Enterprise AI gateway comparison 2026: LiteLLM vs Portkey vs Kong vs TrueFoundry

Summary. For an enterprise AI control plane in October 2026, the shortlist splits by who you want to carry the operational and vendor risk. LiteLLM is MIT-licensed and free to self-host, with virtual keys, team budgets and an MCP gateway in the open-source build; SSO beyond 5 users, SCIM and audit logs need an Enterprise licence priced by annual request capacity. Its release pipeline was hijacked on 21 October 2026 and a malicious 1.107.0 was live on PyPI for about two hours, so pin to 1.106.2 or earlier and verify every build. Portkey's gateway is MIT-licensed on GitHub and its hosted Production plan lists at $49 a month for 100,000 recorded logs, but Palo Alto Networks closed its acquisition on 29 May 2026 and now sells it as Prisma AIRS AI Gateway. Kong Konnect Plus starts from $25 a month plus usage, includes 1 million AI requests, charges $200 per extra million and caps at 10 million, with SSO and audit logs reserved for Enterprise. TrueFoundry is closed-source at $25 per user a month on Pro, with 20,000 requests per user and $20 per extra 100,000, plus a SaaS gateway location in Mumbai. Pick LiteLLM for full control inside your VPC, Kong if you already run Kong for APIs, TrueFoundry for a managed control plane with seat pricing, and Portkey if you are standardising on Palo Alto security.

About this article. Prices, licences and incident details were checked against vendor pages, documentation and incident reports on 22 October 2026. Vendors change pricing often, so re-check before you commit. No vendor paid for inclusion or placement. Researched with AI assistance and reviewed by our editorial team.

This article is the enterprise control-plane companion to our July 2026 AI gateway comparison of LiteLLM, Cloudflare, Kong, Bifrost and OpenRouter, which covers routing, caching and the open-source and edge options. Here the questions are governance, chargeback, guardrails, MCP, in-VPC hosting and total cost of ownership.

What changed in 2026, and why the control plane decision is urgent

Portkey is now a Palo Alto Networks product. Palo Alto announced its intent to acquire Portkey on 30 April 2026, saying it would continue to support existing and new Portkey customers, and closed the deal on 29 May, describing Portkey as the core AI gateway for Prisma AIRS. On 16 July it announced general availability of Prisma AIRS AI Gateway, and Portkey's homepage now presents the product under that name. In March, Portkey had said its production gateway was merging into open source; that 2.0 code still sits on a pre-release branch, and the latest tagged release on GitHub is v1.15.2 from January.

LiteLLM's release pipeline was hijacked twice. On 24 March 2026, versions 1.82.7 and 1.82.8 were live on PyPI for about 40 minutes; LiteLLM traced the compromise to the Trivy dependency in its CI/CD pipeline and said users of its official proxy Docker image were not affected. On 21 October 2026 a malicious 1.107.0 was published. LiteLLM's incident report says the PyPI wheels were live from 11:39 to 13:23 UTC, and the v1.107.0, latest, main-latest and main-stable Docker tags pointed at a compromised image from 11:46 to 14:20 UTC. The artefacts were built from an attacker-controlled lookalike repository after stolen GitHub tokens were used to override branch protection; the official source tag is clean. LiteLLM tells open-source users to pin 1.106.2 or an earlier explicit version, and its private Enterprise registry was not affected. Wiz, JFrog and Upwind, in GitHub issue #47826, report that the payload tries to dump LiteLLM_CredentialsTable, which holds every upstream provider key the proxy stores. PyPI has since removed 1.107.0 and lists 1.106.2 as the latest release.

Kong freed AI Gateway from the API gateway release train. Kong AI Gateway 3.14 (14 April 2026) added agent-to-agent (A2A) traffic management and OAuth2 scope-based MCP tool filtering. AI Gateway 2.0 went GA on 1 September 2026 with MCP Server Bundling and modality-aware cost tracking; AI plugins become opt-in from Kong Gateway 3.18, and 3.14 stays supported as a long-term release. Versions 2.1 and 2.2 followed in late September.

TrueFoundry published self-serve pricing and bought Seldon. Its pricing page now lists three tiers, and it announced the acquisition of UK-based Seldon AI on 24 June 2026.

What an enterprise control plane must do

Routing and caching are table stakes. A multi-team control plane also needs identity (SSO, SCIM, roles), attribution (team budgets, chargeback), policy (PII and prompt-injection checks), tool governance (MCP), evidence (audit logs, OpenTelemetry), placement (VPC or region) and low overhead. Each product is scored on what its vendor publishes.

