Portkey Alternatives (2026): 7 AI Gateways Compared
Portkey is one of the best AI gateways ever shipped — and since May 2026 it belongs to Palo Alto Networks. Teams re-evaluating their gateway layer have seven credible paths, from a like-for-like open-source swap to a full governance platform.
Nobody shortlists Portkey alternatives because Portkey is a weak product. Its gateway fronts 1,600+ models across 45+ providers, its request-level observability leads the category, and its guardrails ecosystem is broad and mature. The reason this page exists is the April 30, 2026 announcement — completed May 29 — that Palo Alto Networks acquired Portkey to become the gateway layer of Prisma AIRS. Acquisitions of this kind often work out fine. They also change roadmaps, packaging and pricing, and as of July 15, 2026 the public docs changelog stops at April 2026 and the last open-source gateway release predates the deal.
This guide compares seven alternatives honestly, using the same ten-axis rubric we apply to every gateway, with every claim cited to vendor documentation. Which one fits depends on why you are leaving — roadmap risk, cost, sovereignty or the governance layer Portkey never built.
Why teams look beyond Portkey
Start with what Portkey does well, because any alternative has to clear this bar: category-leading model breadth behind one OpenAI-compatible API, request logging with 21+ analytics metrics, per-key budgets, sync-blocking guardrails with a partner ecosystem, and a deployment ladder that runs from SaaS to fully air-gapped. Teams that are happy on Portkey have little technical reason to move today.
The first switch driver is ownership uncertainty. Portkey's buyer is now a security platform vendor folding it into Prisma AIRS, which signals a CISO-oriented future. That may be exactly what you want — or it may mean the developer-first free tier, the MIT gateway core and standalone packaging get deprioritized. The quiet public roadmap since the acquisition (docs changelog stopped April 2026, as of July 15, 2026) is the data point most prospects cite.
The second is cost structure. Portkey's paid platform is priced per request tier (pricing); at high volume, teams weigh that against free open-source gateways they can self-host — LiteLLM, Bifrost, Kong's OSS core — or against Cloudflare's free edge gateway. What acquisition integration does to enterprise pricing remains to be seen, which makes multi-year commitments harder to underwrite.
The third is scope. Portkey governs the traffic that flows through Portkey. It does not document an organization-wide AI inventory, EU AI Act / ISO 42001 / NIST AI RMF evidence tooling, or agent sandboxing as of July 15, 2026. Teams whose real problem is proving control over AI — not routing it — end up needing a governance platform rather than a faster gateway.
How we chose the alternatives
- A real runtime data path. Every entry proxies LLM traffic and can enforce policy on it — no workflow-only tools.
- Documented capabilities only, verified against vendor docs as of July 15, 2026; vendor performance numbers are reported as claims, not facts.
- Deployment sovereignty options — SaaS, hybrid, self-hosted, air-gapped — stated plainly, since Portkey's own ladder is a benchmark here.
- Migration friction. Portkey is OpenAI-compatible; alternatives that are too make switching a base-URL change rather than a rewrite.
- Vendor stability, which is the reason many readers are here: ownership, funding and release cadence are treated as first-class facts.
