Open source Self-host only Apache-2.0

Bifrost

Go-based open-source AI gateway focused on low proxy overhead, with an enterprise tier for clustering and SSO.

Built by Maxim AI, founded 2023 · US company

Compare with others Estimate cost Visit site ↗

Access at a glance

Whether this product can work for you at all, before features matter: who pays the model bill, where it can run, and which of your existing API calls keep working. Every value is the vendor’s own claim, linked to the page it came from.

Maxim calls Bifrost "a high-performance AI gateway unifying 20+ providers through a single OpenAI-compatible API", with "automatic failover, load balancing, semantic caching, and enterprise-grade governance" (Bifrost overview), and on GitHub "the fastest enterprise AI gateway (50x faster than LiteLLM)" (maximhq/bifrost, 2026-08-27). It is a self-hosted routing proxy (also embeddable as a Go SDK).

Who pays the model bill

Your keys only

You contract with each model provider directly and hold those accounts. The gateway never resells inference.

Providers are configured with the customer's own keys, e.g. "value": "env.OPENAI_API_KEY", "Add API keys with clicks, not code" (Bifrost setup); the OSS gateway is "Free Forever" and no model credits are sold (Maxim pricing).

Merchant of record: n.a. as an explicit statement; the pages mention "cost control" but do not specify billing, invoicing, credits or payment responsibility (Bifrost setup), and Maxim invoices only Enterprise "Custom Pricing" (Maxim pricing).

Key handling: Keys are held in the customer's own Config Store (SQLite or PostgreSQL) alongside provider configs and MCP settings, typically referenced from environment variables; Bifrost adds "intelligent API key distribution with weighted load balancing, model-specific filtering, and automatic failover" and virtual keys as "the primary governance entity" controlling access, budgets, rate limits and routing per consumer, hierarchically at virtual-key, team and customer levels (Bifrost setup, Bifrost overview). Because deployment is customer-run, request logs stay in the customer's own logs store (Bifrost setup); explicit vendor-visibility statements: n.a.

Where it can run

4 of 5 shapes documented
  • Vendor-hosted
  • Self-host
  • Your VPC
  • On-premise
  • Air-gapped

Dimmed shapes are not documented by the vendor, which is not the same as unsupported.

self-host via NPX binary, Docker, Kubernetes or Go binary (Bifrost setup; Maxim pricing: "SELF-HOSTED: DOCKER | K8S | GO BINARY"); hybrid/VPC, on-prem and air-gapped on the Enterprise tier — "ENTERPRISE READY: VPC | ON-PREM | AIR-GAPPED" (Maxim pricing), with "In-VPC Deployments… Deploy within your private cloud infrastructure with VPC isolation and enhanced security controls" (Bifrost overview). Hosted SaaS: n.a. — the docs mention only "a hosted or production deployment" as customer-run guidance (Bifrost setup).

npx -y @maximhq/bifrost or docker run -p 8080:8080 maximhq/bifrost (versioned tags such as maximhq/bifrost:v1.3.9, amd64/arm64), with a mounted data volume holding config.json, config.db and logs.db; config/log stores can be SQLite or PostgreSQL 16+ (UTF8) (Bifrost setup). Embedded use is go get github.com/maximhq/bifrost/core (maximhq/bifrost, 2026-08-27). Tier gating: OSS self-managed is "Free Forever"; VPC/on-prem/air-gapped, clustering, guardrails and private networking are Enterprise "Custom Pricing" (Maxim pricing; maximhq/bifrost).

API surfaces your code can keep using

5 of 7 documented
  • OpenAI chatPOST /v1/chat/completionsYes

    POST http://localhost:8080/v1/chat/completions, working "with any provider (OpenAI, Anthropic, Bedrock, etc.)", and all Bifrost APIs "follow OpenAI request/response format" (Bifrost setup).

  • Anthropic messagesPOST /v1/messagesYes *

    Yes, via SDK-compatible base-URL replacement: point the Anthropic SDK at http://localhost:8080/anthropic as a "drop-in replacement for the Anthropic Python and TypeScript SDKs" (maximhq/bifrost, 2026-08-27; Bifrost overview).

  • OpenAI ResponsesPOST /v1/responsesNot documented

    n.a. (not documented on the pages fetched).

  • EmbeddingsPOST /v1/embeddingsYes

    Embeddings are documented for providers including Google Gemini, Cohere, Nebius, SGL and vLLM ("chat, embeddings, and STT") (Bifrost overview).

  • ImagesPOST /v1/images/generationsYes *

    Yes at the interface level: "support for text, images, audio, and streaming, all behind a common interface" (maximhq/bifrost, 2026-08-27). Dedicated image endpoint path: n.a.

  • AudioPOST /v1/audio/*Yes *

    Yes, both directions: Hugging Face "TTS, and STT", ElevenLabs "text-to-speech and speech-to-text models", vLLM "chat, embeddings, and STT" (Bifrost overview). Endpoint paths: n.a.

  • Batch jobsPOST /v1/batchesNot documented

    No general batch or asynchronous API is described; only Replicate's "prediction-based architecture with async modes" (Bifrost overview).

An asterisk marks a qualified verdict: support that is indirect (SDK compatibility or provider passthrough rather than a native endpoint), or a gap that is narrower or wider than the label suggests. Read the note before porting.

Drop-in base-URL swap is the primary pattern: "Replace existing AI SDK connections by changing just the base URL" with per-SDK prefixes .../openai, .../anthropic, .../genai, plus native AWS Bedrock SDK integration and LiteLLM/LangChain/PydanticAI compatibility (maximhq/bifrost, 2026-08-27; Bifrost overview). No proprietary SDK is required, though a Go SDK exists for embedded use (maximhq/bifrost). Models can be addressed as openai/gpt-4o-mini or bare gpt-4o-mini resolved through the Model Catalog (Bifrost setup).

How much it reaches

ModelsNot published
Upstream providers20–23vendor pages disagree

Providers: The vendor publishes different totals on different pages; both bounds are shown.

n.a.; no total is stated, only examples (GPT-4o, o1, Claude 4/3.5/3, Gemini, Grok) (Bifrost overview, undated).

Vendor numbers differ: "20+ providers" (Bifrost overview, undated) vs "23+ providers" (maximhq/bifrost, 2026-08-27). The overview page enumerates 22 named providers (OpenAI, Anthropic, AWS Bedrock, Google Vertex AI, Azure OpenAI, Google Gemini, Groq, Mistral, Cohere, Cerebras, DeepSeek, Ollama, Hugging Face, OpenRouter, Perplexity, ElevenLabs, Nebius, xAI, Parasail, Replicate, SGL, vLLM) (Bifrost overview).

Whose models: All third-party or customer-run: Bifrost owns no models and routes to provider APIs plus self-hosted engines such as vLLM ("self-hosted OpenAI-compatible inference") and Ollama ("local inference with OpenAI-compatible format") (Bifrost overview).

Your own endpoints: Yes, indirectly: vLLM and Ollama are first-class providers for self-hosted/local inference (Bifrost overview). Explicit registration of an arbitrary private URL: n.a. (Bifrost overview).

How it behaves in production

What happens when an upstream model is slow, wrong, or down — and what you can see and stop while it happens. Reliability features are recorded as where you configure them, not whether the vendor lists them, because almost every product here lists all of them.

4 of 6 reachable from code4 of 4 can block7 documented destinations

When something goes wrong

Each row says where the knob is, not whether the feature is on the marketing page. A control you can only reach by hand in someone else’s dashboard cannot be reviewed or version-controlled.

  • Request timeoutIn config

    Changing it means editing configuration and shipping it, so behaviour is uniform across traffic until you redeploy.

