Portkey became one of the best-known AI gateways by giving teams a single control plane for routing, observability, and guardrails across LLM providers. In 2026 it changed hands. Palo Alto Networks announced its intent to acquire Portkey on April 30, 2026, and the deal closed at the end of May. Portkey will now serve as the AI gateway for Palo Alto Networks' Prisma AIRS platform.
Palo Alto has said it will keep supporting existing and new Portkey customers, and for large enterprises that already use Prisma AIRS, the acquisition may be good news. For many engineering teams, though, it raises reasonable questions. Will pricing and packaging move toward a security-suite bundle? Will the roadmap favor Palo Alto's platform over neutral, developer-first features? And do you want a core piece of AI infrastructure controlled by a single security vendor?
If you are asking those questions, this guide compares the three strongest Portkey alternatives for teams that want control over their AI gateway.
What to look for in a Portkey alternative
Before comparing tools, it helps to be clear on what an AI gateway needs to do in production. The essentials are:
- An OpenAI-compatible API, so switching is a base-URL change rather than a rewrite.
- Multi-provider routing with fallbacks across OpenAI, Anthropic, Gemini, Bedrock, Azure, and self-hosted models.
- Cost controls: budgets, rate limits, and per-team or per-key usage tracking.
- Observability, ideally through open standards like OpenTelemetry and Prometheus rather than a proprietary dashboard alone.
- Guardrails and caching to reduce risk and spend.
- Self-hosting and deployment flexibility, including on-premises and air-gapped environments.
- Supply-chain safety. A gateway sees every prompt and every API key, so its dependency footprint is part of your attack surface.
- A license and governance model you can trust long term.
1. GoModel: best overall open-source Portkey alternative
GoModel is an MIT-licensed, open-source AI gateway written in Go. It ships as a single binary in a Docker image of roughly 17 MB and exposes an OpenAI-compatible API. It is built for teams that want a fast, auditable gateway they fully own, especially in regulated, on-premises, and air-gapped environments.
Why GoModel tops this list
The biggest difference is architecture. GoModel compiles to one static Go binary, with no Python runtime, no sprawling package tree, and no dependency resolution at install time. That matters more than ever: in March 2026, LiteLLM's PyPI distribution was hit by a supply-chain compromise, a reminder that a gateway holding all your provider keys is a high-value target. A single binary is far easier to audit, pin, scan, and ship into a locked-down network.
GoModel's feature set covers what most teams used Portkey for:
- Exact and semantic caching to cut latency and token spend
- A guardrails pipeline for filtering inputs and outputs
- Budget controls and usage tracking
- Prometheus metrics and OpenTelemetry, both included free in the MIT core
- An admin dashboard
- Per-provider-family translators, so each provider's API quirks are handled properly instead of being flattened
- A passthrough endpoint (
/p/{provider}/...) for when you need a provider's native API features
Enterprise and hosted options
GoModel follows a transparent open-core model. The core stays MIT, and enterprise features such as SSO, RBAC, audit logs, and multi-tenancy live in a visible /ee folder in the same public repository, so you can inspect what you are paying for. For teams that prefer not to run infrastructure, GoModel Cloud offers a hosted bring-your-own-key tier.
Best for: teams that want a vendor-neutral, self-hosted gateway with a minimal attack surface; regulated industries; on-prem and air-gapped deployments; Go and cloud-native shops.
Consider trade-offs: GoModel is a younger project than LiteLLM, so its community and third-party integration ecosystem are still growing.
2. LiteLLM: the most widely adopted option
LiteLLM is the best-known open-source LLM proxy and Python SDK. It supports a very large number of providers, and its proxy server offers virtual keys, budgets, rate limits, and logging integrations. The core is MIT-licensed, with enterprise features in a separate commercial subdirectory.
Strengths
- Very broad provider and model coverage
- Large community, with plenty of examples and integrations
- Works both as a Python library and as a standalone proxy
- Familiar to many ML and data teams already working in Python
Weaknesses
- Built on Python, which means a heavier runtime and a larger dependency tree than compiled gateways. The March 2026 PyPI compromise showed the real-world risk of that footprint for a component that handles every API key.