The alternatives at a glance
| Product | Best for | Deployment | Open source | Pricing model |
|---|---|---|---|---|
| LiteLLM | Platform teams standardizing LLM access on a self-hosted, OSS-first gateway — with the engineers to run it. | Self-hosted (Docker, Kubernetes, Helm, Terraform) — air-gap supported | MIT core; enterprise/ directory under a commercial license | OSS core free; enterprise license by quote (contact sales), with a free 7-day trial |
| Kosmoy | Regulated enterprises that need governance enforced in the runtime path, in their own infrastructure. | Self-hosted — single-tenant, your own Kubernetes (air-gap capable) | Proprietary | Enterprise subscription; no self-service tier. |
| Kong AI Gateway | Platform and API teams — especially existing Kong customers — extending proven gateway governance to LLM, MCP and agent traffic. | Konnect (SaaS control plane, customer-hosted data planes) or fully self-managed; air-gap marketed for Enterprise | Apache-2.0 core (incl. ai-proxy); many AI plugins Enterprise/Konnect-only | OSS gateway free; Konnect has free and self-serve tiers; Enterprise by quote — AI Gateway is not sold separately |
| TrueFoundry | Platform and ML infrastructure teams in regulated sectors that run Kubernetes and want gateway governance plus model serving on their own GPUs. | SaaS, hybrid, or self-hosted on your Kubernetes — documented air-gapped install | Proprietary platform; OSS side projects (aitori, Apache-2.0) | Free developer tier, self-serve paid plans and a custom enterprise tier — figures on the pricing page |
| Bifrost (Maxim AI) | Platform and infrastructure teams that want the fastest possible self-hosted LLM gateway, including regulated shops that need in-VPC or air-gapped deployment. | Self-hosted (Docker/Kubernetes/Go SDK); enterprise in-VPC, on-prem or fully air-gapped | Apache-2.0 core (~6.5k stars); clustering, guardrails and SSO are commercial | OSS core free to self-host; Bifrost Enterprise by quote with a 14-day trial. |
| Cloudflare AI Gateway | Developer and platform teams — especially existing Cloudflare/Workers shops — that want a free, zero-ops edge proxy for caching, reliability, multi-provider routing and cost control. | SaaS only — runs on Cloudflare's global edge; no self-hosted or VPC option | Proprietary | Core gateway features free on all plans; log storage tied to the Workers plan; guardrails billed as Workers AI inference; Unified Billing adds a 5% fee on provider credits. |
| Helicone | Existing Helicone users who need continuity; the maintenance-mode status makes it hard to recommend for new adoption in 2026. | SaaS; full platform self-hostable (Docker Compose, Helm); no air-gapped option documented | Apache-2.0 (main platform repo, ~5.9k stars) | Free Hobby tier (10k requests/month); Pro from $79/mo; Team $799/mo adds SOC 2 and HIPAA; gateway usage billed at provider cost (zero markup). |
Last verified July 15, 2026 against each vendor's public documentation.
Capability shape vs Portkey
Each panel shows one alternative across the same ten capability axes (0–10); the dashed outline is Portkey for reference. The further a shape reaches on a spoke, the stronger that capability.
The alternatives, one by one
LiteLLM
Open-source LLM proxy & AI gatewayLiteLLM is BerriAI's open-source proxy and Python SDK that puts 100+ LLM providers behind one OpenAI-compatible API — with spend tracking, guardrails, MCP and A2A gateways, and an enterprise license that adds SSO, RBAC and audit logs on the same self-hosted deployment.
The closest like-for-like replacement. LiteLLM covers the same job — one OpenAI-compatible API to 100+ providers with budgets, virtual keys, guardrails and an MCP gateway — as self-hosted open source with a 53.6k-star community and weekly releases.
Where it beats Portkey
- No acquisition risk in the code: the MIT core self-hosts everything, and the enterprise tier is a license key on your own deployment — no vendor cloud at all.
- Release velocity: weekly stable releases through 2026 and a Rust migration targeting sub-1ms overhead announced June 2026, versus Portkey's quiet post-acquisition changelog.
- Free at any scale if you run it yourself; Portkey's platform features are metered.
Where it falls short
- Observability is strong but less polished than Portkey's 21+ metric request analytics and dashboards.
- Guardrails orchestrate third-party engines rather than matching Portkey's 20+ built-in checks with sync blocking and a partner marketplace.
- You own the operations — Postgres, Redis, upgrades, on-call — where Portkey offers managed SaaS and hybrid.
Kosmoy
AI management platformA self-hosted control plane for enterprise AI: one inventory, one policy gateway, one audit trail and a containment sandbox for every model, agent and MCP server a company runs.
The pick when the reason for leaving is governance, not just routing. Kosmoy is an AI management platform — inventory, gateway, compliance evidence and agent containment in one self-hosted product — rather than a gateway with add-ons.
Where it beats Portkey
- Inventory beyond the gateway: four registries, including a master agent registry with Foundry, Bedrock, Vertex, Salesforce and ServiceNow connectors — Portkey only catalogs what it routes.
- Compliance evidence: EU AI Act, ISO 42001 (aligned) and NIST AI RMF bundles from one source; Portkey documents none of these as of July 15, 2026.
- Containment and ownership: kernel-enforced Action Capsule sandboxing with a kill switch, from an independent, founder-owned vendor with no acquisition overhang. In production at Italy's central bank and Europe's largest defence group.
Where it falls short
- Gateway breadth: Portkey's 1,600+ models and routing feature set are deeper than Kosmoy's gateway.
- Request-level observability: Portkey's analytics are more granular than Kosmoy's cost and usage monitoring.
- No free or self-service tier — adoption runs through enterprise sales, not a developer signup.
