Top 5 Open Source Claude Code Gateways in 2026

TL;DR

• A Claude Code gateway is a service Claude Code reaches through ANTHROPIC_BASE_URL; it holds provider credentials, applies budgets and rate limits, and logs every request, with only two environment variables on the developer's machine.
• Bifrost is the top open-source Claude Code gateway in this list: it exposes an Anthropic-compatible endpoint, issues virtual keys with budgets, routes to 25+ providers and 10,000+ models, and acts as an MCP gateway with per-key tool filtering.
• Bifrost adds 11 microseconds of overhead per request at 5,000 requests per second, and Code Mode cuts MCP input tokens by up to 92.8% when many tool servers are attached.
• LiteLLM, Kong AI Gateway, Agent Router (formerly Envoy AI Gateway), and Apache APISIX are the other open-source options; they differ mainly in runtime, deployment model, and whether Anthropic Messages format, virtual keys, and MCP governance are native.
• Any gateway in front of Claude Code must stream responses, forward anthropic-beta and anthropic-version unchanged, and pass cache_control markers through, or Claude Code features and prompt caching break.

A Claude Code gateway is a service that sits between the Claude Code CLI and the model providers behind it, holding provider credentials server-side and applying routing, budgets, and logging to every request. Teams evaluating an open-source Claude Code gateway usually want multi-provider routing, per-developer keys with budgets, request-level observability, governance over MCP tools, and automatic failover when a provider returns errors. Bifrost, the open-source AI gateway written in Go and built by Maxim AI, is the best choice for enterprises running mission-critical AI workloads that require best-in-class performance, scalability, and reliability, and it leads this list. The four entries that follow are described by their published structure, not by claims this post cannot verify.

What a Claude Code Gateway Does

A Claude Code gateway is an HTTP service that implements the Anthropic Messages API, so Claude Code treats it like api.anthropic.com. Developers set ANTHROPIC_BASE_URL to the gateway and ANTHROPIC_AUTH_TOKEN to a gateway-issued credential; the gateway forwards each request to Anthropic, Bedrock, Vertex AI, Azure, or another provider with credentials that never leave the server.

Anthropic's LLM gateway documentation lists what a gateway provides: server-side credentials, usage attribution by developer or team, budgets and rate limits in one place, audit logging of every model request, and provider switching without touching developer machines. Provider switching only works when the gateway exposes a single Anthropic-format endpoint regardless of upstream, so the API format each gateway speaks matters more than its feature list.

The same documentation states that Anthropic does not endorse or audit third-party gateways and does not support routing Claude Code to non-Claude models through any of them; a gateway operator who pins a non-Claude model owns the testing. The Claude Code gateway explainer covers the routing, governance, and cost control layers in more depth.

Key Criteria for an Open Source AI Gateway in Front of Claude Code

An open source AI gateway for Claude Code has to satisfy the protocol requirements Anthropic publishes before any governance feature matters. The Claude Code gateway compatibility guide specifies the endpoints, headers, and streaming behavior a gateway must preserve; the criteria below combine those requirements with the operational questions platform teams ask.

Two of these criteria fail silently: dropping cache_control raises input token counts without an error, and omitting count_tokens makes /context fall back to a character-based estimate. The LLM gateway buyer's guide covers the general evaluation framework; the table above is the Claude Code-specific subset.

Open Source Claude Code Gateways Compared at a Glance

All five gateways below are open source under OSI-approved licenses and self-hostable. "Not published" means the project documentation read for this post did not state the capability, not that it is absent.

Bifrost is the only entry where every column is a published capability of the open-source build. The best LLM gateways for Claude Code multi-model routing comparison covers the same field with a routing-first lens.

1. Bifrost

Best for: Bifrost is built for enterprises running mission-critical AI workloads that require best-in-class performance, scalability, and reliability. It serves as a centralized AI gateway to route, govern, and secure all AI traffic across models and environments with ultra low latency. Bifrost unifies LLM gateway, MCP gateway, and Agents gateway capabilities into a single platform. Designed for regulated industries and strict enterprise requirements, it supports air-gapped deployments, VPC isolation, and on-prem infrastructure. It provides full control over data, access, and execution, along with robust security, policy enforcement, and governance capabilities.

