Which AI gateway fits the platforms you run?

Governance layer inside Unity Catalog for Databricks-hosted models, external providers and MCP servers. Formerly Mosaic AI Gateway; generally available since August 2026.

Fits when

Databricks is your centre and Unity Catalog already governs your data and identities.

Watch out for

Much of what sets it apart is still in beta: service policies, smart routing, the unified trace table, external-spend budgets. Budget blocking is approximate. Prompt and response logging is billed per kilobyte. No self-hosted option.

Pricing and licence

Permissions, rate limits and fallbacks are free; usage tracking and prompt and response logging billed per kilobyte; model usage at platform or provider rates.

• Access controlUnity Catalog grants per user, group and service principal; attribute-based policies in beta; per-user OAuth to MCP servers.
• Cost controlBudgets per user or shared, with blocking; request and token limits per minute for each user or service account; cost attribution in Databricks usage tables.
• RoutingTraffic splitting and two-level fallback; smart routing in beta on AWS only; semantic cache not documented.
• ObservabilityUsage and billing system tables, full-payload inference tables, a unified OpenTelemetry trace table in beta.
• GuardrailsSafety filter, PII masking, sensitive-data redaction and policies with human approval; the policy framework is beta.
• Agents and MCPMCP servers as governed catalog objects with per-tool policies, managed OAuth and a CLI for coding agents.
• Deployment flexibilityManaged inside a Databricks workspace only; some features AWS only.
• Vendor independenceAny OpenAI-compatible or major provider with your own keys, but every control lives in Unity Catalog.

Governed access to the Bedrock model catalogue through IAM, Guardrails and invocation logging, with AgentCore Gateway for tools and MCP. External providers go through AgentCore Gateway inference targets or a gateway you run.

Fits when

AWS is your centre, the models you need are on Bedrock, and IAM is already how you control access.

Watch out for

No hard spend caps or per-key token budgets in Bedrock itself. Two inference endpoints with different feature sets. Cross-provider failover needs AgentCore or a LiteLLM deployment you run.

Pricing and licence

No gateway fee; per-token model pricing; Guardrails per text unit; AgentCore Gateway per 1,000 invocations.

• Access controlIAM and SCP policies, API keys, application inference profiles and Cedar policies down to tool parameters.
• Cost controlAttribution through tags, profiles and request metadata; no native hard budgets; the AgentCore token-limit policy is not verified.
• RoutingCross-region inference and model-based routing in AgentCore; cross-provider fallback needs an interceptor or LiteLLM.
• ObservabilityInvocation logs, CloudWatch and CloudTrail; OpenTelemetry-compatible AgentCore observability with Datadog and Langfuse.
• GuardrailsContent filters, denied topics, PII masking, grounding and automated reasoning checks, usable for any model.
• Agents and MCPAgentCore Gateway aggregates Lambda, OpenAPI and MCP targets with semantic tool search, identity vault and policy.
• Deployment flexibilityManaged AWS services only, in many regions including Zürich, with PrivateLink.
• Vendor independenceOpenAI- and Anthropic-compatible endpoints keep clients portable; IAM, Guardrails and policy are AWS-native.

AI gateway policies on Azure API Management: token limits, semantic caching, content safety, MCP and A2A, in front of Foundry, Azure OpenAI and external providers.

Fits when

Azure is your centre and your teams already run API Management with Entra ID.

Watch out for

Token quotas only, no budgets in currency, and counters are per gateway instance. No native PII redaction. The unified model API is still preview. High-volume traffic can force tier upgrades.

Pricing and licence

No AI surcharge; API Management tier from about USD 150 per month, plus Content Safety, Redis and logging.

• Access controlSubscription keys, Entra ID or any IdP via JWT, managed identity to backends, OAuth 2.1 for MCP.
• Cost controlToken limits and calendar quotas per key, product or expression; token metrics for chargeback; no currency budgets.
• RoutingWeighted and priority backend pools, circuit breaker, semantic caching; cross-provider failover in preview.
• ObservabilityPrompt and token logging to Log Analytics, Application Insights metrics, MCP and A2A telemetry.
• GuardrailsAzure AI Content Safety for categories, blocklists and prompt shields; no PII redaction at the gateway.
• Agents and MCPREST APIs as MCP servers, governed remote MCP servers, API Center registry and A2A agent APIs.
• Deployment flexibilityManaged tiers in many regions plus a self-hosted gateway for on-premises or other clouds.
• Vendor independenceOpenAI, Anthropic, Vertex and Bedrock backends behind one facade; policies and monitoring are Azure-specific.

Apigee token quotas, semantic caching and Model Armor screening in front of Vertex AI and any other provider. Apigee hybrid runs on your own Kubernetes.

Fits when

Google Cloud is your centre, or Apigee is already your API platform.

Watch out for

Model Armor policies need the Comprehensive environment, about USD 3,400 per month per region; tier requirements for token and cache policies are not verified. Token quotas per app, no budgets in currency. Model Armor is regional and Gemini-only on the Vertex side. Governing external MCP servers is unclear.

Pricing and licence

Pay-as-you-go per million calls plus environment fees; Model Armor per token; Vertex per token.