Kong AI Gateway
AI gateway on the Kong API platformKong AI Gateway is the AI extension of Kong's API gateway: a plugin-based data path that proxies, secures, rate-limits, caches and observes LLM, MCP and agent-to-agent traffic — self-managed or via the Konnect SaaS control plane.
The API-platform answer. Kong extends a battle-tested gateway (43.8k stars) to LLM, MCP and — since 3.14, April 2026 — agent-to-agent traffic, the only mainstream gateway covering all three patterns in one runtime.
Where it beats Portkey
- Broader traffic coverage: A2A protocol governance went GA in April 2026; Portkey's agent gateway is newer and narrower.
- One gateway for all APIs: teams already on Kong govern REST, LLM and MCP traffic with one operating model instead of adding a second gateway.
- Stable, independent ownership and a hybrid model where Konnect data planes — and your prompts — stay in your infrastructure.
Where it falls short
- LLM-native depth: no prompt management, and LLM observability is thinner than Portkey's request analytics.
- The interesting AI plugins — semantic prompt guard, PII sanitizer, LLM analytics — are Enterprise/Konnect-only; the free OSS tier covers mainly ai-proxy basics.
- No evals tooling of any kind, where Portkey at least offers playground comparisons.
TrueFoundry
Enterprise AI gateway & Kubernetes-native ML platformTrueFoundry is a Kubernetes-native enterprise AI platform that combines LLM, MCP and Agent gateways with model serving, fine-tuning and GPU orchestration — deployable as SaaS, hybrid, self-hosted or fully air-gapped.
The platform-scope alternative: an AI gateway plus a full Kubernetes ML platform (model serving, fine-tuning, GPU orchestration), named a Representative Vendor in the February 2026 Gartner Market Guide for AI Gateways.
Where it beats Portkey
- Scope: LLM, MCP and Agent gateways plus vLLM/Triton serving and fine-tuning — Portkey governs traffic but cannot host your models.
- A documented air-gapped install path (images mirrored to a customer OCI registry, no outbound dependencies) aimed at defence and regulated finance.
- Agent-level FinOps controls: per-agent identities with cost-velocity circuit breakers and instant tool revocation.
Where it falls short
- Observability and guardrails largely orchestrate external engines; Portkey's native depth is greater.
- A smaller vendor (~$21M raised) digesting its own acquisition (Seldon AI, June 2026) — a milder version of the risk Portkey leavers are fleeing.
- Kubernetes-first operating model is heavier than Portkey's SaaS onboarding for teams that only need routing.
Bifrost (Maxim AI)
Open-source high-performance AI gatewayBifrost is Maxim AI's Go-based open-source gateway — vendor benchmarks claim ~11 microseconds of overhead at 5,000 RPS — unifying 1,000+ models across 23+ providers behind one OpenAI-compatible API, with virtual keys and budgets, enterprise guardrails, an MCP gateway and clustering.
The performance-first swap. Bifrost is an Apache-2.0 Go gateway whose vendor benchmarks claim ~11 microseconds of overhead at 5,000 RPS — with budgets, virtual keys, an MCP gateway and air-gapped enterprise deployment.
Where it beats Portkey
- Raw gateway overhead, per vendor-run benchmarks Portkey does not attempt to match.
- Fully open-source core with no vendor cloud; enterprise adds clustering and guardrails on infrastructure you control, including air-gapped with no telemetry.
- No acquisition overhang — though as a $3M-seed startup it carries early-stage risk instead.
Where it falls short
- Ecosystem maturity: ~6.5k stars and 23+ providers versus Portkey's community, 45+ providers and integration surface.
- Guardrails are enterprise-only and thinner than Portkey's marketplace; no prompt management or evals tooling.
- Observability is Prometheus/tracing-grade, not Portkey's 21+ metric analytics suite.
Cloudflare AI Gateway
Edge AI gatewayCloudflare AI Gateway is an edge proxy between applications and major AI providers, adding caching, rate limiting, spend limits, logging and analytics, dynamic routing with fallbacks and retries, stored provider keys and Llama-Guard-based guardrails on Cloudflare's global network.
The zero-ops option. Cloudflare's edge gateway makes caching, rate limiting, routing, retries and spend limits free on all plans — from a public company that is not going anywhere.
Where it beats Portkey
- Price: the core gateway is free at every plan level; Portkey's equivalent features are paid.
- Operational simplicity and edge scale — nothing to host, and Cloudflare has documented scaling the gateway to billions of logs.
- Public-company stability versus post-acquisition integration uncertainty.