LiteLLM: the self-hosted default, with a supply-chain caveat

LiteLLM's repository licence is MIT for everything outside the enterprise/ directory. The open-source gateway already covers much of the control-plane list: virtual keys, users and teams, budgets and rate limits, spend tracking, an admin UI, a guardrail framework with custom guardrails and Presidio PII masking, and an MCP gateway over Streamable HTTP, SSE and stdio, with stdio off by default. Tool permissions apply by key and team; organisations, the outer layer of that hierarchy, are an Enterprise feature.

The Enterprise licence is a key on the same image. It adds SSO and SCIM, audit logs with retention, organisation and team admins, secret managers, IP allowlists, per-team logging, multi-region control, tag-based budgets, soft budget alerts and spend reports, plus guardrail integrations such as Lakera, LLM Guard and LlamaGuard. SSO is free for up to 5 users. The pricing page says Enterprise is annual and sized to request capacity, deployment and support, "never per token", with a 30-day trial. LiteLLM states it is SOC 2 Type II audited; we found no ISO 27001 claim.

LiteLLM's published benchmarks include a run of 1,170 requests per second across four 4-vCPU instances against a mock endpoint, with 2 ms p50 and 8 ms p95 gateway overhead (vendor-run). An opt-in Rust core is in beta.

Best for: teams that want every byte in their own VPC and have platform engineers to run, patch and verify it.

Portkey: MIT gateway core, now inside Prisma AIRS

The Portkey gateway repository is MIT-licensed, has about 13,000 stars and claims under 1 ms of latency. The pricing page lists Developer (free, 10,000 recorded logs a month), Production ($49 a month for 100,000 recorded logs, then $9 per extra 100,000 requests up to 3 million, with role-based access, LLM and partner guardrails and semantic caching) and Enterprise (custom: SSO, granular budgets, VPC hosting, data-lake export and SOC 2 Type 2, ISO 27001, GDPR and HIPAA certificates).

Portkey's enterprise hybrid architecture runs the gateway and cache in your VPC, with logs either in your own store (the recommended option) or encrypted in Portkey's cloud. A Portkey-hosted control plane holds configuration, non-sensitive metadata and aggregated metrics; the data plane checks in every minute and keeps serving from cached configuration if the control plane is unreachable. The MCP gateway adds a single auth layer, team and user access control, per-call logging and identity forwarding.

The open question is ownership: the Upgrade Now button on Portkey's pricing page now leads to Palo Alto. Palo Alto's GA post claims sub-millisecond routing latency; treat it as a vendor statement.

Best for: Palo Alto security customers who want gateway, runtime inspection and agent identity from one vendor, or teams wanting an MIT gateway core they can fork.

Kong AI Gateway: governance across APIs, MCP and agents

Kong Gateway's core is Apache-2.0, but enterprise AI features are commercial. On Kong's pricing page, Konnect Plus for AI starts from $25 a month plus usage for a serverless control plane. A hybrid AI gateway control plane costs $200 a month (up to 2), 1 million AI requests are included, each extra million costs $200, and Plus caps at 10 million requests a month. Each model proxied costs $100 a month, with a limit of 5 on Plus. Nine paid AI plugins, including AI Proxy Advanced, AI Semantic Cache, AI Sanitizer and AI Rate Limiting Advanced, are an add-on on Plus and included on Enterprise. SSO and audit logging are Enterprise only, and a fully self-hosted control and data plane is sold as Gateway Enterprise at custom pricing.

Kong's guardrail catalogue is the broadest here: prompt guards, a PII sanitiser, a semantic response guard and connectors to AWS Bedrock Guardrails, Azure Content Safety and GCP Model Armor. For MCP it offers a proxy, ACLs, OAuth2 scope-based tool filtering and, in 2.0, MCP Server Bundling, which shows each caller only the tools it may use. It emits GenAI OpenTelemetry spans and metrics for AI, MCP and A2A traffic.

Kong's July 2025 benchmark reported 228% higher throughput than Portkey and 859% higher than LiteLLM, with 65% and 86% lower latency. It was vendor-run, proxy-only against a mock, and used Portkey OSS 1.9.19 and LiteLLM 1.63.7, both long superseded. Kong's trust centre lists ISO 27001:2022, a SOC 2 Type II report under NDA, GDPR and PCI DSS, and AI Gateway offers a FIPS 140-3 compliant mode that has not been through NIST validation.