• Access controlAPI keys, OAuth and JWT with API products on Apigee; Google Cloud IAM on Vertex; no per-end-user identity at the gateway.
• Cost controlToken quotas per app or developer with hard limits and token analytics; no currency budgets.
• RoutingRouting and circuit breaking from reference samples; semantic cache on Vertex Vector Search.
• ObservabilityAnalytics with token fields, Cloud Logging and Model Armor dashboards; tracing is less turnkey.
• GuardrailsModel Armor: prompt injection, PII redaction, malicious URLs, content filters, document screening.
• Agents and MCPYour APIs as MCP tools with API hub as registry; external MCP governance not documented.
• Deployment flexibilityApigee X managed or Apigee hybrid on your Kubernetes; Vertex managed only.
• Vendor independenceApigee proxies any provider; Model Armor and Vertex features are Google only.

One governed endpoint for Snowflake-hosted models and Cortex agents, with per-user credit quotas and trace tables. In public preview on AWS since September 2026.

Fits when

Snowflake is your centre and your AI use stays inside its model catalogue.

Watch out for

Preview, AWS only, and usage is granted to all users by default. No external providers or self-hosted models. No load balancing or fallback. Guardrails need cross-region inference, which conflicts with strict residency.

Pricing and licence

No separate gateway fee documented; AI Credits per million tokens; regional routing about 10 percent more.

• Access controlSnowflake roles, OAuth and key-pair auth, per-tool MCP permissions, agent identity with dual attribution.
• Cost controlPer-user credit quotas that block automatically, shared budgets, rate-limit policies per model, usage views.
• RoutingCross-region capacity routing only; dynamic model routing not yet released.
• ObservabilityTrace tables per gateway, Snowsight dashboards and usage views; external export not documented.
• GuardrailsHarmful-content filter and prompt-injection detection; PII redaction and custom policies not documented.
• Agents and MCPManaged MCP server with per-tool roles; multi-server MCP governance in private preview.
• Deployment flexibilitySaaS only; the gateway preview is limited to AWS commercial regions.
• Vendor independenceLimited to Snowflake-hosted models; OpenAI- and Anthropic-compatible endpoints are the main portability lever.

Harmonised API and orchestration service in SAP AI Core on BTP, in front of hyperscaler, third-party and SAP models, with content filtering and data masking. Generally available under the Extended plan.

Fits when

SAP BTP is your centre and you want governed model access with masking and filtering inside SAP applications, hosted by SAP.

Watch out for

SaaS on SAP BTP, running on AWS infrastructure. Model availability, token conversion rates and rate limits sit in an SAP Note behind an S-user login. No budgets, no MCP proxy, no tool policy. Fallback is sequential; retries and timeouts are set per model configuration.

Pricing and licence

Extended plan, pay per use in capacity units; a 30-day trial replaced the free plan in 2026; AI unit prices not verified.

• Access controlBTP identity providers and role collections for the launchpad; per-instance service keys for the API, no per-user roles.
• Cost controlConsumption in the BTP cockpit per instance and resource group; per-model attribution not verified; rate limits per model and tenant; no budgets, caps or alerts.
• RoutingOrchestration tries model configurations in order on 429, 408 and 5xx errors or unsupported regions; retries and timeouts per configuration; no balancing.
• ObservabilityInference records with payloads, tokens and latency in your S3, stored without masking; launchpad traces and an audit log; no OpenTelemetry.
• GuardrailsNative input and output filters with Azure Content Safety and Llama Guard 3, plus SAP data privacy masking.
• Agents and MCPClient-side function calling; no MCP proxy or tool policy.
• Deployment flexibilitySaaS on SAP BTP; new features are marked not for sovereign cloud offerings; no on-site option.
• Vendor independenceProprietary SAP service; many providers behind an SAP-specific API; not self-hostable.

AI plugins on Kong Gateway and Konnect, unbundled as AI Gateway 2.0 in September 2026. LLM, MCP and A2A traffic with routing, semantic cache, guardrails and token budgets.

Fits when

Kong is already your API gateway, or you want a broad AI feature set from an API-management vendor.

Watch out for

Nearly every AI capability needs the enterprise licence; open source covers the basic proxy and a regex prompt guard. A per-model surcharge on the Plus plan. Fast release cadence and a product restructuring to migrate through.

Pricing and licence

Open source free; Konnect Plus per gateway with five models included; enterprise custom.Apache-2.0 core, AI plugins mostly enterprise

• Access controlConsumers and groups, OIDC and JWT, Konnect roles and enterprise SSO, principal-based policies, OAuth 2.1 and token exchange for MCP.
• Cost controlToken and cost limits per consumer, group, model or provider; global daily budgets with per-model caps; cost dashboards.
• RoutingSeven balancing algorithms including semantic and priority failover, circuit breaker, retries, semantic cache.
• ObservabilityOpenTelemetry with principal identity, Prometheus, Konnect LLM dashboards, MCP and A2A logging.
• GuardrailsNative regex, semantic, PII and LLM-judge guards plus AWS, Azure, Google and Lakera integrations.
• Agents and MCPMCP proxy with tool-level ACLs, OAuth 2.1 and server bundling, plus a native A2A proxy.
• Deployment flexibilitySelf-hosted, hybrid, dedicated cloud gateways or serverless, with six control-plane regions.
• Vendor independenceApache-2.0 core and an OpenAI-compatible API, but the AI features are enterprise.

LLM proxy, MCP proxy and A2A proxy inside Gravitee API Management, with in-gateway guardrails and PII filtering. Launched as AI Gateway in April 2026.

Fits when

Gravitee is your API platform, or you want a control plane hosted in Switzerland with MCP and A2A governance.