    A timeout config parameter is documented, but no default value is published: default n.a. (Bifrost overview).

  • RetriesIn config

    A retry config parameter is documented; default retry count and backoff strategy are not published: n.a. (Bifrost overview).

  • Fallback to another modelIn config

    Fallback across providers/models is documented; WEIGHTED selection applies to API keys (weighted key selection, cited at ~10 ns selection cost) rather than to the fallback chain, and the docs do not state a weighted fallback split (maximhq/bifrost).

  • Load balancingIn config

    config_file, with weights on API keys (weighted key selection) (maximhq/bifrost).

  • Upstream health trackingNot documented

    The vendor does not document this, so any behaviour you observe today is unversioned and may change.

    not_documented as an upstream provider health check or circuit breaker. What is documented is Cluster Mode: peer-to-peer HA failover between Bifrost nodes — i.e. gateway-level HA, not provider ejection (maximhq/bifrost).

  • Cross-region failoverNot documented

    Cluster Mode covers node failover; no cross-region provider failover configuration is documented (maximhq/bifrost).

Fallback chain: Weighted split — Traffic splits by percentage across targets, so you can shift 5% to a new model and watch it before committing.

Bifrost is the only product in this set that publishes hardware, VU count, duration, payload size and mock-provider baseline, which makes its own numbers auditable even where its competitor numbers are not (Bifrost benchmarks).

How fast the hop is

Compiled binary

A single compiled Go or Rust binary. The lowest overhead floor of the self-hostable options, and the easiest to reason about under load.

Go, using goroutines and fasthttp, distributed as an ~80MB binary (maximhq/bifrost).

You can run the request path yourselfYes
StreamingYes

Docker image maximhq/bifrost, npx -y @maximhq/bifrost, a helm-charts folder, and a Go SDK via go get github.com/maximhq/bifrost/core (maximhq/bifrost).

Streaming caveats: Supported: the docs state support for "text, images, audio, and streaming"; no streaming caveat is stated on the fetched pages (Bifrost overview).

Published figures, grouped by what each one measured. Figures in different groups are different quantities and cannot be compared with one another — nor, in most cases, with another vendor’s figure in the same group.

Overhead added by the gateway

The only figures that speak to whether this product slows your application down. Still not comparable between vendors: each was measured on different hardware, at a different load, with a different payload.

  • 0.99 msmedian addedVendor-published

    Derived: median end-to-end 60.99ms against a mock OpenAI holding a fixed 60ms latency.

    Source

Sustained capacity

Requests or queries per second sustained on the stated hardware.

  • 424 req/ssustainedVendor-published

    500 RPS comparison test on t3.medium against real OpenAI. A separate 5,000 RPS stress run is Bifrost-only against a mocked provider with ~10KB payloads.

    Source

Full round trip, including the model

Dominated by the upstream model, not the gateway. Useful as a sanity check, useless for comparing routing layers.

  • 804 msp50Vendor-published

    500 RPS, AWS EC2 t3.medium (2 vCPU / 4 GB), us-east-1, 60s, 500 virtual users, real OpenAI Tier 5.

    Source
  • 1680 msp99Vendor-published

    Same 500 RPS t3.medium run; max observed 6.13s.

    Source

Vendor-published, and explicitly flagged: the same benchmark post publishes figures about a COMPETITOR, LiteLLM — LiteLLM P50 38.65 s, P99 90.72 s, max 92.67 s, median end-to-end 100 ms against the 60 ms mock (≈40 ms overhead), 44.84 req/s (Bifrost benchmarks). Those rival numbers are not verifiable from LiteLLM's own docs and should not be used; LiteLLM's own published figure is 8ms P95 latency at 1k RPS (BerriAI/litellm). No independent third-party benchmark was found.

What it will stop

4 of 4 can block

Two separate questions per control: can it stop a request at all, and what does it do before you change any settings? A control that inspects and forwards is a logging feature, however it is named.

  • Personal data in promptsCan block the request

    Out of the box: You pick the action when configuring

    Providers include in-process regex (RE2 patterns with entity_type), Gitleaks-based secrets detection, Microsoft Presidio, and Azure AI Language PII. Each supports action: detect_only | block | redact, redaction_strategy: replace | mask | hash, and redaction_mode: runtime | logs_only | runtime_reversible. Azure PII defaults to detect_only (Guardrails config, Enterprise guardrails)

  • Prompt injection and jailbreaksCan block the request

    Out of the box: You pick the action when configuring

    Azure Content Safety jailbreak shield, Model Armor, CrowdStrike AIDR, Gray Swan, Patronus, Lakera, Repello Argus are configurable as guardrail providers (Enterprise guardrails)

  • Harmful contentCan block the request

    Out of the box: You pick the action when configuring

    Bedrock Guardrails and Azure Content Safety are supported providers for harmful-content categories (Enterprise guardrails)

  • Your own policiesCan block the request

    Out of the box: You pick the action when configuring

    Custom policy form is RE2 regex patterns with per-pattern flags, entity types, and actions, plus ignored_secret_keywords suppression lists on the secrets provider (Guardrails config)

Where checks runEither, your choice
If the guardrail itself failsNot documented

Almost no vendor in this catalogue documents what happens when the guardrail service itself times out. If the control matters to you, this is a question worth asking before you sign.

not_documented — the fetched guardrail pages document action outcomes but no explicit timeout/fail-open or fail-closed rule (Guardrails config)

Calls out to: Microsoft Presidio, Azure AI Language, AWS Bedrock Guardrails, Google Model Armor, Gitleaks. Each is a separate vendor relationship and a separate hop on the request path.

Bifrost has the most nuanced redaction model here: logs_only redacts what is stored while the model still sees the original, runtime redacts what the model sees, and runtime_reversible stores a reveal mapping that stays on the Bifrost log row and is never exported (Guardrails config, Log exports).

What you can see

Exports widely
What gets loggedYour choice

You decide whether bodies are captured, by setting or by header.

You can turn bodies offYes

client.disable_content_logging: true reduces log rows to metadata only; per-request override header x-bf-disable-content-logging works only when client.allow_per_request_content_storage_override is enabled; each observability connector has its own independent disable_content_logging defaulting to false; metrics never carry content (Content logging)

TracesOpenTelemetry

OpenTelemetry natively, with disable_root_span_content and disable_content_logging controls over span content (Bifrost OTel)

Bifrost records metadata plus content: "actual prompts, completions, and tool traffic", including chat history, tool definitions and arguments, reasoning traces, embedding inputs, and verbatim provider bodies when x-bf-store-raw-request-response is used (Content logging)

Where telemetry can go

  • OpenTelemetry
  • Prometheus
  • Datadog
  • Langfuse
  • Maxim
  • S3
  • Webhook

OTel to Grafana Cloud, Datadog, New Relic, Honeycomb, Langfuse, and self-hosted collectors (Bifrost OTel); log payload offload to Amazon S3 and Google Cloud Storage only — "Azure Blob, local filesystem, and data warehouse destinations are not implemented" — with the logs DB on SQLite, Postgres, or ClickHouse and a BigQuery connector gated by disable_content_logging (Log exports, Content logging)

Records user feedbackNo
Scores live trafficNo

n.a. — no feedback endpoint documented on the fetched pages (Bifrost OTel)

n.a. from the fetched Bifrost pages (Enterprise guardrails)

Depends on the vendor’s SaaS: No — logs live in the customer's own SQLite/Postgres/ClickHouse and object storage, and telemetry exports to the customer's collectors (Log exports, Bifrost OTel)

Retention: client_config.log_retention_days, default 365 days, minimum 1 day, 0 disables cleanup (Log exports)

Whether it fits how you work

How much work stands between you and a first call, how different that is from running it in production, and whether it slots into the stack you already have. Recorded as the shape of the work rather than a number of minutes — how long it takes you depends on which accounts and quota you already hold, which no comparison can know.

to try: cli or containerto run: infrastructure rolloutfits 4 of 10 common stacks

Getting to a first call

4 numbered steps
Shape of the workRun something locally first

Nothing works until you have a process running. Fine on a laptop, but it means there is no zero-install way to try it.

