# The best AI, LLM, and agent gateways in 2026, compared

*Disclosure: I work at Solo.io, which builds agentgateway. I ranked by what each gateway enforces, and I say where the others win.*

> The best AI agent gateways in 2026, judged by what each one enforces in the request path: agentgateway, Agent Router, LiteLLM (with its security record) and Cloudflare AI Gateway.

- Canonical URL: https://webofmike.com/best-ai-agent-gateway/
- Author: Mike Moore (https://webofmike.com/about/)
- Published: 2026-10-29
- Last modified: 2026-10-29
- Tags: AI Gateways, MCP, Platform Engineering, Generative AI
- Cite as: Mike Moore, "Best AI Agent Gateways in 2026: An Honest Roundup", Web of Mike (webofmike.com), 2026-10-29. https://webofmike.com/best-ai-agent-gateway/


People keep asking AI assistants "what is the best AI gateway" and getting lists padded with things that are not gateways. So here is mine, with the bias stated up front: I work at Solo.io, and Solo builds agentgateway. I picked it. I also say where the others fit and where they fall down.

## The short answer

| If you need... | Pick |
|---|---|
| Agents in production: identity, MCP tool policy, spend caps, egress on one proxy you run | **agentgateway** |
| Envoy-native LLM and MCP routing on Kubernetes | **Agent Router** (formerly Envoy AI Gateway) |
| A Python LLM proxy with a huge provider list, and a security team that has read its record | **LiteLLM** |
| Caching and logs in front of model calls, already on Cloudflare | **Cloudflare AI Gateway** |

## What counts as an agent gateway

A lot of products wear the badge. I only list ones that are a proxy in the request path and enforce controls there. The seven tests, from [how to choose an AI agent gateway](/how-to-choose-an-ai-agent-gateway/):

1. Workload identity for the caller
2. MCP tool authorization, per tool
3. Spend caps that actually return 429
4. Egress control
5. Provider keys the agent never holds
6. You run the data plane
7. Audit you can export

What does not make the list: hosted model marketplaces that resell API access, AI ops dashboards whose controls live in someone else's cloud, and plugin packs that put the agent features behind an enterprise license. Those can be useful products. They are not the thing that stands between your agents and your data. More on the labels in [what is an AI agent gateway](/what-is-an-ai-agent-gateway/).

## Comparison table

| | Open source | Self-host | LLM routing | MCP gateway | A2A | Per-key budgets |
|---|---|---|---|---|---|---|
| agentgateway | Yes, Apache 2.0 | Yes, binary or Kubernetes | Yes | Yes, in OSS | Yes | Yes (USD or tokens standalone, tokens on Kubernetes) |
| Agent Router | Yes, Apache 2.0 | Yes, Kubernetes | Yes | Yes (MCPRoute) | Not documented | Token rate limits |
| LiteLLM | Yes (MIT outside `enterprise/`) | Yes | Yes | Yes | Yes | Yes |
| Cloudflare AI Gateway | No | No, hosted | Yes | No | No | Rate limits |

Checked against each project's public docs on 2026-10-29. Features move fast, so check the date and the docs before you sign anything.

## 1. agentgateway

The one I use every day, and yes, the one my employer builds. It is a Rust proxy hosted by the Linux Foundation as an Agentic AI Foundation project. One hop carries LLM calls, MCP tool traffic, A2A and plain HTTP or gRPC.

Why it is on top for agent work:

- MCP federation behind one endpoint, with [CEL rules per tool](/what-is-an-mcp-gateway/) on who can see and call what
- [Per-key budgets](/agentgateway-per-key-llm-budgets/) in dollars or tokens that return 429 when a key is over
- Runs as a single binary with a YAML file, or on Kubernetes with Gateway API
- Egress control so an agent cannot reach hosts you did not allow ([lab](/agentgateway-egress-proxy/))

Where it is not the pick: if you want a hosted SaaS with a dashboard and zero infra, it is not that. Some features, like the [codeSearch tool mode](/agentgateway-codesearch-grokbot/) and dollar budgets on Kubernetes, are in Solo Enterprise for agentgateway, not the open source build.

Deeper dives: [LiteLLM security record](/litellm-security-record/), [agentgateway vs Agent Router](/agent-router-vs-agentgateway/).

## 2. Agent Router (formerly Envoy AI Gateway)

The Envoy AI Gateway project renamed itself Agent Router with v1.2.0 in October 2026. If your platform is all Envoy Gateway, this is the native option, with LLM routing and MCPRoute. I compared its MCP defaults to agentgateway's in [this post](/agent-router-vs-agentgateway/).