Watch out for

Core AI policies are still alpha. The LLM proxy is text only, without tool calling. Token limits use windows of seconds or minutes; budgets arrive with version 4.13. Documentation has been unstable.

Pricing and licence

Community edition free; Planet from USD 2,500 per month; agent management package on request.Apache-2.0 core, AI policies enterprise

• Access controlOAuth 2.1 with PKCE via Access Management, OpenFGA authorisation on the enterprise auth package, MCP resource server, plans and portal.
• Cost controlToken rate limits per plan or key in second or minute windows; prompt token tracking; budgets due in 4.13.
• RoutingModel aliases and semantic caching; LLM-specific balancing and failover not documented.
• ObservabilityOpenTelemetry tracing and APIM analytics; exporters not verified.
• GuardrailsIn-gateway prompt guard and NER-based PII redaction, still alpha; no third-party moderation hooks.
• Agents and MCPMCP proxy with method-level ACL, OpenAPI to MCP, MCP resource server, A2A proxy with token exchange, agent catalogue.
• Deployment flexibilitySaaS, hybrid or self-hosted; hosted gateways on Azure, AWS and Google Cloud, including Switzerland.
• Vendor independenceApache-2.0 core and an OpenAI-compatible proxy; guardrails, PII and MCP ACL need enterprise packs.

AI gateway, chat and portal in one open-source product under AGPL, with hard budgets and cost analytics. Enterprise adds SSO, granular roles and the model router.

Fits when

you want source-available budgets and a portal for internal teams and can run it yourself.

Watch out for

AGPL copyleft may not suit every organisation. Model routing, budget enforcement with alerts and SSO are enterprise. No semantic cache. MCP governance is split across two Tyk products.

Pricing and licence

Community edition free; enterprise on request, no public prices.AGPL-3.0 community edition

• Access controlGroups and roles with a request-access portal; SSO via OIDC, SAML and LDAP on enterprise.
• Cost controlHard budgets by amount, currency and period per organisation, model or developer; cost metrics in Prometheus.
• RoutingModel router with load balancing and failover on enterprise; no semantic cache.
• ObservabilityPer-request analytics, Prometheus metrics, OpenTelemetry correlation, compliance dashboard.
• GuardrailsScriptable filters with PII redaction and response guard templates; third-party integrations not found.
• Agents and MCPREST and MCP tools with scoped access; the fuller MCP gateway lives in Tyk Gateway.
• Deployment flexibilityDocker, Helm or binary, self-hosted or hybrid; SaaS availability not confirmed.
• Vendor independenceFull source under AGPL, no licence key for the community edition.

Open-source Rust data plane for LLM, MCP and A2A traffic under the Linux Foundation, the successor to Gloo AI Gateway. Solo sells an enterprise control plane with budgets in currency.

Fits when

your platform team runs Kubernetes and wants a foundation-governed gateway for agents and MCP as much as for models.

Watch out for

Assumes Kubernetes for the full feature set. No portal or API lifecycle features. Budgets debit after the response and fail open if the rate-limit service is down. Rapid release cadence and naming churn.

Pricing and licence

Open source free; enterprise on request.Apache-2.0

• Access controlJWT, API keys, OAuth, SPIFFE identity and CEL rules in open source; SAML and consent screens on enterprise.
• Cost controlToken rate limits and per-key budgets in open source; budgets in currency, virtual keys and cost metrics on enterprise.
• RoutingVirtual models with weighted, failover and conditional routing plus retries; no semantic routing found.
• ObservabilityOpenTelemetry GenAI traces, Prometheus token and cost metrics, exportable access logs.
• GuardrailsRegex, OpenAI moderation, Bedrock Guardrails, Model Armor, webhooks and tool-call guards; Purview DLP on enterprise.
• Agents and MCPBroad MCP support with multiplexing, tasks and tool-level rules, plus an A2A gateway.
• Deployment flexibilityBinary or Kubernetes anywhere, including air-gapped; no SaaS.
• Vendor independenceApache-2.0 under Linux Foundation governance with Kubernetes Gateway API.

AI gateway and MCP gateway add-ons for Traefik Hub on Kubernetes: token quotas, semantic cache, content and LLM guards, OpenTelemetry.

Fits when

Traefik is your ingress and you want AI and MCP policies where your Kubernetes traffic already flows.

Watch out for

Kubernetes only, with Redis required for token limits. Response guards buffer streams. No budgets in currency and no alerts. Several features are early access. Add-on pricing on request.

Pricing and licence

Traefik Proxy free; Hub and the AI and MCP add-ons on request.

• Access controlOIDC, OAuth 2.1, JWT and LDAP, managed subscriptions, MCP OAuth resource server, token exchange.
• Cost controlToken rate limits and sliding-window quotas per user, team or host; no currency budgets or alerts.
• RoutingModel matcher, provider failover with circuit breakers, semantic cache; no cost or latency routing.
• ObservabilityOpenTelemetry GenAI metrics and traces, streaming token metrics, tamper-evident transparency logs.
• GuardrailsContent guard with regex or Presidio, LLM guard with Llama Guard, NeMo or Granite, parallel pipelines, MCP guards.
• Agents and MCPMCP gateway with task-based access control and guards; no A2A, registry not verified.
• Deployment flexibilityKubernetes only, self-hosted; air-gapped mode; single-tenant managed on request.
• Vendor independenceProprietary Hub add-ons, but any OpenAI-compatible provider and Kubernetes-native configuration.