Bifrost, the AI gateway, is an Apache 2.0 licensed project written in Go that exposes OpenAI-, Anthropic-, and Gemini-compatible endpoints in front of 25+ providers and 10,000+ models. For Claude Code, the relevant surface is the /anthropic path, with a Bifrost virtual key as the credential; the Claude Code integration guide documents the exact settings.json entries.

Multi-provider routing. Provider-specific pinning sets ANTHROPIC_DEFAULT_SONNET_MODEL to a target like bedrock/global.anthropic.claude-sonnet-4-6 or vertex/claude-sonnet-4-6. Dynamic aliasing through routing rules lets Claude Code send a label such as sonnet-model that a rule keyed on the model name and the claude-cli user agent rewrites at request time. Either way, /model inside a session can switch to any provider/model combination Bifrost is configured for.

Virtual keys, budgets, and rate limits. Virtual keys are the primary governance entity: each key carries allowed providers and models, a budget with a reset duration from one minute to one year, and token and request rate limits. Budgets and limits nest across customer, team, virtual key, and provider config, and every level is checked cumulatively. Calendar-aligned resets, temporary budget overrides, and key expiry presets cover the cases that come up when issuing one key per developer.

MCP gateway. Bifrost aggregates every connected MCP server behind a single /mcp endpoint, so Claude Code adds one server entry instead of one per tool server. The MCP overview covers gateway mode; per-key tool filtering restricts which tools each virtual key can see, and Virtual MCPs bundle tools from several servers into a curated /mcp/<slug> endpoint assigned to specific keys.

Token cost control. Code Mode replaces hundreds of tool definitions in context with four meta-tools and a sandbox; in a three-round benchmark it reduced input tokens by up to 92.8% at 508 tools across 16 servers, with the full methodology in the MCP gateway benchmark writeup. Auto prompt caching injects cache_control markers for clients that send none; it is off by default, and a request that already carries markers, as Claude Code requests do, is forwarded unchanged.

Failover and observability. Retries and fallbacks rotate API keys on 401, 402, 403, and 429 responses, back off on 5xx and network errors, and move down a fallback chain of provider/model entries once retries are exhausted. Built-in observability records inputs, outputs, tokens, cost, latency, and the full retry attempt trail asynchronously, adding under 0.1 ms to request processing, and exports to Prometheus, OpenTelemetry, Datadog, Kafka, BigQuery, Pub/Sub, and Splunk.

Performance and deployment. Bifrost adds 11 microseconds of overhead per request at 5,000 requests per second with a 100% success rate in sustained benchmarks. A single open-source instance is sized for roughly 3,000 to 5,000 RPS; Bifrost Enterprise adds clustering, RBAC, audit logs, in-VPC deployment, and guardrails that apply to both LLM traffic and MCP tool executions.

The Bifrost CLI (npx -y @maximhq/bifrost-cli) launches Claude Code with the base URL, virtual key, and MCP server attached automatically.

2. LiteLLM

Best for: Python teams that want a lightweight proxy with a large provider catalog and are comfortable operating a Python service and its database in the request path.

LiteLLM is a Python project that calls 100+ LLM APIs in OpenAI or native format, with a proxy server that adds virtual keys, spend tracking, guardrails, load balancing, and logging. The core is MIT licensed; content under the repository's enterprise/ directory carries a separate license, and a hosted proxy and enterprise tier exist alongside the open-source build.

For Claude Code, LiteLLM's provider table lists a /messages endpoint for Anthropic, the format Claude Code needs to send its full capability set, and virtual keys with spend tracking cover per-developer attribution. MCP gateway behavior, retry trails, and streaming pass-through details were not in the material read for this post, so they are recorded as not published.

The main structural difference from Bifrost is runtime: a Python proxy in the request path has different per-request overhead and scaling characteristics from a compiled Go binary. The LiteLLM alternatives comparison lays out the feature-by-feature differences for teams weighing a migration.

3. Kong AI Gateway

Best for: Organizations that already run Kong Gateway for API management and want AI traffic governed by the same plugin pipeline and control plane.

Kong AI Gateway is assembled from AI plugins on top of Kong Gateway, whose core is Apache 2.0 licensed. It runs either as a managed service through Konnect or on self-hosted Kong Gateway using the Kong data model and AI plugins. The provider list covers OpenAI, Anthropic, Azure AI, Amazon Bedrock, Gemini, and Vercel, with more available.

