TL;DR
- Routing Claude Code through your own infrastructure prevents API key sprawl, enforces per-developer budget caps, and prevents unmonitored source code exfiltration.
- Claude Code natively supports custom proxy routing through the
ANTHROPIC_BASE_URLandANTHROPIC_AUTH_TOKENenvironment variables without requiring binary patches. - Bifrost ranks as the top gateway for Claude Code due to its sub-millisecond Go architecture (11 microseconds overhead at 5,000 RPS), built-in MCP gateway, and zero-config CLI launcher.
- Alternative options such as LiteLLM, Kong AI Gateway, Cloudflare AI Gateway, and OpenRouter address specialized needs ranging from Python extensibility to managed edge caching.
- Combining a central control plane with Bifrost Edge ensures endpoint compliance on developer machines while keeping upstream credentials secure.
Engineering teams rolling out Claude Code across terminal and IDE environments face significant challenges around centralized API key distribution, unpredictable token consumption, and audit compliance. Claude Code operates as an agentic coding tool that autonomously inspects file trees, executes tests, and edits codebases. Because each terminal interaction exchanges complete repository contexts, prompt histories, and tool results, an active developer can easily generate tens of thousands of tokens per hour. Sending that unmonitored traffic directly to external endpoints exposes organizations to billing spikes, quota exhaustion, and confidential data leakage.
Bifrost, an open-source AI gateway written in Go by Maxim AI, provides a centralized proxy layer designed to govern and accelerate agentic traffic. By configuring Claude Code to route requests through an intermediary gateway, platform engineers gain complete observability into agent prompts, apply deterministic spending limits, and dynamically route tasks across enterprise-approved model providers. This guide examines the five best gateways for routing Claude Code through self-hosted or private infrastructure, detailing the architecture, latency overhead, and governance capabilities of each option.
Why Route Claude Code Through Your Own Infrastructure?
Claude Code communicates with the Anthropic Messages API by sending HTTP POST requests to /v1/messages. By setting the standard environment variables ANTHROPIC_BASE_URL and ANTHROPIC_AUTH_TOKEN, developers can redirect all outbound requests to a private gateway instead of Anthropic's public servers. Running this proxy layer inside corporate infrastructure resolves four primary operational challenges:
+------------------+ +----------------------------+ +------------------------+
| Claude Code | | Private AI Gateway | | Upstream Providers |
| (Terminal / IDE) | ------> | (Bifrost / Self-Hosted) | ------> | Anthropic / Bedrock |
| | | - Auth & Virtual Keys | | Vertex AI / Azure |
| ANTHROPIC_BASE_URL | - Budget & Token Capping | | |
+------------------+ | - MCP Tool Mediation | +------------------------+
+----------------------------+
- Credential Isolation and Virtual Keys: Rather than distributing production Anthropic API keys directly to developer laptops, administrators issue scoped virtual keys. The gateway injects the real provider secrets securely in-flight, preventing credential exposure in shell profiles or git commits.
- Deterministic Budget Enforcement: Agentic coding workflows can loop unexpectedly during complex debugging tasks. A gateway tracks token usage in real time, automatically terminating or throttling sessions that exceed assigned daily or monthly budgets.
- Multi-Provider Fallback and Routing: When primary API endpoints experience rate limits (HTTP 429) or cloud outages (HTTP 5xx), an intelligent gateway automatically fails over to identical Claude deployments hosted on Amazon Bedrock or Google Cloud Vertex AI without interrupting the developer's session.
- Tool and Context Security: Claude Code frequently leverages the Model Context Protocol (MCP) to interact with external databases, execution sandboxes, and file systems. Routing traffic through an intermediary proxy allows security teams to log tool executions, inspect file diffs, and sanitize source code before it leaves the internal network.
Key Evaluation Criteria for Claude Code Gateways
Routing traffic for interactive CLI agents introduces technical requirements that traditional web API gateways rarely handle. Selecting the correct gateway requires assessing how each tool manages high-throughput streaming, header preservation, and tool invocation protocols.
| Evaluation Dimension | Technical Requirement | Architectural Impact |
|---|---|---|
| Streaming Latency Overhead | Must add less than 1-2 milliseconds per request | Agentic tools depend on real-time Server-Sent Events (SSE). High gateway latency degrades the interactive terminal experience. |
| Protocol & Header Fidelity | Verbatim forwarding of anthropic-beta and custom headers |
Claude Code relies on custom headers to negotiate prompt caching, tool search, and session telemetry. Dropped headers cause API failures. |
| Multi-Provider Translation | Ability to map Anthropic Messages requests to Bedrock, Vertex, or custom endpoints | Allows teams to use enterprise cloud commitments (AWS Bedrock or GCP Vertex) while running the official Claude Code CLI. |
| Tool & MCP Mediation | Centralized hosting or proxying of Model Context Protocol servers | Consolidates MCP connections so individual developers do not need to configure local daemon processes. |
| Budget & Rate Controls | Fine-grained rate limits, user budgets, and request timeouts | Protects infrastructure from runaway agent loops and unexpected billing surprises. |
Beyond network traffic, organizations must address physical endpoints. While a central gateway governs configured traffic, unmanaged developer environments often suffer from shadow AI, where tools bypass proxy settings entirely. Beyond gateway routing, Bifrost applies governance and security controls centrally, and Bifrost Edge extends that same governance and security to AI traffic on employee machines, with endpoint enforcement on each device.