Read off: the vendor’s own quickstart — 4 numbered steps.

Before step one

  • Your own provider keyOptional

    You can start on the product’s own credits and move to your own provider keys later.

    Not explicitly stated; the displayed first-call snippets contain no provider key, but provider setup "supports adding API keys through the UI" and the last Helm step is "Configure Providers & Plugins" (Setting Up - Bifrost, Quick Start - Bifrost Helm)

  • Payment methodNot documented

    n.a. (not documented) on either page (Setting Up - Bifrost, Quick Start - Bifrost Helm)

  • Gate before models answerNot documented

    The docs do not say, so budget for a surprise on the first model you actually want.

    n.a. (not documented). No approval, enablement, quota or waitlist wording (Setting Up - Bifrost, Quick Start - Bifrost Helm)

Everything you need first: None stated: no account, credit card, cloud account, cluster, or provider API key is listed as a prerequisite; provider keys are added later through the Web UI or API (Setting Up - Bifrost)

The vendor’s own time claim: Vendor claim, verbatim: "Get Bifrost running as an HTTP API gateway in 30 seconds with zero configuration." (Setting Up - Bifrost) Quoted, not verified. Marketing time claims assume every account and approval is already in place.

Running it in production

The same scale applied to the path the vendor recommends for production traffic. Kept separate from the quickstart because for several products here the two are barely related pieces of work.

Shape of the workDeploy it on your infrastructure

This is an infrastructure project, not an integration. Expect charts or Terraform, networking, secrets and someone who owns the deployment.

Getting to production is a step up in kind from the quickstart, not just more of the same.

What production needs: Kubernetes v1.19+, configured kubectl, Helm 3.2.0+, a Persistent Volume provisioner (required for SQLite, optional for Postgres-only), UTF8-encoded PostgreSQL storage, a required image.tag, and private registry credentials for Enterprise. The quickstart also says production should "Pin an image version, enable authentication and TLS, and choose durable storage" (Quick Start - Bifrost Helm, Setting Up - Bifrost)

Can you run it yourself

Install command publishedInstall command published

There is a command you can copy and run, so you can evaluate the self-hosted path yourself today.

npx -y @maximhq/bifrost; docker pull maximhq/bifrost + docker run -p 8080:8080 maximhq/bifrost; Helm: helm repo add bifrost https://maximhq.github.io/bifrost/helm-charts, helm repo update, kubectl create secret generic bifrost-encryption-key --from-literal=encryption-key="$(openssl rand -base64 32)", helm install bifrost bifrost/bifrost --set image.tag=v1.4.11 ..., production helm install bifrost bifrost/bifrost -f production.yaml (Setting Up - Bifrost, Quick Start - Bifrost Helm)

How it fits your stack

4 of 10

Each row is a thing you might already run. “With a caveat” means it works but not the way the vendor’s marketing implies — read the reason, because that is usually where the surprise lives.

  • FitsThe OpenAI SDKDrop-in once set up — but first-call work is cli or container.
  • With a caveatThe Vercel AI SDKClaimed compatible, no package named
  • NoCloudflare WorkersNo Workers guidance published.
  • FitsKubernetesbifrost/bifrost from https://maximhq.github.io/bifrost/helm-charts
  • With a caveatTerraform or OpenTofuOfficial modules
  • NoAn existing API gatewayNothing published about running behind your gateway.
  • FitsCloud IAM I already runReuses IAM roles, workload identity or managed identities.
  • With a caveatLangChain or LlamaIndexLangChain only.
  • FitsMCP servers to governActs as an MCP gateway or registry.
  • With a caveatNothing — plain Node or PythonYou have to run a process locally before any call works.

Reading this the other way round — pick what you already run and see every product scored against it.

The integration surfaces behind those answers

  • Vercel AI SDKClaimed compatible, no package named

    The vendor says it is compatible and names no package, so you are on the OpenAI-compatible path until proven otherwise.

    Bifrost is stated to be compatible with the Vercel AI SDK. No official provider package name is documented. (Maxim AI homepage)

  • Cloudflare WorkersNot documented

    No Workers guidance either way. If you are edge-first, verify fetch-only compatibility yourself.

    n.a. (not documented)

  • KubernetesOfficial Helm chart

    A named, published chart. You can read its values file before committing to anything.

    Named: bifrost/bifrost from https://maximhq.github.io/bifrost/helm-charts

    Bifrost documents the official Helm chart bifrost/bifrost from the repository https://maximhq.github.io/bifrost/helm-charts. (Bifrost Helm deployment guide)

  • TerraformOfficial modules

    Vendor-published modules exist. Some are off-Registry Git references, so pin them explicitly.

    Named: github.com/maximhq/bifrost//terraform/modules/bifrost?ref=terraform/v0.1.0; not on the Registry

    A Terraform module source is documented as github.com/maximhq/bifrost//terraform/modules/bifrost?ref=terraform/v0.1.0. A Terraform Registry provider or module name is not documented. (Bifrost enterprise deployment)

  • Existing API gatewayNot documented

    Nothing published about sitting behind an existing gateway. Treat it as a separate hop you route to yourself.

    n.a. (not documented)

  • Cloud identityReuses your cloud identity

    Authenticate with the identity you already run — IAM roles, workload identity or managed identities. No long-lived key to rotate.

    Bifrost documents cloud-native authentication through AWS IRSA, GCP Workload Identity, and Azure Azure WIF, and describes this as native IAM integration. Specific AWS SigV4, Azure managed-identity, and GCP service-account authentication are not documented. (Bifrost enterprise deployment)

  • MCPMCP gateway or registry

    It sits in front of many MCP servers and governs access to them. This is the shape you want if MCP sprawl is the problem you are solving.

    Bifrost acts as both an MCP client and MCP server, connecting to external MCP servers over STDIO, HTTP, and SSE, auto-discovering tools, and exposing them through a single gateway URL. It supports tool filtering, virtual MCP servers, MCP Tool Groups, explicit tool execution, and Tool Hosting. (Bifrost MCP gateway)

Python frameworks
  • LangChain

LangChain integration is documented, including langchain_openai.ChatOpenAI, langchain_anthropic.ChatAnthropic, and langchain_google_genai.ChatGoogleGenerativeAI. LlamaIndex is not documented. (Bifrost LangChain integration)

First-party client libraries
  • Go

An official Go SDK is documented with go get github.com/maximhq/bifrost/core. Documented integrations also include the OpenAI, Anthropic, AWS Bedrock, Google GenAI, LiteLLM, and LangChain SDKs; the evidence does not provide a complete list of official Bifrost client-library languages. (Bifrost GitHub repository)

Agent features: Bifrost returns LLM tool calls as suggestions requiring a separate execution API call, while Agent Mode supports autonomous multi-step tool execution with configurable auto-approval. Code Mode lets the model use Python to orchestrate multiple tools in a sandbox. (Bifrost MCP gateway)

Unversioned npx/docker commands are explicitly "for local evaluation," so the evaluate and production paths diverge deliberately; configuration is via Web UI or API; verification commands include kubectl port-forward svc/bifrost 8080:8080, curl http://localhost:8080/health and /metrics (Setting Up - Bifrost, Quick Start - Bifrost Helm)

Bifrost is open source and supports self-hosted deployment in private VPCs, on-premises or bare-metal environments, air-gapped environments, and single-node or edge deployments. Documented deployment options include AWS, GCP, Azure, generic Kubernetes, Docker Compose, and a single Go binary; air-gapped operation is described as fully offline with no phone-home or telemetry. (Bifrost enterprise deployment)

Silence in the docs: 4 of the integration questions on this card have no published answer either way. That is recorded as undocumented, not as a no — but it does mean you would be verifying it yourself.

