification came back 12/13 exact — see the evaluations digest for the one that broke.
• 2026-07 · (superseded — see the 2026-08-19 item above) WSJ reported Stripe in talks for OpenRouter at a ~$10B valuation (Jul 23). The talks were real; the reported number was not the one both sides eventually announced, which is a useful reminder of what a pre-deal valuation leak is worth.
• 2026-06 · LiteLLM RCE added to CISA's KEV catalog — CVE-2026-42271 (an MCP command-injection) chains with a Starlette auth-bypass into unauthenticated remote code execution that can reach master keys and provider credentials (KEV-listed Jun 8; further CVEs Jun 16–22). Distinct from March's PyPI supply-chain attack — patch and lock down the gateway control plane. (CSA)
• 2026-06 · Envoy AI Gateway hit v1.0 (Jun 23) — the first production-stable open-source AI gateway built on CNCF Envoy: one API across 16 providers plus a native MCP gateway (backed by Tetrate, Bloomberg, Nutanix, Tencent). (release)
• 2026-06 · Hyperscalers converged on AI-gateway governance — Databricks shipped Unity AI Gateway (smart routing + hard spend caps) at Data+AI Summit, Azure API Management's AI-gateway features reached GA at Build, and AWS extended Bedrock AgentCore Gateway at Summit NY. Runtime governance is now table stakes. (Databricks)
• 2026-06 · Anthropic pulled Fable 5 & Mythos 5 offline globally under a US export-control directive (Jun 12–13), then restored them after the Dept of Commerce lifted the controls (Jun 30) — Fable 5 was back on the Claude platform, Claude.ai and Claude Code by Jul 2. The canonical "this is why you keep multi-provider failover" event of the year. (Fortune, CNBC)
• 2026-06 · GLM-5.2 is the new leading open-weight model — Z.ai's MIT-licensed 744B-param MoE (40B active, 1M context, open-weighted mid-June) tops the open-weight tier of the Artificial Analysis Intelligence Index (score 51), taking the crown from the previous open leaders. (Artificial Analysis)
• 2026-06 · TensorZero shut down — the VC-backed open-source LLMOps gateway ($7.3M seed) archived its repo on June 11 (last commit 2026-06-11, archived: true via the GitHub API; the shutdown was reported the next day), as first-party clouds ship native gateway/observability features and squeeze independents. (byteiota)
• 2026-06 · NetFoundry launched zero-trust MCP and LLM gateways; Cisco Investments joined its Series A. (PR Newswire)
• 2026-05 · Palo Alto Networks completed its acquisition of Portkey (announced Apr 30, closed May 29), making the AI gateway the control plane for its Prisma AIRS security platform — a sign gateways are becoming core security infrastructure. (Palo Alto Networks)
• 2026-05 · OpenRouter raised a $113M Series B led by CapitalG at a $1.3B valuation — ~8M users, ~100T tokens/month. (TechCrunch)
• Trend · MCP gateways emerged as a distinct category; spend-limit enforcement became table stakes; the EU AI Act drives the compliance bucket, though its high-risk deadline slipped to 2027-12-02; new-api overtook one-api as the most active China-ecosystem relay; and an independent-gateway shakeout is underway — Portkey (→Palo Alto) and Helicone (→Mintlify) acquired, TensorZero shut down, and the consolidation kept going (Katanemo→DigitalOcean, TrueFoundry→Seldon, Langfuse→ClickHouse).

🚀 Recent releases (auto-updated)

• 2026-10-22 · labring/aiproxy v0.7.6 — Version 0.7.6
• 2026-10-22 · askalf/dario v6.13.28 — v6.13.28
• 2026-10-21 · archestra-ai/archestra platform-v1.4.1 — platform: v1.4.1
• 2026-10-21 · QuantumNous/new-api v1.0.0-rc.46 — v1.0.0-rc.46
• 2026-10-21 · krakend/krakend-ce v3.0.2 — v3.0.2
• 2026-10-21 · router-for-me/CLIProxyAPI v8.0.38 — v8.0.38
• 2026-10-21 · caozhiyuan/copilot-api v2.7.32 — v2.7.32
• 2026-10-21 · mozilla-ai/otari v0.31.1 — v0.31.1
• 2026-10-21 · lidge-jun/opencodex v2.90.0 — v2.90.0
• 2026-10-21 · tashfeenahmed/freellmapi v0.16.7 — v0.16.7
• 2026-10-21 · NadirRouter/NadirClaw v0.25.1 — v0.25.1
• 2026-10-21 · BerriAI/litellm v1.106.2 — v1.106.2

📚 Essential reading

📖 A short, vetted shelf — every link below was HTTP-checked live (2026-06-15). These are the concepts the comparison tables assume; read them before you commit to a gateway.