Best for: enterprises that already govern APIs with Kong and want LLM, MCP and A2A traffic under one policy engine.

TrueFoundry AI Gateway: managed control plane, seat pricing

TrueFoundry's gateway is commercial and closed-source. Its pricing: Developer is free for up to 3 users with 10,000 requests and tool calls per user a month. Pro costs $25 per user a month, pools 20,000 requests per user, charges $20 per extra 100,000, and adds built-in guardrails, up to 10 budget rules, SSO, custom roles and up to 10 teams. Enterprise is a custom annual commitment covering VPC, on-premises and air-gapped deployment, data residency, third-party guardrails, MCP tool approvals and audit exports. MCP tool calls count as requests, and provider charges pass through without markup.

The MCP gateway supports OAuth 2LO and 3LO flows, virtual MCP servers, OpenAPI-to-MCP conversion and pre-tool and post-tool guardrails. Traces and metrics export over OTLP.

TrueFoundry's architecture page says auth, rate-limit and budget checks run in memory. On one vCPU and 1 GB it reports about +7 ms of overhead at 200 to 370 requests per second, rising to +12 ms with complete tracing at the top of that range (vendor-run). Its deployment docs describe its infrastructure as SOC 2, ISO 27001, GDPR and HIPAA compliant.

Best for: teams that want governance, MCP and budgets working this quarter without running an open-source proxy, with a later path to in-VPC deployment.

Head-to-head comparison

The overhead figures are not comparable: different hardware, mock models and methods, and Kong's are relative percentages against old competitor versions. Test with your own prompts, streaming mix and policy chain before you sign.

Decision table

Worked cost example: 50 million requests a month across 6 teams

Scenario and assumptions (labelled, not quotes):

• 50,000,000 requests and tool calls a month: 50,000,000 ÷ 2,592,000 seconds = 19.3 requests per second on average; assume a 10x peak of about 193.

• 6 teams and 60 named users needing SSO or dashboard access. Model spend is excluded; all four pass provider costs through.

• Self-hosted compute: 3 × m7i.xlarge (4 vCPU, 16 GiB) across zones in Mumbai, at AWS's on-demand list price of $0.2121 an hour: 3 × $0.2121 × 730 hours = $465 a month.

• Postgres, Redis, a load balancer and log storage: assumed $300 to $500 a month, so roughly $765 to $965 in total, close to TrueFoundry's own $800 to $1,000 estimate for self-hosting its full stack.

• Operating a self-hosted open-source gateway: assume 20 to 40 engineer-hours a month.

At 50 million requests every commercial option leaves its self-serve list price, so the real comparison is three enterprise quotes against LiteLLM OSS plus engineering time. TrueFoundry's $11,260 list figure is a useful negotiation ceiling; extrapolating Kong Plus linearly to 50 million gives $10,500. TrueFoundry's self-hosting estimates come from its deployment docs. Ask each vendor to price the same scenario, including SSO, audit logs and in-VPC deployment, and weigh it against what caching and routing save on your model bill, using our hybrid routing framework.

India, DPDP and data residency

The DPDP Rules were notified in the Gazette on 13 November 2025; most data-fiduciary obligations, in Rules 3, 5 to 16, 22 and 23, take effect 18 months later, in May 2027. Gateway logs hold full prompts and responses, which often contain personal data, so where the log store and control plane sit matters as much as where the gateway runs.

• LiteLLM: self-host in AWS Mumbai (ap-south-1), Hyderabad (ap-south-2) or Azure and Google Cloud India regions; nothing leaves your account unless you configure a callback.

• Portkey: in the hybrid model with logs kept in your VPC, prompts stay with you and the hosted control plane receives configuration and aggregated metrics. Portkey does not publish where that control plane runs, so ask Palo Alto.

• Kong: Konnect has an IN geo mapped to ap-south-1 and ap-south-2, plus Dedicated Cloud Gateways in Mumbai and Hyderabad.

• TrueFoundry: the SaaS runs a Mumbai gateway location, but its control plane is in Ireland, and in SaaS mode request and response data flows through that control plane. For residency, use the Enterprise in-VPC options; the licensing server still receives user emails and request counts.

EU teams get an EU geo on Kong and EU gateway locations on TrueFoundry. We design gateway deployments aligned with DPDP and GDPR requirements; compliance itself depends on your data, contracts and audits.