AI gateway policies inside the DataPower gateway of API Connect: token limits, caching and an AI usage dashboard for watsonx, OpenAI, Gemini and Azure OpenAI.

Fits when

API Connect is your API platform and your model traffic goes to a few providers.

Watch out for

Four providers, no load balancing or failover, no AI-specific guardrails. MCP features are technology preview. Documentation is fragmented across versions.

Pricing and licence

API Connect subscription; no separate AI gateway price published.

• Access controlConsumer organisations, OAuth and JWT, developer portal, tool-level control for MCP servers.
• Cost controlAI token rate limits per API and an AI usage dashboard by consumer, app and model; no spend budgets.
• RoutingExact response caching only; no LLM balancing or failover found.
• ObservabilityAI usage analytics dashboards; OpenTelemetry and exports not verified.
• GuardrailsGeneric redaction and validation policies only.
• Agents and MCPREST APIs republished as MCP tools with tool-level access control, in technology preview; no A2A.
• Deployment flexibilitySaaS on AWS, reserved instances on IBM Cloud, or on-premises software.
• Vendor independenceProprietary DataPower policy model with per-provider proxies.

Model gateway, MCP gateway and the CalypsoAI-derived AI Guardrails under one control plane. Relaunched in August 2026 and in early access; the guardrails are generally available.

Fits when

F5 already carries your application traffic and you want its guardrails in front of every model.

Watch out for

The gateway is early access with retired documentation, so most features rest on press releases. No public pricing. Air-gapped deployment is planned, not shipped.

Pricing and licence

On request; free trials for the guardrails.

• Access controlRole-based access claimed; identity integration not documented.
• Cost controlToken metering and per-team budgets announced; early access.
• RoutingFallback, model tiering, semantic caching and GPU-aware balancing announced; early access.
• ObservabilityDashboards, audit trails and SIEM export claimed; documentation retired.
• GuardrailsMore than 20 policies including PII redaction, injection defence and compliance packs, deployable on premises.
• Agents and MCPMCP registry and per-tool controls announced; early access; no A2A.
• Deployment flexibilitySaaS or hybrid; guardrails on premises; air-gapped gateway planned.
• Vendor independenceProprietary and bound to the F5 platform.

AI gateway features shipped in the open-source API Manager and the Bijira SaaS: multi-model routing, semantic cache, guardrails, token limits and an MCP hub.

Fits when

you want API-management-grade AI features under Apache-2.0, self-hosted or as SaaS.

Watch out for

Streaming is not supported for AI APIs on the classic gateway. Two gateway runtimes are mid-transition. Bijira is young. No unified LLM API documented. Budgets in currency not verified.

Pricing and licence

API Manager open source free; Bijira from USD 119 per month; enterprise subscription on request.Apache-2.0

• Access controlOAuth 2.0 and key managers, subscriptions, roles, developer portal, tool-level authorisation for MCP.
• Cost controlToken limits per subscription and application with cost tracking; currency budgets not verified.
• RoutingRound-robin and weighted balancing, failover, model routing and semantic caching.
• ObservabilityMoesif-based analytics and OpenTelemetry listed; exporters not verified.
• GuardrailsNine documented native guardrails, from regex to semantic prompt guard and PII masking, plus Azure Content Safety and Bedrock Guardrails.
• Agents and MCPMCP proxy, REST to MCP, MCP hub and governance rulesets; no A2A.
• Deployment flexibilitySaaS, hybrid gateways, private data plane or fully self-hosted.
• Vendor independenceApache-2.0 including the AI features.

Model proxies and LLM, MCP and A2A policies on the Omni Gateway, formerly Flex Gateway, with Agent Fabric as registry. Included with the higher Anypoint tiers.

Fits when

Anypoint is your integration platform and you want MCP and A2A governance from the same control plane.

Watch out for

Requires the higher Anypoint tiers. AI policies need connected mode, so no air-gapped option. Semantic caching depends on Azure AI Search. PII detection is regex and US-centric.

Pricing and licence

Included with Platinum, Titanium, Unlimited and Integration Advanced tiers per the vendor blog, not verified; no public prices.

• Access controlClient ID, OAuth, JWT and SLA tiers; Cedar-based attribute access control for MCP tools.
• Cost controlToken rate limits including reasoning tokens per client or user; usage reports per app and business group; no currency caps verified.
• RoutingModel routing, semantic routing by topic, fallback and semantic caching.
• ObservabilityAnypoint Monitoring with agent telemetry and API analytics; OpenTelemetry export not verified.
• GuardrailsRegex prompt guard and pattern-based PII detection; no third-party moderation.
• Agents and MCPWide MCP and A2A policy catalogue with Agent Fabric registry and visualiser.
• Deployment flexibilityManaged or self-managed gateway, connected mode only.
• Vendor independenceProprietary, tier-gated and bound to the Anypoint control plane.

LLM proxying, multi-provider routing, token limits, caching and guardrail plugins on the Apache APISIX gateway. API7 Enterprise adds roles, SSO and audit; AISIX is a separate Rust gateway from API7.

Fits when

you already run APISIX or API7 and want LLM routing, token limits and guardrails as plugins under an Apache licence.

Watch out for

Open-source APISIX has admin keys but no dashboard SSO, roles, audit log, budgets or MCP tool policy; those sit in API7 Enterprise or in AISIX. The MCP bridge plugin is deprecated. Native PII detection exists in AISIX, not in APISIX. API7 Cloud support for the AI plugins not verified.