• AI gateway vs API gateway: what changes when the traffic is tokens - The Frontier Wire, 2026-09 — a mechanism-by-mechanism comparison (per-token pricing, long streams, provider-specific errors) grounded in AWS, Kong, NGINX, OpenAI and Anthropic docs. (Source reviewed 2026-10-22).
• agentgateway CEL Gotchas: Fail-Open + 403 Fix - Mike Moore, 2026-09 — two authorization-policy mistakes that both report Accepted and Attached, verified on Solo Enterprise for agentgateway v2026.8.2: matchExpressions entries are OR'ed, so one entry per rule fails open, and llm.requestModel is empty at the traffic.authorization phase, so a model check denies every request. Includes a four-request test that catches both. (Source reviewed 2026-10-22).
• Cap LLM Spend per API Key: agentgateway 1.5 - Mike Moore, 2026-09 — per-key token and USD budgets (HTTP 429 on overage, or an Audit mode that records without blocking) and per-key model allowlists (HTTP 403) in open-source agentgateway v1.5.0, with a Docker demo against a mock LLM. Notes that a model missing from the price catalog never charges a USD budget. (Source reviewed 2026-10-22).

What an AI gateway actually is

• The 2026 AI Engineering Report - Amplify Partners (with Notion & Vercel), 2026 — the survey behind the numbers this list assumes: 87% of 1,000+ engineers run multiple models together, 75% are cost-constrained, cost is the #2 production metric, and inference is the most bought (vs built) layer of the stack.
• State of AI Engineering - Datadog, 2026-04 — what the surveys claim, measured: live telemetry from 1,000+ orgs (>70% on 3+ models, rate limits ≈ ⅓ of LLM errors, only 28% of calls cached, system prompts = 69% of input tokens). Telemetry, not opinions — with a self-disclosed customer-base skew.
• State of AI: An Empirical 100-Trillion-Token Study - OpenRouter × a16z, 2026-01 — two years of real multi-provider gateway traffic: open-weight models at ~⅓ of tokens, rapid model turnover, and near-zero price elasticity (quality drives switching). The primary dataset on how routing actually behaves at scale.
• LLM Gateway: The One Decision That Removes 100 AI Engineering Decisions - Latent.Space (swyx), 2025-02 — why one gateway choice collapses routing, caching, observability and guardrails into a single control plane.
• AI Gateway — overview — Cloudflare — first-party docs defining the pattern: one endpoint in front of many providers, with caching, rate limiting, analytics and cost tracking.
• AI Gateway documentation - Kong — how gateway concerns (provider-agnostic routing, PII sanitization, token rate-limiting) map onto mature API-gateway infrastructure.

Routing & fallback

• Routing & load balancing - LiteLLM — cross-provider routing, weighted load balancing and tiered fallbacks from the most-deployed open-source gateway.
• Router architecture (fallbacks & retries) - LiteLLM — how retries-within-group and cross-group fallbacks escalate on 429s and connection errors — the mechanics for judging reliability.
• Load balancing - Portkey — weighted, sticky distribution across providers, models and keys so no single provider becomes a bottleneck.
• FrugalGPT: Using LLMs While Reducing Cost and Improving Performance - Chen, Zaharia & Zou (Stanford), 2023 — the foundational paper behind cost-aware routing: model cascades that try cheap-first and escalate only when needed.
• An Empirical Characterization of Outages and Incidents in Public Services for LLMs - Chu et al. (VU Amsterdam), ICPE 2025 — the peer-reviewed case for failover: across 8 LLM services, a failure lands roughly every 2 days per API (median MTBF 1.99–2.09 days), median recovery ~1h, and only 6.15% of incidents get a postmortem. Their conclusion: treat failure as normal operating procedure.
• LLM inference prices have fallen rapidly but unequally across tasks - Epoch AI, 2025-03 — the economics that make routing rational: the price of a fixed capability level falls 9×–900× per year (median 50×), so yesterday's flagship task is today's budget-tier route.

Semantic caching

• GPTCache documentation - Zilliz — the de-facto open-source semantic cache: embedding + vector-similarity vs. exact-match.
• GPTCache: An Open-Source Semantic Cache for LLM Applications - Fu Bang, EMNLP 2023 — the peer-reviewed case for similarity-matched caching to lift hit rates and cut cost/latency.

Prompt caching (it's a prefix match)

• Prompt caching - Anthropic — the authoritative spec: cache key from exact bytes up to a breakpoint, write/read pricing, and TTLs.
• Prompt caching - OpenAI — cache hits require an exact prefix; put static instructions first and variable content last to maximize reuse.