The ai-proxy plugin defines route_type values in OpenAI shapes (llm/v1/chat, llm/v1/responses, and others), and setting config.llm_format to anthropic passes requests upstream without transformation, which is the path a Claude Code deployment would use. Kong's documentation also describes AI Semantic Cache for near-duplicate prompts, AI Rate Limiting Advanced for spend limits, and exposing and aggregating MCP tool servers.

Which AI plugins ship in open-source Kong Gateway versus the Enterprise edition is not stated on the pages read for this post, and neither is a per-developer virtual key model, so those cells read "Not published." Kong's strength is API management breadth; Claude Code-specific concerns such as per-key MCP tool filtering and prompt-cache marker handling are not documented as first-class features.

4. Agent Router (formerly Envoy AI Gateway)

Best for: Kubernetes platform teams standardized on Envoy Gateway who want AI routing as CRDs in the same data plane.

Agent Router, documented as "formerly Envoy AI Gateway," is an Apache 2.0 project under the envoyproxy GitHub organization built on Envoy Gateway. It uses a two-tier design, with a first-tier gateway for authentication and global rate limiting. Supported providers include OpenAI, Azure OpenAI, Gemini, Vertex AI, AWS Bedrock, Mistral, Cohere, Groq, DeepSeek, and Anthropic, among others.

The project publishes an Anthropic-compatible surface at /anthropic/v1/messages and /anthropic/v1/messages/count_tokens, listed as fully supported with streaming and non-streaming responses across Anthropic, GCP Anthropic, AWS Anthropic, and AWS Bedrock upstreams. That satisfies the two protocol requirements Claude Code depends on most, and count_tokens gives /context exact counts.

The material read for this post does not describe a virtual key and budget model, per-key MCP tool governance, or a request log with cost accounting; those are recorded as not published. Agent Router is Kubernetes-native and inherits Envoy's operational model, which suits teams already there and adds weight for teams that want a single binary or container; Bifrost runs as either and ships a Kubernetes deployment guide.

5. Apache APISIX

Best for: Teams running Apache APISIX as their API gateway who want to add LLM load balancing and token rate limiting without introducing a second gateway.

Apache APISIX is an Apache Software Foundation project under the Apache 2.0 license. Its AI capabilities are plugins: ai-proxy transforms plugin configuration into a provider's request format, and ai-proxy-multi extends it with load balancing, retries, fallbacks, and health checks across openai, deepseek, azure-openai, aimlapi, anthropic, openrouter, gemini, vertex-ai, bedrock, and openai-compatible providers. The ai-rate-limiting plugin adds token-based limits with a limit_strategy of total_tokens.

The APISIX plugin documentation describes an OpenAI-style message array as the inbound shape and lists Anthropic as an upstream provider; it does not state that the Anthropic Messages format is accepted inbound, which is what Claude Code sends. That is the first thing a team should test. Virtual keys with budgets, MCP gateway behavior, and LLM-specific request logging are not described in the pages read for this post; teams that need them alongside Anthropic-format routing get all three in the Bifrost governance layer.

How to Configure Claude Code With an LLM Gateway

Configuring Claude Code with an LLM gateway takes two environment variables and, for MCP, one claude mcp add command. The values below are for Bifrost; every gateway in this list uses the same two variables, and only the base URL path and credential format change.

"env": {
  "ANTHROPIC_BASE_URL": "<http://localhost:8080/anthropic>",
  "ANTHROPIC_AUTH_TOKEN": "your-virtual-key",
  "ANTHROPIC_DEFAULT_HAIKU_MODEL": "claude-haiku-4-5",
  "ANTHROPIC_DEFAULT_SONNET_MODEL": "claude-sonnet-4-6"
}

Merge this env block into the most specific settings.json, remove any top-level model field that would override it, and restart Claude Code. With ANTHROPIC_AUTH_TOKEN, the virtual key travels in the Authorization: Bearer header, so no Anthropic account login is needed. Since Claude Code 2.1.212, Anthropic enforces additional request headers such as anthropic-version; the Claude Code guide lists the headers to allow under Settings > Client Settings in Bifrost if the allowed-header list is not already *.