What it does well

  • Go implementation with the lowest vendor-claimed proxy overhead in this set
  • Generous OSS tier: semantic caching, MCP gateway, budgets, virtual keys and prompt repository at no cost
  • Apache-2.0 license with VPC, on-prem and air-gapped deployment paths
  • Ships with OpenTelemetry-native observability tied into Maxim's evaluation platform

Where it falls short

  • Headline latency and throughput figures are all vendor-run against mock upstreams; no independent benchmark found
  • Much smaller community than LiteLLM, Kong or APISIX (7.6k vs 16.8k-57.5k stars)
  • Guardrails, cluster mode, adaptive load balancing, SSO, RBAC and audit logs are enterprise-only with unpublished pricing
  • Provider and model counts are inconsistent across the vendor's own pages

Choose it when

Teams that want a fast Go gateway they can self-host for free and later buy clustering, SSO and guardrails from a single vendor.

Look elsewhere when

You need certified compliance artifacts, published enterprise pricing, or a large third-party operator community to lean on.

Open source: You run the gateway yourself. Full control over the data path and no per-request vendor fee, in exchange for operating it.

How hard is it to leave?

Derived from six published facts, not from an opinion. The weights are fixed and the same for every product — see the arithmetic.

100/100Easy to leave
Portability score breakdown for Bifrost
What helps you leave Points Source
Works with standard OpenAI codeSwitching away is a base-URL change rather than a rewrite of every call site.22/22 vendor page
No vendor-specific SDK requiredA proprietary client library spreads through your codebase and has to be torn out again.10/10 vendor page
Can use your own provider accountsYour keys and billing relationship stay yours, so removing the gateway does not cut off model access.20/20 vendor page
Can be self-hostedYou can run it yourself instead of accepting a pricing or policy change.20/20—
Configuration lives in version controlRouting and budget rules are a file you keep, not dashboard state you would have to rebuild.16/16 vendor page
Your request history can be exportedYou leave with your own logs instead of abandoning them.12/12 vendor page

All six inputs are published, so this is scored against the full 100. This measures technical switching cost only. It does not price the engineering time to re-test prompts against a different routing stack.

Full specification

Every field we track. Blank fields say "Not published" rather than "No" — we do not infer an absence from silence. Switch to Technical in the header for the precise field names and the low-level details.

Overview

What kind of product Category
Open source Not verified
Marketplaces resell many providers behind one key. Gateways add governance on top. Open-source projects you run yourself. Cloud platforms are hyperscaler surfaces. Inference providers host models on their own hardware.
Who runs it Deployment model
Self-host only Not verified
Managed means the vendor operates it. Self-host means you run it on your own infrastructure. Both means you can choose.
Licence Licence
Apache-2.0 Verified 2 days ago
Proprietary products cannot be inspected or forked. Open licences such as MIT and Apache-2.0 let you audit, modify, and run the code without permission.
Company Company
Maxim AI Verified 2 days ago
The organisation that maintains the product.
Who you would be signing with Vendor status
Independent company Not verified
Whether the product is still an independent company, has been acquired, is a large cloud vendor’s product line, is run by a software foundation, or has been put into maintenance mode. Maintenance mode means bug fixes and security patches only — no new features.
Last shipped an update Latest release
2026-08-27 Not verified
The date of the most recent release or version tag. A product that has not shipped in a year is a different risk from one that shipped last week, regardless of what its marketing site says.
GitHub stars GitHub stars
7,600 Verified 2 days ago
A rough proxy for community size on open-source projects. Not a quality measure.

Cost

Markup on model prices Token markup
None Verified 2 days ago
How much the product adds on top of what the underlying model provider charges. Zero means you pay the same per-token price you would pay the model provider directly.
Fee to add funds Credit purchase fee
None Verified 2 days ago
A percentage charged when you top up your balance, separate from token prices. It is easy to miss because it does not appear on the per-token price list.
Monthly cost per person Seat fee
None Verified 2 days ago
A recurring per-user platform charge that applies regardless of how much you use the models.
Can use your own provider accounts BYOK supported
Yes Verified 2 days ago
Bring Your Own Key: you keep direct contracts with OpenAI, Anthropic and others, and the gateway only routes traffic. This preserves negotiated rates and committed-spend discounts.
Cost of using your own accounts BYOK terms
Self-hosted with your own provider keys and vault integration; no gateway token fee. Not verified
What the product charges to route traffic through your own provider keys.
Free tier Free tier
OSS tier is "Free Forever": drop-in gateway, OpenTelemetry observability, budgets, rate limits, virtual keys, custom routing, fallbacks, simple and semantic caching, MCP gateway, prompt repository. Verified 2 days ago
What you can do without paying, useful for evaluation.
Enterprise plan from Enterprise plan from
Not published Not verified
Annual entry price for the enterprise tier, where one is published or credibly reported.
Cost to run it yourself Self-host cost
OSS is free (Apache-2.0); infra cost only. Enterprise adds guardrails, cluster mode, adaptive load balancing, SAML/OIDC SSO, vault integration, log exports, audit logs, RBAC and SLAs at custom pricing after a 14-day trial; VPC, on-prem and air-gapped installs are enterprise options. Verified 2 days ago
What self-hosting actually costs once you account for infrastructure and any paid tier.
How the vendor makes money Pricing model
Open source with a managed tier Not verified
The shape of the vendor’s bill: does the routing layer charge a percentage on top of tokens, a flat monthly fee, both, neither (because inference is the product), or nothing at all (open source with no paid tier).
How pricing works, briefly Pricing model detail
OSS 'Free Forever' (Docker/K8s/Go binary) for developers, small teams and self-managed deployments. Enterprise is 'Custom Pricing' for VPC/on-prem/air-gapped, quote-only. Not verified
A one-paragraph description that covers the caveats a pricing category cannot: introductory rates, per-feature meters, tier gating, and pricing that resets on a specific date.
Minimum commitment Minimum commitment
None for OSS. Enterprise not stated. Not verified
Whether the vendor requires a minimum contract term, a minimum spend, or a provisioned-capacity purchase to get its published rate.
Charges that fire after you go over an allowance Overage terms
None stated. Self-hosting infrastructure cost is yours. Not verified
The line items that scale with usage after an included allowance is exhausted — log storage, extra requests, per-feature meters, data export — which is where cost estimates usually go wrong.
Prompt cache offered Cache mechanism
Both exact and semantic Not verified
Whether the gateway offers its own response cache, what kind of match it does (exact request, prefix, semantic), or simply passes provider caching through unchanged.
Discount on cached input Cache-read discount
Not published Not verified
How much cheaper cached tokens are than fresh input, when the vendor publishes a single figure. Bundled-inference clouds usually price this per model instead of as one number.
Premium on cache writes Cache-write premium
Not published Not verified
How much more the first write of a cached prefix costs versus a plain input token. A high write premium and a low hit rate can leave you paying more than you save, so this matters as much as the read discount.
Who captures the cache saving Cache economics
Simple (exact) and semantic caching both in OSS. Semantic caching 'reduces costs and latency for similar queries with semantic similarity caching'. Bifrost prices no tokens, so caching saving is fully the customer's. MCP Code Mode claims to cut tokens by 50%+ separately. Not verified
Whether the customer keeps the full saving from caching or the vendor captures part of it — and any conditions attached (write premium, storage fees, best-effort hits).
What you can split spend by Cost attribution
Per virtual key, consumer, team and customer. Per-user and per-tag not stated. Not verified
The dimensions the vendor documents for splitting spend — per key, per user, per team, per tag, per customer. Matters if you need to chargeback internally or bill an end customer.
How you get cost data out Cost export
OTel-compatible metrics and traces (any OTel backend can receive data). CSV, cost API, webhook-of-spend, S3 and warehouse export not stated. Not verified
The mechanisms the vendor publishes for exporting cost and usage data: CSV, an API, webhooks, S3, a data warehouse, or nothing at all. Any per-unit price is included.
Who pays the model bill BYOK mode
Your keys only Not verified
Whether you bring your own provider accounts (BYOK), buy inference from this vendor, or can do either. This is the single biggest commercial difference between these products: it decides who holds the contract with the model provider and who carries the spend.