Claude Code Gateways Compared at a Glance
The following matrix compares the leading solutions for proxying and managing Claude Code across self-hosted and hybrid infrastructure:
| Gateway | Core Language | Proxy Overhead | Native Claude Code Support | Multi-Provider Failover | MCP Gateway Support | Deployment Model |
|---|---|---|---|---|---|---|
| Bifrost | Go | ~11 µs | Yes (Native /anthropic path + CLI) |
Yes (Anthropic, Bedrock, Vertex, 20+) | Yes (Agent & Code Mode) | Self-hosted, In-VPC, Air-gapped |
| LiteLLM | Python | 15-40 ms | Yes (Anthropic & OpenAI bridges) | Yes (100+ backends) | Partial (External scripts) | Self-hosted Docker / Kubernetes |
| Kong AI Gateway | Lua / C | 1-5 ms | Partial (Via AI Proxy plugins) | Limited (Basic upstream pools) | No | Self-hosted / Managed Cloud |
| Cloudflare AI Gateway | Rust / V8 | 15-50 ms | Yes (Universal endpoint rewrite) | Basic (Provider fallbacks) | No | Managed Edge |
| OpenRouter | Proprietary | 50-150 ms | Yes (Direct endpoint proxy) | Yes (Internal model routing) | No | Hosted SaaS |
1. Bifrost (Author's Top Pick)
Bifrost is an enterprise-grade, open-source AI gateway built specifically for high-throughput, low-latency agentic workloads. Developed in Go, Bifrost introduces an industry-leading overhead of just 11 microseconds at 5,000 requests per second in sustained benchmarks, ensuring that interactive agent workflows suffer zero human-perceptible lag.
# Terminal configuration for Bifrost
export ANTHROPIC_BASE_URL="http://localhost:8080/anthropic"
export ANTHROPIC_AUTH_TOKEN="bifrost-vk-prod-developer-01"
claude
Bifrost includes direct support for Claude Code out of the box. Its dedicated /anthropic routing endpoint implements complete protocol parity with Anthropic's Messages API, preserving streaming chunks, prompt caching markers, and custom telemetry headers such as x-claude-code-session-id. For enterprise deployments seeking to leverage existing cloud budgets, Bifrost automatically converts Anthropic schema calls into native AWS Bedrock or Google Vertex AI requests without requiring external translation daemons.
Native MCP Gateway and Tool Management
Agentic coding tools reach their full potential when connected to external systems, but configuring local MCP daemons on every engineer's machine creates configuration sprawl. Bifrost functions as a full MCP gateway, allowing platform teams to register tools centrally. Claude Code connects to Bifrost's single /mcp endpoint, which multiplexes access to internal databases, GitHub connectors, and file tools while enforcing strict authentication via MCP tool filtering.
+---------------+ Single Endpoint +------------------------------+
| Claude Code | -----------------------> | Bifrost Gateway |
| (CLI Agent) | /mcp Connection | - Auth & Permission Scopes |
+---------------+ +------------------------------+
| | |
v v v
+---------+ +---------+ +---------+
| GitHub | | Postgres| | Custom |
| Server | | Server | | Tools |
+---------+ +---------+ +---------+
Furthermore, the companion Bifrost CLI terminal utility eliminates manual configuration entirely. Executing npx @maximhq/bifrost-cli launches an interactive interface that discovers available models from your gateway, manages OS keyring credentials, and bootstraps Claude Code in a persistent workspace.
Key Capabilities of Bifrost
- Sub-Millisecond Execution: Built in Go with optimized memory allocation, adding only 11 µs of latency to inference streams.
- Provider Failover & Load Balancing: Configures automatic, zero-downtime fallbacks from Anthropic to Amazon Bedrock or Google Cloud Vertex AI if primary rate limits occur.
- Hierarchical Governance: Allocates virtual keys with granular spending budgets, rate limits, and model access policies across teams, projects, or individual engineers.
- Semantic Caching: Employs semantic caching to identify repetitive codebase questions, reducing token costs and accelerating response times.
- Enterprise Deployment Ready: Supports clustering, in-VPC deployments, and immutable audit logs required for SOC 2 and ISO 27001 compliance.
Best for: Engineering teams and regulated enterprises running mission-critical coding agents that demand the lowest possible latency overhead, comprehensive MCP tooling integration, and flexible on-premises or private cloud deployment.