Pricing and licence

Open source free; API7 Enterprise per CPU core on request; API7 Cloud Standard USD 250 per gateway group per month plus USD 2 per million calls and USD 10 per service.Apache-2.0; API7 Enterprise proprietary

• Access controlConsumer keys, JWT and OIDC for callers; admin keys with admin or viewer role; roles, SSO, SCIM and audit are API7 Enterprise, scored here as a separate product.
• Cost controlToken limits per consumer, instance or rule; budgets with alerts not found in APISIX or API7 Enterprise.
• RoutingWeighted, hash and semantic balancing, priority fallback, retries, health checks; exact caching on Redis, semantic caching needs Redis Stack.
• ObservabilityPrometheus token and latency metrics, OTLP traces over HTTP without OTel metrics or logs, token fields in access logs, loggers for Splunk, Loki and ELK.
• GuardrailsRegex prompt guard plus Lakera, AWS Comprehend and Aliyun moderation; PII detection is an AISIX feature.
• Agents and MCPThe MCP bridge plugin is deprecated; MCP tool ACLs are API7 Enterprise and the MCP gateway is AISIX, both scored as separate products.
• Deployment flexibilitySelf-hosted via Docker, Helm or packages; API7 Cloud hosts the control plane, data planes stay yours.
• Vendor independenceApache Software Foundation project under Apache-2.0 with ten provider options including OpenAI-compatible.

LLM gateway, the former Lunar.dev proxy, paired with the MCPX MCP gateway under the Boomi Enterprise Platform. Documentation is live; the acquisition closed in July 2026 with no GA statement, though the overview calls the LLM gateway production-ready.

Fits when

Boomi is your integration platform and you want one vendor for MCP tool governance and LLM traffic control on your own Kubernetes.

Watch out for

No GA statement, price list or hosting region published. Cost-aware routing is claimed, but the documented policy routes on token count or task type. PII redaction covers card numbers, e-mail addresses and phone numbers; prompt injection defence is undocumented. No OpenTelemetry or traces.

Pricing and licence

On request; Boomi lists the gateway without prices; the former Lunar tiers (Free up to 50 users, Pro up to 100, Enterprise) show no figures.MIT proxy and MCPX; control plane proprietary

• Access controlIdP SSO, group mapping and per-identity instances in the MCP control plane on enterprise; API keys and team invites for the LLM gateway.
• Cost controlFixed-window request quotas by URL, header or consumer group with nesting; token counting; no token or currency budgets, no alerts.
• RoutingRouting by token count or task; fallback substitutes a model on status 429 to 504; retries with exponential backoff; TTL cache; no balancing across a provider pool.
• ObservabilityPrometheus metrics, Fluent Bit export to Datadog and Grafana, access logs; MCP audit logs as local JSONL with a 14-day default retention; no traces.
• GuardrailsData sanitation redacts card numbers, e-mail addresses and phone numbers; MCP tool hardening and risk scoring; injection prevention claimed without a policy page.
• Agents and MCPMCP gateway with per-agent tool groups, hardened tool variants, OAuth to servers, JSONL audit logs and an SSO control plane.
• Deployment flexibilityHosted admin console with the gateway runtime on your Linux hosts; MCP control plane on Kubernetes in your VPC, on premises or air-gapped; Docker and Helm not on the Boomi help pages.
• Vendor independenceProxy and MCPX are MIT from one vendor; OpenAI- and Anthropic-compatible endpoints; the control plane is proprietary.

Open-source proxy in front of more than 100 providers. Keys, teams, budgets, logging and an MCP gateway, run in your own cluster.

Fits when

you want an independent, open-source gateway in your own cluster and have a platform team to run it.

Watch out for

Python overhead and memory use at high load; a Rust rewrite is in beta. Governance features are increasingly gated to the enterprise licence. A PyPI supply-chain incident in March 2026 was contained.

Pricing and licence

Open source, free. Enterprise licence per seat, custom quote.MIT, enterprise features under a separate licence

• Access controlVirtual keys, users, teams and SSO; organisations and SSO beyond five users need the enterprise licence.
• Cost controlBudgets with hard limits per key, user, team and end customer, plus rate limits and budget metrics.
• RoutingLoad balancing, fallbacks, retries and cooldowns across deployments.
• ObservabilityOpenTelemetry, Prometheus, Langfuse and object storage in open source; Datadog export is enterprise.
• GuardrailsPresidio, Bedrock Guardrails, Azure Content Safety and others; per-key scoping is enterprise.
• Agents and MCPMCP gateway with per-key and per-team permissions and OAuth; no approval workflow.
• Deployment flexibilityDocker, Helm and Kubernetes anywhere, including air-gapped; the managed cloud is thinly documented.
• Vendor independenceMIT code and an OpenAI-compatible API, from one small vendor.

Gateway with an open-source core and a hosted control plane for keys, budgets, guardrails and MCP. Part of Palo Alto Networks since May 2026; the docs now brand it Prisma AIRS AI Gateway.

Fits when

you want a managed control plane with a large guardrail catalogue and accept that governance lives in the vendor cloud.

Watch out for

Budgets and rate limits are enterprise features. The MCP gateway is hosted only. The acquisition by Palo Alto Networks leaves roadmap and pricing open. The open-source gateway has had no release tag since January 2026.