Reasoning-token cost

• Building with extended thinking - Anthropic — reasoning/thinking tokens are billed and consume the output budget — the economics to grasp before enabling reasoning models behind a gateway.

Security & guardrails

• OWASP Top 10 for LLM Applications - OWASP, 2025 — the standard risk taxonomy; prompt injection is LLM01, the checklist any gateway's guardrails must answer to.
• Design patterns for securing LLM agents against prompt injection - Simon Willison, 2025-06 — six concrete architectural defenses (Dual LLM, Plan-Then-Execute, Action-Selector, …).
• LLM Prompt Injection Prevention Cheat Sheet - OWASP — a defense-in-depth checklist for what a gateway's guardrail layer should implement.

MCP & agent gateways

• Model Context Protocol — specification - The open standard any MCP gateway must speak and govern.
• Building effective agents - Anthropic, 2024 — when to use workflows vs. agents and the composable patterns (routing, orchestrator-workers) the traffic flowing through an agent gateway is made of.
• LLM Powered Autonomous Agents - Lilian Weng, 2023 — the canonical map of agent architecture (planning, memory, tool use) — what an MCP/agent gateway sits in front of and governs.

Observability

• AI Gateway observability - Cloudflare — per-request logs, token usage, cost estimation and OpenTelemetry export across all providers.
• How to monitor your LLM API costs - Helicone — practical cost-per-query tracking and spotting caching / model-downgrade opportunities.
• Your AI Product Needs Evals - Hamel Husain, 2024 — why systematic evals (not vibes) are how you actually catch quality regressions in the request/response data your gateway logs.

Self-hosting economics

• Automatic prefix caching - vLLM — KV-block prefix caching (and per-request cache isolation), the mechanism behind the savings when you self-host behind your own gateway.

Guides & comparisons

In-depth, data-backed comparisons for the questions people actually search:

• 📘 Coding-agent routers (2026) - claude-code-router vs OmniRoute vs 9router vs CLIProxyAPI vs sub2api: savings vs. ban risk
• 📘 LiteLLM vs OpenRouter vs Portkey (2026) - which AI gateway should you use?
• 📘 LiteLLM alternatives (2026) - 8 gateways compared by cost, security & self-hosting
• 📘 OpenRouter alternatives (2026) - 0%-markup, EU-residency & self-hosted options compared
• 📘 Cloudflare vs Vercel AI Gateway (2026) - which 0%-markup hosted gateway?
• 📘 Best self-hosted AI gateway in 2026 - LiteLLM vs Bifrost vs Portkey vs Kong
• 📘 one-api vs new-api vs LiteLLM - Choosing a China-market LLM API gateway (Chinese)

More comparisons coming. Suggest one via an issue.

FAQ

What is an AI gateway (LLM gateway)? A proxy between your code and LLM providers: one OpenAI-compatible endpoint and key for many models, adding routing, failover, caching, rate limits, cost tracking and guardrails. See the intro.

AI gateway vs LLM router — what's the difference? A router decides which model gets each request (e.g. cheap vs flagship); a gateway is the full proxy layer (auth, caching, observability, guardrails) that usually includes routing. See smart routing.

What's the best open-source AI gateway? LiteLLM is the default for breadth (Python, 100+ providers). For raw performance pick Bifrost (Go); for enterprise K8s pick Kong or Higress. Full list under self-hosted.

LiteLLM vs OpenRouter — which should I use? OpenRouter is hosted (zero ops, ~5.5% fee, ~340 models); LiteLLM is self-hosted (your keys, your infra, $0 markup). Hosted to start, self-host when volume justifies it. Cost math in the evaluation set.

What's the cheapest way to call many LLMs? Two different "cheapest": 0% markup on your own keys (Vercel / Cloudflare AI Gateway — you hold each provider account) vs one balance, no key management (OpenRouter, whose ~5.5% fee buys the catalog + failover). Same split as the 10-second answers table. For lowest token cost, route bulk work to cheap models — a 100K-token report runs $0.03 on DeepSeek vs $3.01 on GPT-5.5. See cost-first.

Are AI gateways safe? Who sees my prompts? Every gateway sees your prompts. For sensitive data self-host or require zero-data-retention in writing; check the gateway scorecard for compliance/security ratings and known CVEs.

Do I even need a gateway? Often not yet. If you use one provider, one wire format, one team's budget, and can tolerate an outage longer than an hour, an SDK's built-in retries plus a fallback library cover it — and you skip a component that sits on 100% of your traffic and ships releases you must patch. The handbook works through the six conditions and the tripwires that flip the answer: the case against a gateway.