Spend governance in detail

Seven signals matter when a bill starts to hurt: who can spend, how much, on what, and who gets paged when it goes wrong. Everything below is drawn from the vendor’s own pricing and docs pages — how we read these.

  • Virtual or scoped keysYes — oss

    Keys that carry their own budget and rate-limit policy, so an intern experiment cannot spend against a production budget.

    Supported, free — 'control access permissions, budgets, rate limits, and routing per consumer'.

  • Budget caps per keyYes — oss

    A dollar or token ceiling attached to an individual key. Where enforcement is soft, one over-limit request still completes before the block kicks in.

    Enforced through virtual keys.

  • Budget caps per team or workspaceYes — oss

    A ceiling applied at a higher scope than one key — a team, a workspace, a customer, or an entire environment.

    Hierarchical cost control across virtual keys, teams and customers.

  • Rate limiting as a cost controlYes — oss

    Configurable request-per-time-window caps. Platform-set rate limits do not count as spend controls; user-configurable ones do.

    Supported, free.

  • Model allowlistsNot published

    A policy that constrains which models a key or team can call, keeping expensive frontier models out of the wrong hands.

    Not stated for models. MCP tool allow-lists are: 'strict allow-lists for which MCP tools are available per virtual key'.

  • Spend alertsYes — enterprise

    Alerts fired as spend approaches a threshold. Alerts that only fire after the meter has rolled over are marked as such.

    'Real-time notifications for budget limits, failures and performance issues' via email/Slack/PagerDuty/Teams/Webhook is Enterprise.

  • Webhook notificationsYes — enterprise

    Programmatic notifications on spend events, so budget breaches can page an on-call or open a ticket.

    Webhook notification channel is Enterprise.

Enforcement:Enforced before each request

Catalog

Models available Models available
Not published Verified 2 days ago
How many models you can call, shown as a range because several vendors publish different totals on different pages. Vendor-reported either way, so counts are not directly comparable — some count every provider variant of the same model separately.
Model providers reachable Upstream providers
20–23 Verified 2 days ago
How many distinct model providers or labs you can reach, shown as a range where the vendor’s own pages disagree. More providers usually means better redundancy when one has an outage.
Works with standard OpenAI code OpenAI-compatible API
Yes Verified 2 days ago
If yes, you can usually switch to it by changing one base URL, and switch away just as easily. This is the main defence against lock-in.
OpenAI chat endpoint POST /v1/chat/completions
Yes Not verified
The endpoint almost every application ports first. "Not documented" means the vendor never states it, which is different from a documented no.
Anthropic messages endpoint POST /v1/messages
Yes Not verified
Whether Anthropic-shaped calls work without rewriting them. Several products support this only as SDK compatibility or provider passthrough rather than a native endpoint — the detail page says which.
OpenAI Responses endpoint POST /v1/responses
Not documented Not verified
The newer stateful OpenAI surface. Support is much thinner across this market than chat completions.
Embeddings endpoint POST /v1/embeddings
Yes Not verified
Whether you can generate vectors through the same gateway, or need a second integration for retrieval workloads.
Image generation endpoint POST /v1/images/generations
Yes Not verified
Whether image models are reachable through the same surface as text.
Audio endpoints POST /v1/audio/*
Yes Not verified
Speech-to-text and text-to-speech. Frequently the first gap in an otherwise complete gateway.
Batch jobs endpoint POST /v1/batches
Not documented Not verified
Asynchronous bulk processing, usually at a discount. Commonly undocumented, and commonly the reason a migration stalls late.
Needs the vendor’s own code library Requires a vendor-specific SDK
No Verified 2 days ago
A proprietary client library spreads through your codebase and has to be torn out again if you leave. “No” is the better answer here, and it means the standard OpenAI client works.
You can export your request history Logs / usage data export
Yes Verified 2 days ago
Whether you can get your own request logs, traces, or usage records back out — through an API, a bulk export, or a download. Decides whether you leave with your history or abandon it.
Settings can live in version control Declarative config-as-code
Yes Verified 2 days ago
Whether routing, fallback, and budget rules can be declared in a file you keep in Git, rather than existing only as settings clicked into a hosted dashboard.
Embeddings Embeddings
Yes Verified 2 days ago
Text-to-vector models, needed for search and retrieval features.
Image generation Image generation
Yes Verified 2 days ago
Whether image models are reachable through the same interface.
Speech and audio Speech and audio
Yes Verified 2 days ago
Text-to-speech or transcription models through the same interface.
Video generation Video generation
Not published Not verified
Whether video models are reachable through the same interface.
Batch processing Batch processing
Not published Not verified
Submitting large jobs for cheaper, slower processing. Often 50% off for work that is not time-sensitive.

Routing & reliability

Uptime it promises in writing Contractual SLA uptime
99.999% Not verified
The uptime percentage in a published, contractual service level agreement. A public status page is not an SLA — it reports what happened, it does not promise anything or pay you back when it breaks.
Automatic failover Automatic failover
Yes Verified 2 days ago
When a model provider goes down or rate-limits you, traffic moves to a backup automatically instead of returning errors to your users.
Load balancing Load balancing
Yes Verified 2 days ago
Spreads requests across several providers or keys to raise your effective rate limit.
Rule-based routing Conditional routing
Yes Verified 2 days ago
Send different requests to different models based on rules — for example a cheap model for free users and a strong model for paying ones.
Response caching Response caching
Yes Verified 2 days ago
Reuses the answer when the exact same request comes in again, which cuts both cost and latency.
Similar-question caching Semantic cache
Yes Verified 2 days ago
Reuses an answer when a new question means roughly the same thing as an earlier one. Saves far more than exact-match caching but can return subtly wrong answers if tuned loosely.
Where you set the timeout Request timeout surface
In config Not verified

A `timeout` config parameter is documented, but no default value is published: default `n.a.` ([Bifrost overview](https://docs.getbifrost.ai/overview)).

Where a request timeout can be set: per request, in a config file, in the vendor dashboard, or nowhere. Nine of the twenty products documented here do not describe a request timeout at all, so the worst case of a hung upstream call is unknowable from the docs.
Where you set retries Retry policy surface
In config Not verified

A `retry` config parameter is documented; default retry count and backoff strategy are not published: `n.a.` ([Bifrost overview](https://docs.getbifrost.ai/overview)).