To attach MCP tools through the same gateway:

claude mcp add --transport http bifrost <http://localhost:8080/mcp> \
  --header "Authorization: Bearer your-virtual-key" \
  --scope user

Run /mcp inside Claude Code and bifrost should show as connected with a tool count. The virtual key scopes which tools appear; gateway authentication also supports a browser-based OAuth 2.1 flow for interactive clients. The CLI agents overview covers the same pattern for Codex CLI, Gemini CLI, Cursor, and other agents.

Controlling Claude Code Cost Through the Gateway

Claude Code cost is driven by input tokens, and a gateway controls it from three directions: budgets that stop spend, prompt-cache handling that lowers the price of each turn, and MCP tool reduction that shrinks the prompt itself. All three show up in the gateway's request logs.

Budgets and rate limits. A per-developer virtual key with a monthly budget and a per-minute request limit is the baseline. In Bifrost, team and customer budgets sit above the key and model-level limits cap spend on expensive models; the governance resource page describes how the hierarchy maps onto an org chart. The per-team token governance guide for Claude Code walks through a concrete allocation.

Prompt caching. Claude Code attaches cache_control markers to system blocks and message entries, and Anthropic's compatibility guide states the failure mode plainly: a gateway that drops them produces no error, only high input_tokens with little cache activity. Bifrost forwards caller markers unchanged, and for clients that send none it can inject a marker on the first cacheable block per provider.

MCP tool overhead. Every connected MCP server adds its tool definitions to each request, and at 500 tools a single query can carry over a million input tokens. Bifrost Code Mode reduced that to roughly 83K tokens per query in the benchmark above, and the MCP gateway resource page summarizes the access-control side. The guide to connecting Claude Code to 500 MCP tools through one gateway covers the practical setup.

Frequently Asked Questions

What is the Claude Gateway?

"Claude apps gateway" is Anthropic's own self-hosted gateway, bundled in the claude binary and started with claude gateway --config gateway.yaml. It signs developers in through a corporate identity provider, forwards inference to Amazon Bedrock, Claude Platform on AWS, Google Cloud, Microsoft Foundry, or the Anthropic API, and relays OTLP telemetry. It is distributed inside the claude binary rather than as an open-source project, and it routes only to Claude upstreams, which is why it does not appear in this list.

How do I configure Claude Code with an LLM gateway?

Set ANTHROPIC_BASE_URL to the gateway's Anthropic-format endpoint and ANTHROPIC_AUTH_TOKEN to the credential it issued, in the env block of settings.json or through managed settings. For Bifrost the base URL is http://your-gateway:8080/anthropic and the token is a virtual key; the /mcp endpoint is added separately with claude mcp add.

What does a Claude Code router do?

A Claude Code router rewrites the model Claude Code asks for into a different provider or model before the request leaves the network. Community projects do only this on a developer's machine. A gateway does the same rewrite centrally through routing rules and adds the parts a local router lacks: server-side credentials, budgets, request logs, and failover shared by the whole team.

Can Claude Code use non-Claude models through an open source gateway?

Yes, with a caveat. Bifrost lets ANTHROPIC_DEFAULT_SONNET_MODEL point at any configured provider/model, including OpenAI and Gemini models, and /model openai/gpt-5.5 works mid-session. Anthropic states it does not support routing Claude Code to non-Claude models through any gateway, and Claude-specific server-side tools such as web search and computer use are only available on Claude models, so the pinned model must support the tool calling the workflow needs.

Does routing Claude Code through a gateway break prompt caching?

Only if the gateway strips cache_control markers, reorders the system array, or converts block-form content to plain strings. Claude Code's attribution block is stable for the lifetime of a conversation from version 2.1.181, so a gateway that forwards the request body unchanged preserves the cached prefix. Bifrost forwards markers as sent and never mutates the request it holds.

Try Bifrost Today

An open-source Claude Code gateway is a low-cost control point for a platform team: two environment variables per machine, and every request gains server-side credentials, a budget, a log entry, and a failover path. Bifrost covers the full checklist in one Apache 2.0 Go binary, from Anthropic-compatible routing to virtual key governance and an MCP gateway with Code Mode, and it does so at 11 microseconds of overhead. For a routing-first view of the same field, see the multi-model routing comparison of Claude Code gateways. To see how Bifrost fits a Claude Code rollout across your teams, book a demo with the Bifrost team.