Will a gateway retry my failed request? Probably not, unless you configured it. Read at pinned commits across six open-source gateways, exactly one retries at the LLM layer by default — Bifrost, Portkey OSS and new-api all ship a default of 0, Kong OSS has no AI-level retry, and Envoy writes no retry count of its own. Details and per-gateway config: retry vs failover.

Does prompt caching actually save money? Only above a break-even hit rate. Reads cost 0.1× base input, but writes cost 1.25–2×, so caching a prefix you rarely hit again is a loss: the break-even is 21.7% on Anthropic's 5-minute tier and OpenAI 5.6+, 52.6% on Anthropic's 1-hour tier. The formula, and which variable actually dominates it: caching economics.

Will a gateway break my coding agent? It can, and four of the five ways are silent. Translating between Anthropic and OpenAI wire formats can drop tool-call identity, reshape or buffer the stream, misreport usage, truncate the system prompt, or strip cache_control — the last one bills cached input at 10× with no error anywhere. Each failure mode is anchored to a real issue, with a ten-minute self-test: the five failure modes.

Glossary

Why this exists

On June 10 I ran Claude Code hard for ~13 hours, and the bill came to ≈ $788. One look at the per-model breakdown told the whole story: the flagship (Fable 5) alone was $617 — 78% of the bill — while the cheap model (Haiku) did 242 real tasks for $1.70. I hadn't done anything clever to rack that up; I'd done the opposite — defaulted every request to the most capable (and most expensive) model because I couldn't be bothered to set up routing.

The fix wasn't "stop using good models." It was route by task — default to a cheap model, escalate to a flagship only when the work is genuinely hard. That's exactly what an AI gateway is for. While I was at it, I couldn't find a single gateway list organized by what you actually need, that scored the options honestly (CVEs and all), and shipped reproducible cost numbers instead of vibes. So I built one — that's this repo.

No vendor money, no affiliate links, CC0. If it saves you one surprise bill, it did its job. ⭐ Star it so the next person mid-$788-day finds it.

Who maintains this — and the conflict of interest

Maintained by Cui Huan, who also runs Runix (Runix AI Inc, Wyoming) — a commercial LLM gateway. That is a conflict of interest with a list that ranks gateways, so here is exactly how it is handled.

Runix Router is not on this list, and will not be added while I maintain it. On paper it would clear the inclusion criteria in CONTRIBUTING.md — it is a commercial gateway with public docs — but a maintainer scoring their own product against competitors is not a score anyone should trust, and no disclosure line fixes that. It is excluded on principle, not on merit.

No entry here is paid, sponsored, or affiliate-linked. Scores follow the published scoring rubric and dated evidence, and the raw data is CC0 so you can recompute any of them. The two companion tools listed further up are mine and labeled as such, because they are things you run against your own gateway rather than products competing for the same buyer.

If a judgement here reads like it was bent toward or against a competitor, open an issue and quote it — that correction is worth more to the list than any entry.

The engineering that comes out of running a gateway in production gets written up on the Runix blog — retry budgets, cost attribution, prompt-cache accounting, why a token bill misses the price list. Those posts are one operator's numbers; this list is the neutral map.

🔌 Use the data — it's an API

Everything behind the tables is machine-readable, CC0, and refreshed by CI — consume it directly (like models.dev, the raw files are the API):

Attribution appreciated, not required. If you build on it, tell us — we'll link you.

Contributing

Contributions welcome! Please read CONTRIBUTING.md first. Inclusion criteria, in short: the project must be an actual gateway/proxy/router for LLM or agent traffic (not an SDK wrapper or chat UI), publicly available, and active within the last 12 months — or clearly labeled as stale.

Listed here? You're welcome to show the badge — — snippet in CONTRIBUTING.md. It never changes your scores; those follow the rubric and evidence only.

🔗 Related lists

This list lives in the awesome-list ecosystem. If it doesn't have what you need, these well-maintained neighbors might — and the gateways here sit between their tools and the models:

• Awesome-LLMOps - The broader LLMOps landscape (serving, fine-tuning, observability) this list's gateways plug into.
• Awesome-LLM - Models, papers and the wider LLM ecosystem.
• awesome-langchain - LangChain tools and LLM app frameworks that call through these gateways.
• awesome-mcp-servers - MCP servers to put behind the MCP & agent gateways here.
• awesome-free-llm-apis - CC0 list of permanently-free LLM APIs, from the team behind the Manifest router listed here; pairs with our verified free-tier limits table.
• AI4S for Programmers - Free two-day course on the data-engineering side of AI for Science (antibody/protein data), for programmers with zero biology background; six runnable labs over a reproducible public dataset.

Maintain a related list and think this belongs in yours? Open an issue — cross-linking helps every list's readers.

Star history