Where retry count and backoff are configured. Worth knowing alongside billing: a retried streaming call can be charged more than once.
Where you set fallbacks Fallback surface
In config Not verified

Fallback across providers/models is documented; WEIGHTED selection applies to API keys (weighted key selection, cited at ~10 ns selection cost) rather than to the fallback chain, and the docs do not state a weighted fallback split ([maximhq/bifrost](https://github.com/maximhq/bifrost)).

Where the fallback chain is defined. Almost every product claims fallback; the useful question is whether you can change it from code or only by hand in a dashboard.
Shape of the fallback chain Fallback shape
Weighted split Not verified
An ordered list tries targets in sequence; a weighted split sends a percentage of traffic to each, which is what you need to trial a new model on 5% of requests. Weighted splits are much rarer than the marketing implies.
Upstream health tracking Health checks / circuit breaking
Not documented Not verified

`not_documented` as an upstream provider health check or circuit breaker. What is documented is Cluster Mode: peer-to-peer HA failover between Bifrost nodes — i.e. gateway-level HA, not provider ejection ([maximhq/bifrost](https://github.com/maximhq/bifrost)).

Whether the product notices a failing upstream and stops sending traffic to it, and whether you can tune the thresholds. This is what turns a provider outage into a blip rather than a sustained error rate, and only four of the twenty expose it.
Cross-region failover you control Multi-region failover surface
Not documented Not verified

Cluster Mode covers node failover; no cross-region provider failover configuration is documented ([maximhq/bifrost](https://github.com/maximhq/bifrost)).

Whether you can define what happens when a region degrades. A vendor running many regions is not the same as a vendor letting you configure failover between them; only three document a user-controlled mechanism.
Where you set load balancing Load balancing surface
In config Not verified

`config_file`, with weights on API keys (weighted key selection) ([maximhq/bifrost](https://github.com/maximhq/bifrost)).

Where traffic distribution across upstreams or keys is configured.

Operations

Usage dashboards and logs Observability
Yes Verified 2 days ago
Built-in visibility into what was sent, what came back, what it cost, and how long it took.
Spending limits Budget controls
Yes Verified 2 days ago
Hard caps that stop spend before it becomes a surprise invoice. The single most valuable control for a small team.
Rate limits Rate limits
Yes Verified 2 days ago
Caps on request volume per key or per user, useful for protecting against abuse and runaway loops.
Separate keys per team or app Virtual keys
Yes Verified 2 days ago
Issue scoped keys with their own budgets and permissions so you can attribute cost and revoke access without rotating everything.
Prompt versioning Prompt management
Yes Verified 2 days ago
Store and version prompts outside your code so they can be changed without a deploy.
Quality testing Evals
Not published Not verified
Built-in tooling to score model output against test cases, so you can tell whether a model swap made things better or worse.
MCP support MCP support
Yes Verified 2 days ago
Native support for the Model Context Protocol, the emerging standard for connecting models to external tools.
What gets logged Logged content
Your choice Not verified

Bifrost records metadata plus content: "actual prompts, completions, and tool traffic", including chat history, tool definitions and arguments, reasoning traces, embedding inputs, and verbatim provider bodies when `x-bf-store-raw-request-response` is used ([Content logging](https://docs.getbifrost.ai/features/observability/content-logging))

Whether full prompts and responses are stored, only metadata, or nothing. Full-body logging is the most useful debugging feature here and the one most likely to need a conversation with your compliance team.
You can turn logging off Body-logging opt-out
Yes Not verified

`client.disable_content_logging: true` reduces log rows to metadata only; per-request override header `x-bf-disable-content-logging` works only when `client.allow_per_request_content_storage_override` is enabled; each observability connector has its own independent `disable_content_logging` defaulting to `false`; metrics never carry content ([Content logging](https://docs.getbifrost.ai/features/observability/content-logging))

Whether prompt and response bodies can be suppressed while still keeping usage metrics. Nineteen of the twenty document a way to do this; the mechanisms range from a per-request header to an organisation-wide setting.
Traces you can take elsewhere Distributed tracing
OpenTelemetry Not verified

OpenTelemetry natively, with `disable_root_span_content` and `disable_content_logging` controls over span content ([Bifrost OTel](https://docs.getbifrost.ai/features/observability/otel))

Whether the product emits OpenTelemetry, a proprietary format, or nothing. OpenTelemetry means the traces land in the tooling you already run instead of only in the vendor’s dashboard.
Where telemetry can go Export destinations
OpenTelemetry, Prometheus, Datadog, Langfuse, Maxim, S3, Webhook Not verified

OTel to Grafana Cloud, Datadog, New Relic, Honeycomb, Langfuse, and self-hosted collectors ([Bifrost OTel](https://docs.getbifrost.ai/features/observability/otel)); log payload offload to Amazon S3 and Google Cloud Storage only — "Azure Blob, local filesystem, and data warehouse destinations are not implemented" — with the logs DB on SQLite, Postgres, or ClickHouse and a BigQuery connector gated by `disable_content_logging` ([Log exports](https://docs.getbifrost.ai/enterprise/log-exports), [Content logging](https://docs.getbifrost.ai/features/observability/content-logging))

Documented sinks for logs and metrics. This is a good proxy for how replaceable the vendor’s own dashboard is: around twenty destinations means you never have to depend on it, while a CSV download means you do.
Can record user feedback Feedback capture API
No Not verified

`n.a.` — no feedback endpoint documented on the fetched pages ([Bifrost OTel](https://docs.getbifrost.ai/features/observability/otel))

Whether there is an API to attach a rating or score to a logged request, which is what lets production traffic feed quality work later.
Scores live traffic Online eval hooks
No Not verified

`n.a.` from the fetched Bifrost pages ([Enterprise guardrails](https://docs.getbifrost.ai/enterprise/guardrails))

Whether automated scorers can run against real production requests, rather than only against a test set you assemble yourself.

Performance

Delay it adds Proxy overhead
0.99 ms Verified 2 days ago
Extra time the product itself adds to each request, on top of however long the model takes. Usually irrelevant next to multi-second model latency, but it matters for high-volume or streaming-sensitive workloads.
Requests per second ceiling Throughput
5,000 rps Verified 2 days ago
Published sustained request rate before the product becomes the bottleneck. Only relevant at genuinely high volume.
What the request path runs on Architecture class
Compiled binary Not verified

Go, using goroutines and `fasthttp`, distributed as an ~80MB binary ([maximhq/bifrost](https://github.com/maximhq/bifrost)).

The comparable way to talk about latency here. An edge worker, a compiled Go or Rust binary, and a Python proxy have different overhead floors no matter which figures each vendor publishes. Products that never disclose their runtime are recorded as undisclosed rather than assumed.
You can run the request path yourself Self-hostable data plane
Yes Not verified

Docker image `maximhq/bifrost`, `npx -y @maximhq/bifrost`, a `helm-charts` folder, and a Go SDK via `go get github.com/maximhq/bifrost/core` ([maximhq/bifrost](https://github.com/maximhq/bifrost)).

Whether the component that actually carries your prompts can run on your own infrastructure. Distinct from a vendor offering a self-hosted control plane while still proxying traffic through their network.
Streaming responses Streaming support
Yes Not verified

Supported: the docs state support for "text, images, audio, and streaming"; no streaming caveat is stated on the fetched pages ([Bifrost overview](https://docs.getbifrost.ai/overview)).

Whether token-by-token streaming is documented. The caveats matter more than the yes: some products cannot cancel a stream without still being billed, and several timeout and fallback mechanisms stop applying once the first token has been sent.