Where it falls short
- Sovereignty is the opposite of Portkey's ladder: SaaS-only, all traffic transits Cloudflare's edge, and the Data Localization Suite docs list AI Gateway as incompatible with Regional Services — no air-gapped or VPC option exists.
- Guardrails rest on a single moderation model (Llama Guard 3 8B) versus Portkey's 20+ checks and partners.
- No prompt management, no MCP gateway, and evals limited to cost/speed/thumbs-up feedback.
Helicone
LLM observability platform with an AI gatewayHelicone is an open-source, developer-first LLM observability platform (traces, costs, prompts, experiments) with a lightweight Rust AI gateway and zero-markup cloud gateway — in maintenance mode since Mintlify acquired the company in March 2026, with feature development ended.
A qualified entry: Helicone paired strong open-source LLM observability with a lightweight Rust gateway and zero-markup billing — but it has been in maintenance mode since the March 2026 Mintlify acquisition, with feature development ended. Fine for existing users; hard to recommend as a new Portkey replacement.
Where it beats Portkey
- Cost model: zero-markup passthrough billing and a $79/month Pro tier undercut Portkey's platform pricing.
- Self-hostable observability stack (Apache-2.0) with deeper prompt-experiment tooling than Portkey's playground.
Where it falls short
- Maintenance mode is the story: Portkey's roadmap is uncertain, Helicone's has formally ended.
- No guardrails, no MCP gateway, no air-gapped deployment documented as of July 15, 2026.
- The cloud gateway was still reported as private beta in 2026 — thin enterprise track record, now frozen.
Decision guide
Questions buyers ask
Should I leave Portkey because of the Palo Alto Networks acquisition?
Not necessarily. Portkey remains one of the strongest gateways on the market, and Palo Alto Networks gives it enterprise security distribution few startups could match — for CISO-led buyers the acquisition is arguably a reason to stay. The honest concerns are narrower: the public docs changelog stops at April 2026, the last open-source gateway release predates the deal, and future packaging under Prisma AIRS is unknown as of July 15, 2026. If your dependency on Portkey is deep and your planning horizon is multi-year, it is prudent to know your exit path — which, thanks to OpenAI compatibility, is a base-URL change.
Is LiteLLM a good replacement for Portkey?
For most gateway workloads, yes — it is the closest functional match: one OpenAI-compatible API to 100+ providers, virtual keys, budgets, guardrails and an MCP gateway. The trade is operational: LiteLLM is software you run (Postgres, Redis, upgrades), its guardrails orchestrate third-party engines rather than shipping Portkey's built-in check library, and its enterprise pricing is quote-based. Teams that wanted a managed service should look at Kong Konnect or Cloudflare instead.
Which Portkey alternative is best for EU AI Act compliance?
Kosmoy is the only entry on this list that documents EU AI Act tooling: risk classification in an AI systems registry and framework-mapped evidence bundles (EU AI Act, ISO 42001 aligned, NIST AI RMF) generated from registry state plus gateway logs. Note the current timeline: after the May 2026 Digital Omnibus agreement, high-risk obligations land in December 2027 and August 2028, while Article 50 transparency obligations still apply from August 2, 2026. None of the other six gateways documents EU AI Act evidence tooling as of July 15, 2026.
What is the cheapest Portkey alternative?
At the infrastructure level, Cloudflare AI Gateway — its core features are free on all plans — provided you accept that all traffic transits Cloudflare's edge with no self-hosted option. If you can run your own gateway, LiteLLM, Bifrost and Apache APISIX are free open source; your cost becomes the engineers who operate them. Helicone's zero-markup billing is cheap too, but its post-acquisition maintenance mode makes it a poor new bet.
Can I run one of these alternatives alongside Portkey during migration?
Yes, and most teams should. Every gateway here except Azure-style API products speaks the OpenAI-compatible dialect Portkey uses, so applications can be moved one base URL at a time. A common pattern is keeping Portkey for existing workloads while new or regulated workloads land behind the replacement — Kosmoy customers in particular often arrive running another gateway and migrate incrementally.
Sources
Every factual claim about another vendor on this page traces to that vendor's own published material or a named third-party source below.