- At high throughput, a Python proxy generally needs more instances and tuning than a compiled Go or Rust gateway.
- The rapid release pace that gives LiteLLM its breadth can also make upgrades less predictable.
Best for: Python-centric teams that prioritize maximum provider coverage and community support, and that can invest in dependency pinning and supply-chain hardening.
3. TensorZero: best for LLM optimization workflows
TensorZero takes a different angle. It describes itself as an open-source stack that unifies an LLM gateway, observability, optimization, evaluation, and experimentation. The gateway is one part of a larger feedback loop for improving LLM applications over time.
Strengths
- Performance: the gateway is written in Rust, and the project reports under 1 ms of p99 latency overhead at 10k QPS.
- Optimization tooling: you can collect metrics and human feedback to optimize prompts, models, and inference strategies, and run built-in A/B tests with routing, fallbacks, and retries.
- Compatibility: it works with any OpenAI SDK or OpenAI-compatible client and deploys as a single Docker container.
Weaknesses
- TensorZero is opinionated. Getting its full value means adopting its configuration model and feedback workflow, which is more than a drop-in Portkey replacement.
- Teams that mainly need a governance and cost-control gateway may find it more framework than they need.
Best for: teams focused on systematically improving LLM quality through evaluations, experiments, and fine-tuning, and willing to build around its workflow.
Portkey alternatives compared
| GoModel | LiteLLM | TensorZero | |
|---|---|---|---|
| Language | Go | Python | Rust |
| License | MIT (open core) | MIT (open core) | Open source |
| Deployment | Single binary, ~17 MB image | Python package or proxy container | Docker container |
| OpenAI-compatible API | Yes | Yes | Yes |
| Caching | Exact and semantic | Yes | Yes |
| Guardrails | Built-in pipeline | Via integrations | Limited focus |
| Observability | Prometheus and OpenTelemetry (free) | Logging integrations | Built-in, database-backed |
| Air-gapped and on-prem fit | Excellent | Possible, heavier | Good |
| Supply-chain footprint | Minimal | Large | Small |
| Main focus | Secure, vendor-neutral gateway | Maximum provider coverage | LLM optimization loop |
How to choose
Pick GoModel if you want the closest thing to Portkey's gateway capabilities in a fully open, self-hosted package with a minimal attack surface, especially if you work in a regulated or air-gapped environment.
Pick LiteLLM if your team lives in Python, needs the widest provider coverage today, and is prepared to manage the supply-chain risk.
Pick TensorZero if your main goal is optimizing model quality through experiments and feedback rather than centralized governance.
Migrating from Portkey
Because all three alternatives expose OpenAI-compatible APIs, most migrations follow the same path. Deploy the new gateway alongside Portkey, point one non-critical service at it by changing the base URL, and compare latency, error rates, and cost. Then recreate your routing rules, fallbacks, and budgets, and move remaining services over gradually. With GoModel, the first step is typically a single docker run.
FAQ
What is the best Portkey alternative?
For most teams, GoModel is the strongest overall Portkey alternative: it is MIT-licensed, self-hosted, ships as a single Go binary, and covers routing, caching, guardrails, budgets, and observability.
Is there an open-source alternative to Portkey?
Yes. GoModel, LiteLLM, and TensorZero are all open-source AI gateways you can self-host.
Who owns Portkey now?
Palo Alto Networks completed its acquisition of Portkey and plans to make it the core AI gateway for its Prisma AIRS security platform.
Which AI gateway is best for air-gapped or on-premises deployments?
GoModel is designed for these environments. A single binary with no runtime dependency installation is simpler to scan, approve, and move across network boundaries.
Can I switch from Portkey without rewriting my code?
In most cases, yes. All three alternatives support the OpenAI API format, so switching usually means updating your base URL and keys, then recreating your routing configuration.
Try GoModel: get started at gomodel.enterpilot.io.
Top comments (0)