Implementation checklist

1. Pin and verify artefacts. Pin Docker images by digest, never latest, and wait a few days before adopting a new release. LiteLLM signs its GHCR images with cosign from v1.83.0, so verify before every rollout, but do not rely on the signature alone: the October images were signed by the hijacked release workflow.

            cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/0112e53046018d726492c814b3644b7d376029d0/cosign.pub \
  ghcr.io/berriai/litellm:<release-tag>
          

1. Check for the October payload on any host that installed 1.107.0 between 11:39 and 13:23 UTC on 21 October, or ran the affected Docker tags between 11:46 and 14:20 UTC. Search for litellm-1.107.0.dist-info, cook.pth and sitecustomize.py without starting Python, treat any hit as a compromised host, and rotate every provider key stored in the proxy database plus the master key, virtual keys and database password.

1. Keep provider keys in your vault rather than the gateway database where supported.

1. Model organisation, team, project and key first, with one budget owner and a cost-centre tag per team.

1. Wire SSO and SCIM before the second team onboards, and ship audit logs to your SIEM.

1. Decide where guardrails run: in the gateway, in the agent framework or both, and budget the extra latency.

1. Put MCP behind the gateway with per-team tool allowlists and OAuth scopes.

1. Export OpenTelemetry using the GenAI semantic conventions, and pick a backend with our LLM observability comparison.

1. Load-test with real prompt sizes, streaming share and the full policy chain.

1. Keep an exit path. All four expose OpenAI-compatible APIs, so switching cost sits mostly in policies and budgets.

How eCorpIT can help

eCorpIT is a Gurugram-based technology organisation, founded in 2021, assessed at CMMI Level 5 and MSME certified, with senior-led engineering teams working across AWS, Microsoft and Google platforms. Our AI gateway and model-routing service maps your organisation into keys, teams and budgets, deploys the gateway inside your own cloud account, wires SSO, audit logs and OpenTelemetry, and puts MCP tools behind per-team policies. Talk to us at /contact-us/.

Last updated: 22 October 2026.

References

1. Enterprise features and licensing — LiteLLM documentation

1. Oct 21, 2026 LiteLLM release v1.107.0 compromised — LiteLLM

1. Palo Alto Networks completes acquisition of Portkey — Palo Alto Networks

1. Kong pricing — Kong

1. TrueFoundry pricing — TrueFoundry

1. Palo Alto Networks to acquire Portkey — Palo Alto Networks

1. Announcing general availability of Prisma AIRS AI Gateway — Palo Alto Networks blog

1. Portkey homepage — Portkey

1. Production gateway merging into open source, discussion 1576 — Portkey on GitHub

1. Portkey AI Gateway repository — GitHub

1. March 2026 supply-chain incident report — LiteLLM

1. LiteLLM compromised, steals credentials — Wiz

1. LiteLLM hijacked again — JFrog Security Research

1. LiteLLM issue 47826 — GitHub

1. litellm release history — PyPI

1. Kong AI Gateway 3.14 — Kong

1. Kong AI Gateway 2.0 is now GA — Kong

1. AI Gateway changelog — Kong documentation

1. TrueFoundry acquires Seldon AI — TrueFoundry

1. LiteLLM LICENSE — GitHub

1. MCP gateway — LiteLLM documentation

1. Access control — LiteLLM documentation

1. LiteLLM pricing — LiteLLM

1. Benchmarks — LiteLLM documentation

1. Rust gateway — LiteLLM documentation

1. Portkey pricing — Portkey

1. Enterprise hybrid deployment architecture — Portkey documentation

1. Kong LICENSE — GitHub

1. AI Gateway overview — Kong documentation

1. AI gateway benchmark: Kong AI Gateway vs Portkey and LiteLLM — Kong

1. Trust Center — Kong

1. FIPS 140-3 support for AI Gateway — Kong documentation

1. MCP gateway overview — TrueFoundry documentation

1. Export OpenTelemetry data — TrueFoundry documentation

1. Gateway plane architecture and benchmarks — TrueFoundry documentation

1. AI Gateway deployment options — TrueFoundry documentation

1. Amazon EC2 on-demand pricing — Amazon Web Services

1. Digital Personal Data Protection Rules, 2025, G.S.R. 846(E) — Gazette of India

1. Konnect geographic regions — Kong documentation

1. Globally distributed SaaS gateway — TrueFoundry documentation

1. Docker image security — LiteLLM documentation