Pricing and licence

Free developer tier; USD 49 per month for 100k logs; enterprise custom.MIT gateway, hosted control plane

• Access controlSSO on the enterprise tier; workspaces and roles from the Production tier; identity forwarded from your IdP for MCP.
• Cost controlCost or token budgets and rate limits per key and workspace, with alerts, on the enterprise tier.
• RoutingWeighted load balancing, fallbacks, retries, conditional routing and semantic cache.
• ObservabilityLogs and traces on all tiers; OpenTelemetry, Datadog and S3 export on enterprise.
• GuardrailsMore than 50 native and partner checks with deny, log, retry or fallback actions.
• Agents and MCPHosted MCP gateway with registry, OAuth, per-user tool control and tool-call limits.
• Deployment flexibilitySaaS, hybrid with the data plane in your VPC, private cloud, or open-source self-hosting.
• Vendor independenceKeys, budgets and policies live in the hosted control plane; the owner is now a security vendor.

Proprietary gateway and MCP gateway with a self-hosted or SaaS control plane. Identity, quotas, guardrails and audit in one product.

Fits when

you want a full control plane, including MCP governance with approvals, in your own VPC or on premises.

Watch out for

Not open source; a licence key is needed even when self-hosted. Native PII and injection checks are SaaS only. Per-user pricing adds up in large organisations.

Pricing and licence

Free developer tier; USD 25 per user per month on Pro; enterprise custom.

• Access controlSSO and SCIM on enterprise; roles, teams, service accounts and scoped keys per user, team and application.
• Cost controlCost or token quotas with hard enforcement; rate limits per user, model and application.
• RoutingWeighted, latency or priority load balancing with retries, fallback and semantic cache.
• ObservabilityOpenTelemetry metrics, traces and logs, with logs kept in your own object storage.
• GuardrailsNative checks plus more than 20 providers, attached per requester, model or tool.
• Agents and MCPMCP registry, OAuth, tool permissions, approvals for risky calls and an audit trail.
• Deployment flexibilitySaaS, hybrid, in your VPC, on premises or air-gapped, from one Helm chart.
• Vendor independenceProprietary control plane, but 30 or more providers behind an OpenAI-compatible API.

Open-source Go gateway with virtual keys, hierarchical budgets, semantic cache and an MCP gateway. The enterprise tier adds SSO, roles and clustering.

Fits when

you want a fast open-source core with budgets and MCP built in, and will run it yourself.

Watch out for

Young product from a small vendor with no SaaS option. Guardrails, SSO, role-based access and high availability are enterprise features. Rate limits apply per key only.

Pricing and licence

Open source, free. Enterprise custom.Apache-2.0

• Access controlVirtual keys, teams and customers in open source; SSO and roles on the enterprise tier.
• Cost controlBudgets per key, team and customer with resets and hard rejection; rate limits per key only.
• RoutingWeighted keys, fallbacks and semantic cache; adaptive balancing and circuit breaker are enterprise.
• ObservabilityPrometheus and OpenTelemetry natively; Datadog, BigQuery and Kafka connectors.
• GuardrailsPII and secrets detection on the enterprise tier; plugin hooks in open source.
• Agents and MCPMCP client, server and agent modes, per-key tool scoping and per-user OAuth.
• Deployment flexibilityDocker, Kubernetes or a binary anywhere, including air-gapped; no SaaS.
• Vendor independenceApache-2.0 core and an OpenAI-compatible API, from one small vendor.

Open-source gateway on Envoy Gateway, formerly Envoy AI Gateway, now a Linux Foundation project. Token-aware limits, an MCP gateway and OpenTelemetry for Kubernetes estates.

Fits when

your platform team runs Kubernetes with Envoy Gateway and wants a foundation-governed data plane rather than a product.

Watch out for

Kubernetes, Envoy Gateway and Redis are hard requirements. No UI, no keys, no budgets in currency and no user model. Guardrails are not yet merged.

Pricing and licence

Open source, free. Commercial support from Tetrate.Apache-2.0

• Access controlInbound auth delegated to Envoy Gateway policies, not verified, and tenant headers; no user or team objects.
• Cost controlToken-based rate limits per tenant and model; no budgets in currency and no alerts.
• RoutingPriority fallback, retries and traffic splitting; semantic cache and routing not yet released.
• ObservabilityPrometheus metrics and OpenTelemetry tracing with GenAI semantic conventions.
• GuardrailsNone released; a guardrail policy is in review.
• Agents and MCPMCP gateway multiplexes servers with OAuth and rule-based tool authorisation.
• Deployment flexibilityKubernetes with Envoy Gateway only; the standalone CLI is experimental.
• Vendor independenceApache-2.0 under the Linux Foundation, maintained by several companies.

Open-source gateway inside the MLflow tracking server, rebuilt in 2026. Endpoints over 15 or more providers with fallbacks, usage tracking and MLflow tracing.

Fits when

you already run MLflow and want a light governed endpoint for a data science team, not a company-wide control plane.

Watch out for

Months old in its current form. Basic authentication only, no keys or teams, and no MCP support. Shares its name with the legacy gateway; Databricks Unity Gateway, formerly Mosaic AI Gateway, is a separate product.

Pricing and licence

Open source, free.Apache-2.0

• Access controlHTTP basic authentication; no keys, teams or roles.
• Cost controlUsage tracking per endpoint and team; budget alerts advertised, limits not verified.
• RoutingFallback chains, retries and traffic splitting.
• ObservabilityUsage dashboard and native MLflow tracing.
• GuardrailsContent filters and LLM judges mentioned; depth undocumented.
• Agents and MCPNone in the open-source gateway.
• Deployment flexibilitySelf-hosted with the tracking server, or managed on Databricks.
• Vendor independenceApache-2.0 under the Linux Foundation, driven by Databricks.