Security & compliance

Does your prompt reach their servers Prompt transits vendor
Depends how you deploy it Not verified

A binary, Docker image or embedded Go library you run. Maxim also offers a private deployment where both data and control planes sit in your VPC, or a VPC-peered hybrid.

Whether the text you send passes through this company’s own infrastructure. If it does, every other promise on this page is a policy commitment rather than a physical impossibility. Self-hosted products can answer no outright.
What they keep if you change nothing Logging default
Yes — prompts and replies Not verified

Every offloadable payload field is uploaded to object storage by default — your storage, but stored. Setting disable_content_logging skips content and does not persist reveal data.

Defaults matter more than options. A product that stores full prompts and replies unless you find the right header will have stored them by the time you read the docs.
How long they keep it Default content retention (days)
365 days Not verified

Default 365 days, minimum one day, and zero disables cleanup entirely rather than disabling storage.

Default retention for request content, in days. Zero means nothing is kept. Read the note: several products keep nothing as a rule but make timed exceptions for abuse review or specific models.
Could they train on your prompts Training on customer data
Not published — silence, not a no Not verified

Nothing on the README, enterprise docs or governance page addresses training.

Whether the vendor may use your prompts and outputs to train models. “Not published” means we could not find any position, which is not the same as a no — ask for it in writing.
Where it runs, and what you can pin Region and residency control
Your own infrastructure. Log offload targets S3 or GCS in a region you name. Maxim offers full VPC isolation or a VPC-peered hybrid. Not verified
Which regions are offered and whether you can force processing to stay in one. A global endpoint that silently picks a region is a different compliance story from an endpoint you pin yourself.
Where safety filters run Guardrail execution location
In your own infrastructure Not verified

Guardrail redaction happens in the Bifrost instance you run, and the reveal mapping stays with your own log row.

A filter that strips personal data only helps if it runs before the data leaves your boundary. If guardrails execute in the vendor’s cloud, the vendor has already received whatever you wanted redacted.
Who else touches the data Subprocessor list
Not published Not verified
The published list of third parties the vendor passes your data to. No list means you cannot know the full chain, which most data-protection agreements require you to.
SOC 2 audited SOC 2 audited
Not published Not verified
An independent audit of security controls. Enterprise buyers and their procurement teams routinely require it.
Will sign a HIPAA agreement HIPAA BAA
Not published Not verified
Required before you may send protected health information through the service. Without a signed BAA, healthcare data is off limits.
GDPR commitments GDPR commitments
Not published Not verified
Published data processing terms for handling personal data of people in the EU and UK.
Can keep data in the EU EU data residency
Not published Not verified
Requests can be processed inside the EU rather than routed to US infrastructure. Often the deciding constraint for European customers.
Does not retain your data Zero data retention
Not published Not verified
Prompts and responses are not stored after the request completes. Sometimes a paid add-on rather than the default.
Strips personal data PII redaction
Not published Not verified
Detects and removes identifiers such as names, emails, and card numbers before the request reaches the model provider.
Content guardrails Content guardrails
Yes Verified 2 days ago
Policy checks on inputs and outputs — blocking unsafe content, enforcing formats, or catching prompt-injection attempts.
Runs fully disconnected Air-gapped deployment
Yes Verified 2 days ago
Can be deployed in a network with no internet access, which some regulated and defence environments require.
Blocks personal data in prompts PII / DLP enforcement
Can block the request Not verified

Providers include in-process regex (RE2 patterns with `entity_type`), Gitleaks-based secrets detection, Microsoft Presidio, and Azure AI Language PII. Each supports `action: detect_only | block | redact`, `redaction_strategy: replace | mask | hash`, and `redaction_mode: runtime | logs_only | runtime_reversible`. Azure PII defaults to `detect_only` ([Guardrails config](https://docs.getbifrost.ai/deployment-guides/config-json/guardrails), [Enterprise guardrails](https://docs.getbifrost.ai/enterprise/guardrails))

Whether personal data detection sits on the request path and can stop the call, merely inspects and forwards it, or is not documented. A control that only reports is a logging feature, not a policy control.
Blocks prompt injection Injection / jailbreak enforcement
Can block the request Not verified

Azure Content Safety jailbreak shield, Model Armor, CrowdStrike AIDR, Gray Swan, Patronus, Lakera, Repello Argus are configurable as guardrail providers ([Enterprise guardrails](https://docs.getbifrost.ai/enterprise/guardrails))

Whether injection and jailbreak detection can stop a request. Most products offering this call a partner classifier rather than shipping their own.
Blocks harmful content Toxicity / moderation enforcement
Can block the request Not verified

Bedrock Guardrails and Azure Content Safety are supported providers for harmful-content categories ([Enterprise guardrails](https://docs.getbifrost.ai/enterprise/guardrails))

Whether hate, violence, sexual and self-harm categories are checked inline and can stop a request, in either direction.
Your own policy rules Custom policy hooks
Can block the request Not verified

Custom policy form is RE2 regex patterns with per-pattern flags, entity types, and actions, plus `ignored_secret_keywords` suppression lists on the secrets provider ([Guardrails config](https://docs.getbifrost.ai/deployment-guides/config-json/guardrails))

Whether you can add your own rule — a regex, a webhook, or your own classifier — rather than choosing from the vendor library.
Where guardrails run Guardrail execution location
Either, your choice Not verified
Whether guardrail evaluation happens inside your infrastructure or on the vendor’s servers. This decides whether the prompt you are trying to protect leaves your network in order to be checked.
If the guardrail itself fails Guardrail failure mode
Not documented Not verified

`not_documented` — the fetched guardrail pages document action outcomes but no explicit timeout/fail-open or fail-closed rule ([Guardrails config](https://docs.getbifrost.ai/deployment-guides/config-json/guardrails))

What happens when the guardrail service times out or errors: does the request proceed unchecked, or is it blocked? This is the worst-documented field in the entire catalogue — only two vendors state it plainly, which means most teams are running a control whose failure behaviour they cannot know.
Third-party guardrail vendors Guardrail integrations
Microsoft Presidio, Azure AI Language, AWS Bedrock Guardrails, Google Model Armor, Gitleaks Not verified
Named external guardrail services the product can call. A long list means the product is a router for policy engines rather than a policy engine itself — which also means another vendor bill and another hop.

Compliance evidence

Graded by how strong the evidence is, not whether the word appears on the vendor’s website. An audited report and a marketing claim are different things, and only one of them will satisfy your own auditor.

  • SOC 2 Certified Type 2 for Maxim AI
  • ISO 27001 Vendor’s own pages disagree trust center says compliant, governance page says in progress
  • GDPR DPA Certified reported compliant on the governance page
  • HIPAA BAA Vendor’s own pages disagree trust center says compliant, governance page says not applicable
  • FedRAMP Not published
  • ITAR Not published

Vendor source

Fit & integration

Work to try it Evaluation work shape
Run something locally first Not verified
The shape of the work on the vendor’s own quickstart, from swapping one base URL through to deploying infrastructure. An ordinal class rather than a duration, because elapsed time depends on accounts and quota we cannot see.
Work to run it Production work shape
Deploy it on your infrastructure Not verified
The same scale applied to the vendor’s recommended production path. For several products this is much heavier than the quickstart, which is exactly why both are recorded.
Steps on the quickstart Numbered quickstart steps
4 Not verified
A literal count of numbered steps on the vendor’s quickstart, recorded as evidence beside the work shape. Zero means the page publishes no numbered procedure at all. Large counts usually mean interleaved language tracks rather than more work.
Can you self-host it today Self-host install documentation
Install command published Not verified