- Palo Alto Networks press release — intent to acquire Portkey (April 30, 2026) — accessed July 15, 2026
- Palo Alto Networks press release — Portkey acquisition completed (May 29, 2026) — accessed July 15, 2026
- Portkey pricing — accessed July 15, 2026
- Kosmoy AI Gateway — accessed July 15, 2026
- Kosmoy AI Compliance — accessed July 15, 2026
- Portkey open-source gateway repository — accessed July 15, 2026
- Portkey docs — what is Portkey — accessed July 15, 2026
- Portkey docs — plan & feature comparison (SaaS / hybrid / air-gapped) — accessed July 15, 2026
- Portkey docs — observability — accessed July 15, 2026
- Portkey docs — guardrails — accessed July 15, 2026
- Portkey docs — MCP gateway — accessed July 15, 2026
- LiteLLM GitHub repository (stars, license, activity) — accessed July 15, 2026
- LiteLLM README (100+ providers, MCP/A2A, performance claims) — accessed July 15, 2026
- LiteLLM enterprise docs (features, SLAs, air-gap, pricing by quote) — accessed July 15, 2026
- LiteLLM release notes index (2026 releases) — accessed July 15, 2026
- Rust migration announcement (issue #31263, June 25, 2026) — accessed July 15, 2026
- Guardrail policy templates (incl. offline/air-gapped mode) — accessed July 15, 2026
- MCP deployment docs (registry, exposure controls, air-gap guidance) — accessed July 15, 2026
- litellm-agent-runtime (per-session VM coding-agent runtime) — accessed July 15, 2026
- Kosmoy Platform — accessed July 15, 2026
- Kosmoy Action Capsule — accessed July 15, 2026
- Kong AI Gateway product page — accessed July 15, 2026
- Kong AI Gateway 3.14 release blog (Agent Gateway GA, A2A) — accessed July 15, 2026
- A2A support press release (PR Newswire, April 2026) — accessed July 15, 2026
- MCP Tool ACLs announcement (AI Gateway 3.13, January 2026) — accessed July 15, 2026
- Kong MCP Registry press release (February 2026) — accessed July 15, 2026
- Konnect LLM usage reporting docs — accessed July 15, 2026
- Kong EU AI Act positioning blog — accessed July 15, 2026
- Kong/kong GitHub repository — accessed July 15, 2026
- Kong pricing — accessed July 15, 2026
- TrueFoundry air-gapped deployment docs — accessed July 15, 2026
- TrueFoundry AI Gateway product page — accessed July 15, 2026
- TrueFoundry guardrails overview — accessed July 15, 2026
- Gartner Market Guide for AI Gateways recognition (Businesswire, Feb 20, 2026) — accessed July 15, 2026
- Agent Gateway launch press release (Businesswire, June 2, 2026) — accessed July 15, 2026
- TrueFailover launch (VentureBeat, January 2026) — accessed July 15, 2026
- Seldon AI acquisition (SiliconANGLE, June 25, 2026) — accessed July 15, 2026
- aitori repository (v0.1.0, June 25, 2026, Apache-2.0) — accessed July 15, 2026
- Enterprise MCP access control blog — accessed July 15, 2026
- Bifrost GitHub repository — accessed July 15, 2026
- Bifrost product page — accessed July 15, 2026
- Bifrost pricing — accessed July 15, 2026
- Bifrost enterprise deployment (in-VPC, air-gapped) — accessed July 15, 2026
- Bifrost guardrails docs — accessed July 15, 2026
- Guardrails at the Gateway (Bifrost blog) — accessed July 15, 2026
- Cloudflare AI Gateway docs — accessed July 15, 2026
- AI Gateway pricing — accessed July 15, 2026
- Guardrails feature docs — accessed July 15, 2026
- Changelog — spend limits (June 5, 2026) — accessed July 15, 2026
- Changelog — unified REST API (May 21, 2026) — accessed July 15, 2026
- Data Localization Suite docs (AI Gateway compatibility) — accessed July 15, 2026
- Blog — scaling AI Gateway to billions of logs — accessed July 15, 2026
- Blog — AI Security for Apps GA — accessed July 15, 2026
- Helicone main GitHub repo — accessed July 15, 2026
- Helicone AI Gateway repo (Rust) — accessed July 15, 2026
- Helicone pricing — accessed July 15, 2026
- Helicone — joining Mintlify (March 2026) — accessed July 15, 2026
- Mintlify acquires Helicone (March 2026) — accessed July 15, 2026
- Helicone cloud gateway / passthrough billing launch — accessed July 15, 2026
Need governance, not just a swap?
Kosmoy puts an inventory, a policy gateway and a containment sandbox around every AI your teams run — in your own Kubernetes.
Or email sales@kosmoy.com.