# Four self-hosted AI gateways: LiteLLM, Portkey, Kong and Agent Router

Compare four self-hosted gateway options through exact editions, data paths, policies, operating actions and complete maintenance responsibilities.

Author: Retrivium team
Updated: 2026-11-01
Canonical URL: https://retrivium.ai/journal/top-self-hosted-ai-gateways/
Language: en

An owned AI gateway can centralize model access, policy and accounting before external providers or private endpoints. It is useful when the team can maintain another component and understands the boundaries it wants to control.

This selection was checked on November 1, 2026. The editorial order moves from a common LLM interface to wider traffic governance, not speed. Open code, local installation and enterprise functionality are considered separately.

## LiteLLM and Portkey for a common interface

[LiteLLM Proxy](https://docs.litellm.ai/docs/simple_proxy) is a self-hosted server for model executors. Test it for shared keys, restrictions and routes across applications. Database, observation and update costs depend on architecture.

[Portkey Gateway](https://github.com/Portkey-AI/gateway) has an official repository and self-hosted options. Current documentation uses Prisma AIRS AI Gateway. Fix the version and do not transfer every managed-service feature to an arbitrary local installation.

## Kong for shared API infrastructure

[Kong AI Gateway](https://developer.konghq.com/ai-gateway/) places AI-traffic governance within a broader architecture. It can interest teams with existing access and policy procedures. Describe the self-hosted data plane and its management as separate elements.

Check edition and licensed functions. Self-hosted does not promise free operation. Match required rules and maintenance capacity instead of selecting the longest feature list.

## Agent Router for Envoy-based infrastructure

[Agent Router](https://theagentrouter.ai/docs/) is the current name of the project formerly known as Envoy AI Gateway. The official page explicitly states the change. Both names connect familiar searches with the current project without implying every interface changed.

Check required target compatibility, configuration control and operating dependencies. A suitable framework does not remove testing of your request format. A capabilities catalog and a ready production route remain different project states.

## Compare the same operating scenario

For each candidate, add an executor, restrict a team, investigate an error and restore previous configuration. Record time and necessary components. These actions reveal the cost of control better than one successful call.

Map data paths separately. A local gateway can send input to an external model and logs to another service. Fully local claims must cover the whole arrangement, not one container's location. Preserve each installation's version and enabled components so similar names do not conceal different database, configuration-management or observation duties.

## Assessment notes

A gateway organizes access but does not create external demand. A pool still needs appropriate workloads, operations and a checked commercial path; funding should cover the chain.

Continue with [OpenRouter versus LiteLLM](/journal/openrouter-vs-litellm/) and [routing costs](/journal/token-router-total-cost/).