Proprietary control layer with an OpenAI-compatible gateway for LLM, MCP and agent traffic, inventory, budgets, guardrails and EU AI Act evidence. Runs in your own Kubernetes; the vendor cites Banca d'Italia and Leonardo as users.

Fits when

you are a regulated EU organisation that wants a single-tenant gateway with EU AI Act evidence inside your own Kubernetes and accept a closed, sales-led product.

Watch out for

Public documentation lags the website: it describes a hosted web app, documents failover and two guardrail types. SSO via OIDC and SAML, retries and complexity routing are claimed on the website, not in the docs; OpenTelemetry not documented. No public pricing, release notes or source code.

Pricing and licence

Annual enterprise subscription billed in advance, quoted per scope; no public prices; provider consumption billed separately.

• Access controlPer-app keys, four tenant roles, Google or Microsoft sign-in with 2FA; OIDC and SAML SSO with IdP group mapping claimed on the platform page, absent from the docs.
• Cost controlBudgets per app, team and model with hard caps, alerts and chargeback claimed on product pages; the docs show dashboards, no budget settings.
• RoutingFailover documented; balancing, retries and complexity-based routing claimed on the website; semantic cache not verified.
• ObservabilityTraces with guardrail decisions, cost and latency; events to Splunk, Datadog, Grafana and Snowflake; OpenTelemetry not verified.
• GuardrailsToxicity, PII, prompt injection and EU AI Act checks listed on the website; two types documented; no integrations verified.
• Agents and MCPMCP server registry, agent authentication and A2A policy claimed on the website; tool allowlists per identity not found; no MCP material in public docs.
• Deployment flexibilityHelm charts into your Kubernetes on Azure, AWS, GCP, on premises or air-gapped; no hosted option.
• Vendor independenceProprietary licence; OpenAI-compatible API; the docs list integrations for OpenAI, Google, Azure, Anthropic, AWS and OpenRouter.

Open-core Go gateway from NeuralTrust for LLM, MCP and agent traffic with routing, budgets, tracing and per-user tool access. The repository dates from May 2026 and is pre-1.0.

Fits when

you want one gateway for models and MCP tools with per-user tool access, accept a young open core and may buy the vendor detection service.

Watch out for

Four months old, pre-1.0, ten GitHub stars. Injection and PII detection need the proprietary TrustGuard service. Budgets stop shortly after the ceiling and have no alerts. Streamed responses cannot be blocked. No Prometheus endpoint found.

Pricing and licence

Open source free; free SaaS sign-up; no public price list; enterprise on request.Apache-2.0; SSO, roles, audit and detection proprietary

• Access controlApplication keys, Okta or Entra ID tokens and OAuth2 PKCE for agents; console SSO and roles; SCIM limited to Microsoft Entra ID; tier gating not documented.
• Cost controlToken or dollar budgets per gateway, application and end user with reject or downgrade; list prices unless contract pricing is entered; soft ceiling, no alerts.
• RoutingRound robin, weighted and least-connections balancing, health checks, fallback chains, complexity-based routing, Redis semantic cache.
• ObservabilityPer-request traces, analytics, OTLP exporters per gateway, end-user attribution, SIEM alert forwarding, audit logs kept 365 days with CSV or JSON export; Prometheus not verified.
• GuardrailsRegex masking native; OpenAI, Azure, Bedrock and Model Armor integrations; injection, PII and toxicity need TrustGuard.
• Agents and MCPMCP plane with OAuth2 PKCE, per-application tool restrictions, per-user grants, per-tool rate limits and traced calls.
• Deployment flexibilitySingle binary or Helm, including air-gapped; SaaS with hosting regions not documented; hybrid and managed options, tier gating not documented.
• Vendor independenceApache-2.0 from one vendor, 14 providers per the docs behind an OpenAI-compatible API; SSO, audit and detection are proprietary.

Edge gateway with caching, rate limits, spend limits, logs and guardrails in front of 14 or more providers. Core features are free on every Cloudflare plan.

Fits when

you want control fast with no infrastructure, and processing prompts on a global edge is acceptable.

Watch out for

API tokens cannot be scoped to one gateway. Prompts are logged by default. Guardrails do not support streaming. Dynamic routing still depends on a deprecated endpoint. No Swiss or regional processing option.

Pricing and licence

Core features free; 100k logs free, 10M logs and Logpush on Workers Paid; 5 percent fee on unified billing credits; no fee for your own keys.

• Access controlCloudflare Access adds SSO and per-user identity; API tokens reach every gateway in the account.
• Cost controlSpend limits in USD by model, provider, user or metadata, with fallback routing; rate limits per gateway.
• RoutingDynamic routes, retries and exact-match cache; semantic cache planned.
• ObservabilityFull payload logs and Logpush export; no OpenTelemetry export; storage caps stop logging silently.
• GuardrailsLlama Guard categories and Cloudflare One DLP profiles; no streaming support.
• Agents and MCPMCP governance lives in Cloudflare One, not in the gateway.
• Deployment flexibilitySaaS on the global edge only; not compatible with regional services.
• Vendor independenceStandard request formats and your own keys; billing, routing config and Access are Cloudflare-specific.

Single endpoint to 200 or more models with provider failover, budgets, a no-retention option and no markup on tokens.

Fits when

your applications run on Vercel and you want failover and budgets without a gateway to run.