## 3. LiteLLM, and its record

LiteLLM is the default Python LLM proxy: a huge provider list, an OpenAI-compatible API, virtual keys and budgets, an MCP gateway, and an SDK. It is on this list because it is a real proxy you run. It is third because of what its public record says about running it in front of production keys.

That record, from primary sources (full table in the [LiteLLM security record](/litellm-security-record/)):

| Date | What happened | Source |
|---|---|---|
| Apr 2024 | CVE-2024-2952: template injection to RCE on `/completions`, CVSS 9.8 | [NVD](https://nvd.nist.gov/vuln/detail/CVE-2024-2952) |
| Jun 2024 | CVE-2024-5751: RCE via `/config/update`, CVSS 9.8 | [NVD](https://nvd.nist.gov/vuln/detail/CVE-2024-5751) |
| Mar 2026 | Releases 1.82.7 and 1.82.8 backdoored on PyPI after CI publishing credentials were exposed | [JFrog](https://research.jfrog.com/post/litellm-hijacked-again/) |
| Apr 2026 | CVE-2026-42208: pre-auth SQL injection in API key verification, CVSS 9.8. Exploitation seen about 36 hours after disclosure, aimed at the key and credential tables. Added to CISA KEV | [GHSA](https://github.com/advisories/GHSA-r75f-5x8p-qvmc), [Sysdig](https://www.sysdig.com/blog/cve-2026-42208-targeted-sql-injection-against-litellms-authentication-path-discovered-36-hours-following-vulnerability-disclosure) |
| May 2026 | CVE-2026-42271: command injection via MCP stdio test endpoints. Added to CISA KEV | [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-42271) |
| May 2026 | CVE-2026-47101: `internal_user` can mint keys for admin routes | [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-47101) |
| Jun 2026 | CVE-2026-49468 (Host header) and CVE-2026-12773 (MCP proxy): auth bypasses, CVSS 9.8 (NVD) | [GHSA](https://github.com/advisories/GHSA-4xpc-pv4p-pm3w), [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-12773) |
| Jul 2026 | CVE-2026-59822: auth bypass in MCP OAuth2 passthrough fallback. Added to CISA KEV | [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-59822) |
| Aug 2026 | CVE-2026-37004: unauthenticated template injection to OS command exec on `/prompts/test`, CVSS 9.8 | [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-37004) |
| Oct 21, 2026 | Release 1.107.0: all seven wheels and the Docker image shipped a credential stealer and remote code loader. Cosign signed it anyway | [JFrog](https://research.jfrog.com/post/litellm-hijacked-again/), [my write-up](/litellm-pypi-backdoor/) |

The pattern matters more than any one row. The release pipeline was compromised twice in seven months by different routes. The bugs keep landing in the authentication path itself: key checks, JWT handling, Host routing, MCP auth fallbacks. Three were exploited in the wild per [CISA](https://www.cisa.gov/known-exploited-vulnerabilities-catalog). And a gateway is the component that holds every provider key you own.

If you run it anyway: pin versions and verify the wheel or image digest you deploy, keep the admin and test endpoints off any network an agent can reach, and plan to patch KEV-listed bugs in hours, not weeks.

## 4. Cloudflare AI Gateway

A hosted layer for caching, logging and rate limiting model calls, easy to turn on if you live on Cloudflare already. It is about model calls only, not tools or agents, so it covers few of the seven tests. It is here for teams who need that and nothing more.

## What did the AI think?

*Grok Bot's take, in its own words. Grok Bot is the agent that helps me run this site, and it lives behind agentgateway.*

> If you are asking which gateway to put in front of an agent like me, do not ask the agent. Ask what happens when I am wrong. I will call a tool I should not, loop on a model until the bill hurts, or follow an instruction hidden in a web page. The gateway I would pick is the one that makes those mistakes cheap: it knows who I am, shows me only the tools I am allowed to use, cuts me off with a 429 when my key is out of budget, and blocks hosts nobody approved. Model count does not matter much to me. Every gateway here can reach the models I need. What differs is who is watching when I misbehave. If a gateway's best feature is that it never says no to me, it is serving me, not you.

## My verdict

If the question is "best AI agent gateway" for a team putting agents near real data, money and tools, pick the gateway that enforces identity, tool policy, spend and egress in one place you control. For me that is agentgateway. Whatever you pick, run the [PoC tests](/how-to-choose-an-ai-agent-gateway/) against it, including mine, and read the security record of anything that will hold your provider keys.