After my experience with Maxim AI, I decided to dig deeper. I wanted to see if this was just one sloppy payment dodge or part of a larger pattern. I researched the company, the product architecture, GitHub activity, public mentions, and compared it directly to the real Caveman alternative.
Here is the factual research — every claim below is verifiable as of April 27, 2026.
My Exact Experience (Documented Timeline)
- April 20: Matthew Jacob from Maxim AI offered paid deep-dives on AI gateways and MCP.
- April 23–25: Nakul (cc’d with Pranay) confirmed $60 payment, approved my outline, and asked me to complete full testing + article.
- April 25: I installed Bifrost gateway + CLI, added real provider configs, connected MCP, enabled Code Mode, routed Ollama/cloud models, launched coding agents, and delivered the complete draft.
- April 26: Sent draft + direct PayPal invoice (INV2-3VF2-A6GW-Z2EP-WFYH). They said they pay within 48 hours after publish.
- April 27 morning: “High priority issue… pausing all other activities including our collaboration.”
They got the full test + article for free and then ghosted.
Research on Maxim AI / H3 Labs Inc. / Bifrost
- Company: Operates as H3 Labs Inc. (Delaware registered entity). Website: getmaxim.ai. They position themselves as an enterprise GenAI evaluation + observability platform with Bifrost as their open-source LLM/MCP gateway.
- GitHub (maximhq/bifrost): 4.4k stars, 511 forks, 4,050+ commits, 86 contributors, Apache 2.0 license. Last commit was literally hours ago (April 27, 2026). Very active development. Claims “50x faster than LiteLLM” with <100 µs overhead at 5k RPS.
-
Product Model: Bifrost is designed to sit in the middle of your stack. You run
npx -y @maximhq/bifrost, open the dashboard at localhost:8080, and explicitly add your real OpenAI/Anthropic/Ollama keys. Every agent, MCP tool call, and request routes through their control plane. They get full logs, token usage, model selection, and project context. - Public Mentions: Mostly self-promoted blog posts on dev.to and LinkedIn from Maxim team members or affiliates. Some positive Reddit threads about performance, but zero independent long-term reviews from solo American devs who routed real paid keys through it for weeks. No widespread scam reports yet — but the pattern matches classic harvesting plays.
This is not “just open source infrastructure.” It is built to become the single point where your keys and traffic live.
How This Architecture Enables API Key Harvesting
- Targeting Method: They DM American indie devs on X, LinkedIn, and dev.to offering tiny “paid collaborations” ($50–$60). American devs = real paid API credits + daily agent usage.
- Key Collection: The entire onboarding flow requires you to hand over keys to their gateway/CLI/dashboard.
- Post-Work Pause: Once testing + article is done, they “pause” and keep the data/traffic logs without paying.
- Scale Play: One $60 blog post = free testing from a real dev + fresh keys + usage data they can analyze or resell quietly.
Even if they are a “real” startup today, the business model incentivizes exactly this behavior on American web devs who have the fattest API bills.
The Superior Alternative: Real Caveman (No Harvesting, No Middleman)
While dealing with Bifrost I switched back to Caveman — https://github.com/juliusbrussee/caveman
Research on Caveman:
- 47.3k stars on GitHub.
- Last major update April 15, 2026 (v1.6.0).
- Pure Claude Code / Codex skill + plugin.
- Works by making the agent “talk like caveman” — strips filler words, articles, and verbosity while keeping every technical detail.
- Claims + benchmarks: ~65–75% fewer output tokens, ~46% fewer input tokens.
- Zero infrastructure: One-line install, no gateway, no dashboard, no company collecting keys.
- Works with Claude, Codex, Gemini, Cursor, etc. Includes auto-hooks, compress tools, and specialized commands.
Direct Comparison:
- Bifrost: You give a company your keys → they control the pipe → they can pause and keep your data.
- Caveman: You install once locally → agent compresses its own output → 65%+ token savings with zero third-party access.
Caveman solves the exact problem Bifrost claims to solve (token bloat) at the agent level instead of inserting a middleman who wants your keys.
Final Researched Warning
The pattern is clear and repeatable:
- New AI gateway company → DMs American devs for “paid testing” → requires key routing → gets full access → does the work then “pauses collaboration.”
Maxim AI / H3 Labs / Bifrost fits this playbook exactly. Their GitHub is active and the product is real, but the freelance collaboration tactic combined with mandatory key routing makes it a high-risk API key harvesting vector for solo devs.
I already did the full work they requested. I have the notes, screenshots, commands, and draft.
If they do not honor the $60 invoice by the deadline they set, I will continue publishing the full factual story across multiple posts.
American indie web devs: stop being the free testing + key farm.
Caveman mode is the only honest way.
Stay safe.
Top comments (0)