LiteLLM Alternatives in 2026: Self-Hosted vs Hosted
LiteLLM alternatives in 2026 compared on setup, cost, security and model routing: Bifrost, Portkey, OpenRouter, Cloudflare AI Gateway and more.
The strongest LiteLLM alternatives in 2026 split into two camps: self-hosted options like Bifrost (Go, Apache 2.0) and Portkey's open-source gateway (MIT) that you run yourself, and managed options like OpenRouter and Cloudflare AI Gateway that remove ops entirely. Two security incidents in early 2026 pushed many teams to re-evaluate LiteLLM specifically: a supply chain compromise in March that hit PyPI versions 1.82.7 and 1.82.8, and an unauthenticated SQL injection (CVE-2026-42208, CVSS 9.3) disclosed in April. Which alternative is right depends almost entirely on whether your team wants to own the infrastructure or delegate it, and what you are actually willing to pay once engineering time is counted.
Why Teams Are Reconsidering LiteLLM in 2026
LiteLLM has always been two things sharing one name: a Python SDK that unifies calls to 100+ model providers under one function, and a self-hosted proxy (the AI Gateway) that gives platform teams virtual keys, budgets, spend logging, and fallback routing across your whole organization. The software itself is MIT-licensed and free to download. The operating cost is not free.
Running LiteLLM in production correctly requires at minimum two or more stateless proxy replicas behind a load balancer, PostgreSQL for keys, teams, spend logs, and config, and typically Redis for shared rate-limit state. Infrastructure alone is commonly estimated at a few hundred dollars a month for a modest deployment, before engineering time for setup, upgrades, and on-call. LiteLLM publishes no markup on provider token prices, which means your token spend goes straight to OpenAI, Anthropic, or Google at list rates. What you pay for is the system surrounding it.
The 2026 Security Events
On March 24, 2026, versions 1.82.7 and 1.82.8 of the LiteLLM package were published to PyPI as part of the TeamPCP supply chain campaign. LiteLLM's own post-mortem explains that attackers gained access to the PyPI publishing pipeline through a compromise of the Trivy security scanner used in LiteLLM's CI/CD. The malicious packages, which were live for about three hours before PyPI quarantined them, contained a credential-stealing payload that exfiltrated SSH keys, cloud credentials, and Kubernetes secrets. These two versions have been removed; the project continued from a clean baseline.
A separate issue followed in April. CVE-2026-42208, rated 9.3 out of 10, is an unauthenticated SQL injection in the proxy's API key verification path. CISA added it to its known exploited vulnerabilities catalog on May 8, 2026. The fix shipped in version 1.83.7.
If you are still running LiteLLM today: pin to an exact version at or above 1.83.7, use LiteLLM's official Docker image with pinned dependencies, and keep the proxy off the public internet. Neither incident means LiteLLM is finished, but they gave security-conscious teams concrete reasons to evaluate alternatives.
Self-Hosted Alternatives
Self-hosted alternatives carry the same operational burden as LiteLLM but eliminate its specific dependency chain and, in some cases, its Python runtime.
Bifrost
Bifrost, from Maxim AI, is an open-source gateway written in Go and licensed under Apache 2.0. Because it compiles to a single binary with no interpreter dependency, it sidesteps Python's GIL bottleneck and the class of supply chain risk that comes with PyPI installs. It supports latency-based routing, adaptive fallback, and semantic caching, and it routes to all the major commercial providers. Setup is a single container start rather than a multi-service Docker Compose stack. The tradeoff is that Bifrost is younger than LiteLLM, so its ecosystem of community plugins and provider-specific workarounds is smaller.
Portkey Gateway (Open-Source)
Portkey ships in two modes. The open-source gateway is MIT-licensed, runs via Docker or npx, and provides the full routing, retries, fallbacks, guardrails, and load balancing layer with no per-token markup and no subscription fee. The gateway's vendor-reported latency overhead is under 1 ms. Self-hosting the gateway gives you the complete data plane; you just lose the hosted observability layer, persistent log storage, and semantic caching that come with the managed tier.
One procurement note: Palo Alto Networks acquired Portkey in May 2026 and now offers the product as Prisma AIRS AI Gateway under enterprise terms. The open-source gateway itself continues under MIT, and the $49/month managed tier pricing was unchanged as of September 2026.
Other Self-Hosted Options
The Portkey blog and several comparison sites also point to agentgateway (a Rust proxy donated to the Linux Foundation under Apache 2.0, still under active development as of early October 2026) and Kong AI Gateway (Apache 2.0 core, with AI routing features that get more capable as you move up the licensing ladder). Kong suits teams already standardized on Kong for general API management, where adding an AI Proxy plugin is a smaller incremental lift than adopting a new runtime.
Let each request use the cheapest model that's just as good
PromptUnit checks each request your app sends. When a cheaper model is just as good for that request, it uses it; otherwise your model answers. Free until it has saved you money.
Try it free →Hosted (Managed) Alternatives
Hosted alternatives hand off the ops entirely. You pay a platform fee or a per-credit surcharge in exchange for someone else running the proxy, handling upgrades, and absorbing the supply chain risk on the gateway layer.
OpenRouter
OpenRouter is a managed-only gateway with no self-hosting option. It provides access to a large catalog of models through one API key and routes automatically. It passes provider token prices through without a per-token markup, collecting its revenue instead on credit purchases: a 5.5% fee on the Standard plan and 8% on Business when you buy credits by card. BYOK (using your own provider keys) is free up to $25,000 of list-price inference per month, then 5% beyond that.