Watch out for

Budgets are soft caps and exclude your own keys. Requests with your own keys can fall back to Vercel credentials. No content guardrails, no MCP governance, no prompt-level audit trail. Processing region not yet pinnable.

Pricing and licence

Zero markup on tokens; prepaid credits; allowlists, zero data retention and reporting metered per 1,000 requests.

• Access controlTeam-scoped keys with roles and a budget-manager permission; keys end when their creator leaves.
• Cost controlBudgets per team, project, key and user with alerts; soft caps, and spend on your own keys is not counted.
• RoutingProvider failover, model fallback chains, routing rules, virtual models and prompt-cache orchestration.
• ObservabilityMetadata logs and OpenTelemetry trace drains without prompt content.
• GuardrailsNone; only allowlists, zero data retention and safety identifiers.
• Agents and MCPNone in the gateway.
• Deployment flexibilitySaaS only; inference region can be pinned to the US or EU.
• Vendor independenceStandard formats and your own keys; routing rules and credits are Vercel-specific.

Router in front of 400 or more models from 80 or more providers, with credit limits, guardrails and export to 19 observability sinks. Acquisition by Stripe agreed in August 2026.

Fits when

you want access to several hundred models with no infrastructure and can live with a US-centric service.

Watch out for

Pending Stripe acquisition. A 5.5 percent credit fee and a fee on your own keys above an allowance. In-region routing and data-region guardrails need the Business or Enterprise plan. Prompt-injection detection is regex-based.

Pricing and licence

No markup on tokens; 5.5 percent fee on credit purchases; Business and Enterprise plans on request.

• Access controlOrganisations, workspaces, SSO and SCIM on enterprise; only admin and member roles.
• Cost controlPer-key credit limits with resets, guardrail budgets per member or key, hard stop at zero balance.
• RoutingProvider sort by price, throughput or latency, fallbacks, zero-retention filters and an auto router.
• ObservabilityMetadata by default, prompt logging opt-in; Broadcast to Datadog, Langfuse, OpenTelemetry and more.
• GuardrailsBudgets, allowlists, zero data retention, PII redaction and regex injection filters.
• Agents and MCPNo MCP governance.
• Deployment flexibilitySaaS; EU and US in-region routing on Business and Enterprise plans.
• Vendor independenceOpenAI-compatible with your own keys; credits and routing config are OpenRouter-specific.

Router in front of 300 or more models with spend caps, an MCP gateway and regional endpoints in the EU, US and Asia. Seed-stage vendor in London.

Fits when

you want an EU-hosted routing layer with MCP governance and no infrastructure, at small scale.

Watch out for

Seed-stage vendor, SOC 2 still in progress. A 5 percent markup on pay-as-you-go. Prompts retained 30 days by default. Analytics visible to all members on pay-as-you-go. The EU endpoint does not pin where the model runs.

Pricing and licence

Free tier; pay-as-you-go with 5 percent markup; enterprise on request.

• Access controlEnterprise SSO, five-level roles and audit logs; pay-as-you-go shows data to all members.
• Cost controlMonthly caps per key, user and group with alerts; monthly resets only.
• RoutingFallback chains with retries, weighted load balancing and latency routing.
• ObservabilityAnalytics per key, user and model with CSV export; no OpenTelemetry streaming documented.
• GuardrailsPII and secrets detection with masking; injection and moderation checks not documented.
• Agents and MCPMCP gateway with tool allowlists per server and per-user keys on enterprise.
• Deployment flexibilitySaaS only, with EU, US and Asia endpoints.
• Vendor independenceOpenAI-compatible with your own keys; policies and MCP config live in Requesty.

EU-hosted SaaS gateway from the Nord Security founders, 200+ models per the vendor site and 99+ in the docs catalogue, behind one OpenAI-compatible endpoint, with spend caps and an employee workspace. SOC 2 Type II and ISO 27001 certified.

Fits when

an EU-hosted managed gateway with spend caps and a governed employee workspace matters more to you than self-hosting, log export or MCP policy.

Watch out for

SaaS. Logs are kept for seven days and exports go through the vendor. SSO, roles and audit logs sit in the Enterprise tier. The MCP gateway is marked coming soon and the status of your own provider keys is stated inconsistently.

Pricing and licence

Pay as you go at provider rates plus a 5 percent platform fee; workspace seats USD 39 per month; API access needs a paid plan plus API credits; enterprise on request.

• Access controlUser and team keys with expiry; SSO, roles and audit logs on the Enterprise tier; SCIM and OIDC not verified.
• Cost controlBudgets per team and user with an HTTP 402 hard stop; keys inherit the owner's budget; usage API for attribution; alerts not verified.
• RoutingModel fallbacks documented; smart routing documented for Chat and claimed for the API; load balancing claimed; retries and semantic cache not verified.
• ObservabilityLogs with spans for seven days, metrics for 90 days, usage API; exports on request; no OpenTelemetry documented.
• GuardrailsNative PII and regex validators that redact or block; ActiveFence and Pangea named on the website without a docs page; injection detection not verified.
• Agents and MCPMCP gateway listed as coming soon; MCP servers can be added at organisation level in the workspace for all members; no per-user tool policy.
• Deployment flexibilitySaaS hosted in Europe; the docs mark each model's location as EU, US or other; no self-hosted or customer-cloud option.
• Vendor independenceProprietary, OpenAI-compatible API over 13 providers; not self-hostable; own provider keys marked coming soon.