Portkey vs OpenRouter (2026): AI Gateway vs Model Router — and Where Kosmoy Fits

Three shapes on the same ten axes. Portkey (orange) peaks on Gateway & Policy Control (9) and Observability & FinOps (9), with a full self-hosting ladder that earns a 9 on sovereignty. OpenRouter (violet) sits lower on gateway (7) as a hosted router and 5 on observability, and drops to 2 on sovereignty — it is SaaS-only. Both cluster low on the governance axes: inventory, compliance and containment are not what either is for. Kosmoy (blue) trades a little raw gateway breadth for reach across inventory, compliance and agent containment. Read it as area: the two route traffic on one spoke; the suite covers the web.

Depth of the control plane. Portkey ships request-level observability (21+ metrics), a guardrails library with synchronous blocking (HTTP 446) plus a broad partner ecosystem, and a prompt-engineering studio — an observability and guardrails depth OpenRouter does not match (Portkey observability).

Sovereignty. A documented deployment ladder — MIT open-source gateway self-hosted anywhere, hybrid with the data plane in your VPC, and a fully air-gapped enterprise option with FIPS-compliant images — where OpenRouter is SaaS-only with EU in-region routing as its sole residency control.

MCP and agent governance. A GA MCP Gateway with per-user tool provisioning and full tool-call logging, plus an Agent Gateway (April 2026) with skill-level RBAC for A2A agents — governance surfaces OpenRouter does not offer.

Enterprise trust posture. SOC 2, ISO 27001, GDPR and HIPAA certifications with custom BAAs, and enterprise security backing since the Palo Alto Networks acquisition (Prisma AIRS).

Model breadth and pass-through pricing. OpenRouter exposes 400+ models across dozens of providers behind one endpoint with pass-through provider prices and no per-token markup, monetizing a credit fee instead — cost transparency that matters at high volume (OpenRouter FAQ).

Marketplace routing and data-policy controls. Provider order/allow-deny lists, price/throughput/latency sorting, automatic failover across many providers, and strong data-policy routing — per-request `data_collection: deny`, `zdr: true` to require Zero Data Retention endpoints, and EU in-region processing.

Scale, momentum and independence. OpenRouter reported 25 trillion tokens a week at its May 2026 CapitalG-led Series B (~$1.3B valuation) and remains independent and fast-moving, where Portkey's public roadmap has quieted under Palo Alto Networks and its OSS gateway has not released since January 2026.

Zero infrastructure. Instant access to many providers with nothing to operate — the lightest possible adoption for a team that does not want to run a gateway at all.

Both Portkey and OpenRouter answer “how do we route and govern model traffic?” Portkey answers it as a control plane you can own; OpenRouter as a hosted marketplace you consume. Neither answers “what AI are we running across the whole organization, is it compliant, and what happens when an agent misbehaves?” Those are different questions, and in a regulated enterprise they arrive together.

Kosmoy includes the gateway both products are — one OpenAI-compatible policy point with guardrails, RBAC, budgets and logging — but wraps it in the three layers a gateway or router leaves out: a risk-tiered inventory of every model, MCP server and agent (including a master agent registry that pulls from Foundry, Bedrock, Vertex, Salesforce and ServiceNow); EU AI Act, ISO 42001 (aligned) and NIST AI RMF evidence from registry state plus gateway logs; and kernel-enforced Action Capsule containment for agents that act.

So the honest framing is not “Kosmoy beats Portkey and OpenRouter at routing” — Portkey is the deeper gateway and OpenRouter the broader marketplace, and Kosmoy is neither a 400+-model catalog nor a tracing suite. It is that routing is one spoke. If the requirement is the whole web — inventory, gateway, compliance and containment in one self-hosted platform — that is a suite decision, not a routing decision.

For a team whose problem genuinely is model traffic, pick on the axis that matters: OpenRouter for the widest catalog with no infrastructure to run, Portkey for a control plane with depth you can self-host. Both are OpenAI-compatible, so switching later is largely a base-URL and key change.

For an enterprise that has to prove control over all of its AI — not just route it — the choice is not between these two but between a routing layer and a suite. Kosmoy can also sit in front of either: some teams keep OpenRouter for model breadth or Portkey for observability while Kosmoy holds the inventory, compliance evidence and containment for what reaches production.