`npx -y @maximhq/bifrost`; `docker pull maximhq/bifrost` + `docker run -p 8080:8080 maximhq/bifrost`; Helm: `helm repo add bifrost https://maximhq.github.io/bifrost/helm-charts`, `helm repo update`, `kubectl create secret generic bifrost-encryption-key --from-literal=encryption-key="$(openssl rand -base64 32)"`, `helm install bifrost bifrost/bifrost --set image.tag=v1.4.11 ...`, production `helm install bifrost bifrost/bifrost -f production.yaml` ([Setting Up - Bifrost](https://docs.getbifrost.ai/quickstart/gateway/setting-up), [Quick Start - Bifrost Helm](https://docs.getbifrost.ai/deployment-guides/helm))

Whether an install command is actually published. Several products advertise self-hosting while publishing no command to start from, which a plain yes/no would hide.
Works with the OpenAI SDK OpenAI SDK drop-in
Yes Not verified

Yes. Existing OpenAI SDK applications require zero code changes beyond setting `base_url` to `"http://localhost:8080/openai"`; the Python and JavaScript examples retain an API key such as `"your-openai-key"` or `process.env.OPENAI_API_KEY`. ([Bifrost OpenAI-compatible integration](https://www.getmaxim.ai/docs/bifrost/usage/http-transport/integrations/openai-compatible))

Whether an existing OpenAI-compatible client can be pointed at it by changing the base URL and key.
Vercel AI SDK support AI SDK provider package
Claimed compatible, no package named Not verified

Bifrost is stated to be compatible with the Vercel AI SDK. No official provider package name is documented. ([Maxim AI homepage](https://www.getmaxim.ai/))

Whether a first-party AI SDK provider package exists, or only a community package, a documented workaround, or the generic OpenAI provider pointed at a custom base URL.
Python framework integrations Documented Python frameworks
LangChain Not verified

LangChain integration is documented, including `langchain_openai.ChatOpenAI`, `langchain_anthropic.ChatAnthropic`, and `langchain_google_genai.ChatGoogleGenerativeAI`. LlamaIndex is not documented. ([Bifrost LangChain integration](https://docs.getbifrost.ai/integrations/langchain-sdk))

LangChain, LangGraph, LlamaIndex and similar orchestration frameworks with a documented integration.
Callable from Cloudflare Workers Cloudflare Workers support
Not documented Not verified

n.a. (not documented)

Whether the docs show calling this product from your own Worker. Deliberately separated from the several products whose own gateway runs on Workers, which is a fact about their infrastructure and not about your edge compatibility.
Kubernetes install Helm chart availability
Official Helm chart Not verified

Bifrost documents the official Helm chart `bifrost/bifrost` from the repository `https://maximhq.github.io/bifrost/helm-charts`. ([Bifrost Helm deployment guide](https://docs.getbifrost.ai/deployment-guides/helm))

Whether a named, published Helm chart exists, versus Helm being referenced with no chart named, versus generic cluster documentation that has nothing to do with this product.
Terraform support Terraform provider or modules
Official modules Not verified

A Terraform module source is documented as `github.com/maximhq/bifrost//terraform/modules/bifrost?ref=terraform/v0.1.0`. A Terraform Registry provider or module name is not documented. ([Bifrost enterprise deployment](https://www.getmaxim.ai/bifrost/resources/enterprise-deployment))

Whether you can declare this in code: an official provider, official modules, resources inside a hyperscaler’s provider, a community provider, or only Terraform code shipped in a repo.
Reuses your cloud identity Cloud IAM reuse
Reuses your cloud identity Not verified

Bifrost documents cloud-native authentication through AWS IRSA, GCP Workload Identity, and Azure Azure WIF, and describes this as native IAM integration. Specific AWS SigV4, Azure managed-identity, and GCP service-account authentication are not documented. ([Bifrost enterprise deployment](https://www.getmaxim.ai/bifrost/resources/enterprise-deployment))

Whether you can authenticate with IAM roles, workload identity or managed identities instead of another long-lived API key. Distinguished from products that only accept static upstream provider credentials.
Fits behind your API gateway API gateway integration
Not documented Not verified

n.a. (not documented)

Whether AI traffic can go through a gateway you already run, and who documented that — the product’s vendor or the gateway’s.
MCP support MCP surface shape
MCP gateway or registry Not verified

Bifrost acts as both an MCP client and MCP server, connecting to external MCP servers over STDIO, HTTP, and SSE, auto-discovering tools, and exposing them through a single gateway URL. It supports tool filtering, virtual MCP servers, MCP Tool Groups, explicit tool execution, and Tool Hosting. ([Bifrost MCP gateway](https://www.getmaxim.ai/bifrost/resources/mcp-gateway))

Which kind of MCP support this is: a gateway that governs many MCP servers, a hosted MCP server you connect to, MCP tools accepted inside the completion API, or client tooling. These are different products behind one acronym.
Needs your own provider key Upstream provider key required
Optional Not verified

Not explicitly stated; the displayed first-call snippets contain no provider key, but provider setup "supports adding API keys through the UI" and the last Helm step is "Configure Providers & Plugins" ([Setting Up - Bifrost](https://docs.getbifrost.ai/quickstart/gateway/setting-up), [Quick Start - Bifrost Helm](https://docs.getbifrost.ai/deployment-guides/helm))

Whether an upstream provider account and key must exist before your first call works. A prerequisite rather than a step, and it can differ between the hosted and self-hosted forms of the same product.
Gate before models work Model access gate
Not documented Not verified

n.a. (not documented). No approval, enablement, quota or waitlist wording ([Setting Up - Bifrost](https://docs.getbifrost.ai/quickstart/gateway/setting-up), [Quick Start - Bifrost Helm](https://docs.getbifrost.ai/deployment-guides/helm))

Whether an enablement click, a quota grant, a paid tier or an approval form stands between a valid key and a working model call.
Official client languages First-party client SDK languages
Go Not verified

An official Go SDK is documented with `go get github.com/maximhq/bifrost/core`. Documented integrations also include the OpenAI, Anthropic, AWS Bedrock, Google GenAI, LiteLLM, and LangChain SDKs; the evidence does not provide a complete list of official Bifrost client-library languages. ([Bifrost GitHub repository](https://github.com/maximhq/bifrost))

Languages with a first-party client library. An empty list can still mean the product is usable from any language via an OpenAI-compatible SDK.

How pricing actually works

OSS is free (Apache-2.0); infra cost only. Enterprise adds guardrails, cluster mode, adaptive load balancing, SAML/OIDC SSO, vault integration, log exports, audit logs, RBAC and SLAs at custom pricing after a 14-day trial; VPC, on-prem and air-gapped installs are enterprise options.

Back to top ↑

Official links

7,600 GitHub stars — a proxy for community size, not for quality.

Independent coverage

Third-party analysis, walkthroughs and operator threads. We link criticism as readily as praise. Nothing here is written or published by the vendor, by a competitor listed on this site, or by an SEO content farm — how we vet these.

Written reviews and analysis 1

  • The 3 LLM Gateways on My Shortlist kleinloog.ch · Apr 2026 Arnoud Kleinloog explains why Bifrost (Maxim AI) made his personal shortlist over LiteLLM, Portkey, Helicone, BricksLLM and Martian, with deployment and maturity caveats.

Video 2

What has changed here

No tracked value on this page has moved since it was first researched. Every figure still carries its original citation and check date.

Back to top ↑

Read the head-to-head

These pairs have a written verdict, not just a table.

Bifrost vs LiteLLM Read the verdict →

Usually weighed against

Bifrost vs Apache APISIX AI Gateway Compare → Bifrost vs LiteLLM Compare → Bifrost vs LLM Gateway Compare →