For developers who want to prototype across many models quickly, or who need automatic failover without standing up any infrastructure, OpenRouter is one of the lowest-friction paths. The limitations are no self-hosting option and the fact that you are sending all traffic through a third-party system rather than your own.
Cloudflare AI Gateway
Cloudflare AI Gateway is a hosted proxy that routes to the major commercial providers. Core features including basic routing and observability are available on the free tier. For teams already running workloads on Cloudflare Workers, it is a natural fit because there is minimal new infrastructure to introduce. It is not an option for teams that need self-hosted or air-gapped deployments.
Portkey Managed
The managed Portkey tier starts at $49 per month for the Production plan, which includes 100,000 logged requests per month and 30-day retention. Additional logging runs $9 per additional 100,000 requests. The managed layer adds persistent request logs, cost traces, semantic caching, RBAC, and the observability dashboard that the open-source self-hosted gateway does not provide. Enterprise pricing is custom and includes VPC hosting, SSO, and compliance certifications.
Comparison Table
All token prices are pass-through (no markup) across all options below. What varies is the platform fee structure and operational responsibility.
| Option | Hosting | License | Platform Cost | Key Security Notes |
|---|---|---|---|---|
| LiteLLM (self-host) | Self-hosted | MIT | $0 software; a few hundred $/mo infra | Supply chain attack Mar 2026; CVE-2026-42208 Apr 2026 (fixed in 1.83.7) |
| Bifrost | Self-hosted | Apache 2.0 | $0 software; infra similar to LiteLLM | Go binary, no PyPI dependency |
| Portkey Gateway OSS | Self-hosted | MIT | $0 software; infra lower (single container) | Separate CVE history (CVE-2025-66405, SSRF, fixed in 1.14.0) |
| Portkey Managed | Hosted | MIT gateway | From $49/month; $9/100k log overages | Palo Alto Networks (Prisma AIRS); SOC2, HIPAA |
| OpenRouter | Hosted | Proprietary | 5.5% credit fee (Standard); 8% (Business); BYOK free up to $25k/mo then 5% | No self-host option |
| Cloudflare AI Gateway | Hosted | Proprietary | Free core features | Cloudflare infrastructure |
How to Choose
Stay on LiteLLM if your team already runs it cleanly at 1.83.7 or later, your ops burden is acceptable, and you value the widest provider catalog and community ecosystem. Pin versions, verify image signatures, and keep the proxy off the public internet.
Switch to Bifrost if you want a self-hosted drop-in with a smaller attack surface, Go throughput, and no Python dependency chain to audit. It is the most direct like-for-like replacement.
Use Portkey's OSS gateway if you want self-hosting but need guardrails and a cleaner single-container setup than LiteLLM's multi-service stack. Add the managed tier if you want persistent observability without building your own logging pipeline.
Use OpenRouter if you want no infrastructure at all and can tolerate the 5.5% credit fee (or BYOK within the free allowance). It is the right call for prototyping and small teams where ops cost would dwarf the credit fee.
Use Cloudflare AI Gateway if you are already on Cloudflare Workers and need a lightweight, zero-ops routing layer.
Where Cost Optimization Fits In
All of these tools handle routing between models you choose explicitly. What none of them do by default is automatically find a cheaper model that can answer each specific request as well as the expensive one you asked for.
That is a different job. A few approaches exist: hardcoding cheaper models per app step (which breaks on quality regressions and model retirements, as covered in Hardcoding a Cheaper AI Model Per Step: What Goes Wrong), building your own routing rules from benchmark data, or using a proxy that handles the per-request quality check for you.
PromptUnit takes the latter approach. You point your app's AI API base URL at it and add your PromptUnit key in the x-promptunit-key header; your own provider keys stay in place. On each request, it checks whether a cheaper model can answer just as well and routes accordingly, with the dashboard showing the model asked for, the model that answered, and what each request cost and saved. It works with OpenAI, Anthropic, Google, Groq, and DeepSeek keys, as well as your own OpenRouter key. Pricing is free until it has saved you money, then 20% of what it saves.
If you want to understand the full token cost picture before choosing any of these tools, the AI Cost Optimization Checklist 2026 covers 15 concrete steps across model selection, caching, routing, and output compression, in order of savings impact.
Model Routing Strategies
Whatever gateway you run, the routing configuration you write matters as much as the gateway itself. LiteLLM's router supports latency-based, cost-based, usage-based, and least-busy strategies, each tuned to a different objective. Latency-based routing tracks response times and sends each request to the fastest available deployment, which is valuable for consumer-facing products. Cost-based routing picks the cheapest registered deployment for a given model name, which is useful when you have the same model on multiple cloud regions with different pricing. Usage-based routing distributes load to deployments below their rate limit, which reduces 429 errors under burst traffic.
These are static rules: they do not know whether a cheaper model would have answered as well as the expensive one you assigned to that route. That distinction matters more than it sounds when you are running multi-step agent workloads where every step is billed at full flagship rates.
The key takeaway for 2026: LiteLLM remains capable software, but the two security incidents this year have made supply chain hygiene a first-class concern for any team running it. Self-hosted alternatives like Bifrost reduce that surface area. Managed alternatives like OpenRouter and Portkey eliminate it from your infrastructure entirely, at the cost of a platform fee and reduced data sovereignty. The right answer is determined by your team's operational capacity and your security posture, not by any single benchmark.