2. LiteLLM Proxy
LiteLLM is an established, open-source proxy written in Python that translates between diverse LLM interfaces. Widely recognized for its broad provider catalog, LiteLLM allows developers to map Claude Code's Anthropic API requests to hundreds of alternative backends, including local models hosted on Ollama or vLLM.
# litellm config.yaml snippet
model_list:
- model_name: claude-3-7-sonnet
litellm_params:
model: bedrock/anthropic.claude-3-7-sonnet-20250219-v1:0
aws_region_name: us-east-1
LiteLLM supports Claude Code through standard base URL redirection and provides an enterprise SSO device authorization flow. When configured with an identity provider such as Okta or Microsoft Entra ID, developers can run an authentication handshake directly from the terminal, binding sessions to corporate identity directories.
Trade-Offs and Architectural Considerations
While LiteLLM offers unmatched translation flexibility, its underlying Python and asyncio runtime introduces noticeable performance overhead. Under sustained multi-user loads, proxy latency can range between 15 and 40 milliseconds per request, which can create micro-stutters during high-speed code generation streams. Additionally, managing Python dependency trees, memory overhead, and horizontal scaling in containerized clusters requires active maintenance from DevOps teams.
Best for: Python-centric development teams needing rapid model experimentation and universal protocol translation across a wide variety of secondary model providers.
3. Kong AI Gateway
Kong AI Gateway builds on the enterprise foundation of Kong Gateway, utilizing a high-performance OpenResty and Lua core. Organizations already using Kong for general API traffic can activate its AI Gateway capabilities by configuring specialized plugins such as ai-proxy, ai-prompt-guard, and ai-rate-limiting.
-- Example Kong AI Proxy configuration concept
plugins:
- name: ai-proxy
config:
route_type: "llm/v1/chat"
auth:
header_name: "x-api-key"
model:
provider: "anthropic"
name: "claude-3-7-sonnet-latest"
Kong handles high request volumes efficiently, adding minimal overhead (typically 1 to 5 milliseconds). It allows platform administrators to apply corporate security policies, firewalls, and mutual TLS (mTLS) to outbound AI calls alongside standard REST traffic.
Limitations for Agentic Workflows
Kong was originally designed for stateless API proxying rather than agentic tool mediation. It does not provide native MCP server discovery, session-aware agent tracing, or automated protocol adaptation between Anthropic's dialect and other cloud engines without custom Lua development. Configuring Kong for Claude Code requires managing complex declarative YAML topologies, making it better suited for centralized platform infrastructure than developer-focused environments.
Best for: Large enterprise organizations with substantial Kong API Gateway investments looking to fold AI agent traffic into existing API management platforms.
4. Cloudflare AI Gateway
Cloudflare AI Gateway operates as a fully managed edge proxy deployed across Cloudflare's global CDN locations. For distributed teams that do not want to manage self-hosted infrastructure, Cloudflare provides an accessible endpoint rewrite service that captures analytics, applies rate limits, and caches model outputs.
# Connecting Claude Code to Cloudflare AI Gateway
export ANTHROPIC_BASE_URL="https://gateway.ai.cloudflare.com/v1/{account_id}/{gateway_id}/anthropic"
export ANTHROPIC_AUTH_TOKEN="your-cf-gateway-token"
claude
Because Cloudflare intercepts traffic at the edge, it offers real-time dashboards detailing token counts, latency distributions, and regional usage patterns. The platform also provides simple fallback configurations to route around downstream provider downtime.
Environmental Constraints
Cloudflare AI Gateway runs entirely as a public SaaS product. Organizations operating within strict data-residency boundaries, regulated financial institutions, or teams requiring fully air-gapped on-premises deployments cannot deploy Cloudflare inside private VPC environments. Additionally, edge routing introduces round-trip network hops that can fluctuate based on regional ISP routing.
Best for: Distributed, remote-first development teams seeking zero-maintenance SaaS telemetry and caching without deploying private servers.
5. OpenRouter
OpenRouter is a hosted routing platform that unifies access to proprietary and open-weights models through a single billing account. While primarily used as a consumer and startup inference marketplace, OpenRouter provides an Anthropic-compatible routing endpoint that Claude Code can leverage.
# Connecting Claude Code through OpenRouter
export ANTHROPIC_BASE_URL="https://openrouter.ai/api/v1"
export ANTHROPIC_AUTH_TOKEN="sk-or-v1-your-openrouter-key"
export ANTHROPIC_MODEL="anthropic/claude-3.7-sonnet"
claude
OpenRouter handles automated failover between multiple hosted infrastructure providers (such as AWS, Azure, and independent GPU clouds), ensuring high uptime if Anthropic's primary API suffers regional rate throttling. It also provides transparent token pricing and straightforward crypto or credit card billing.
Enterprise Limitations
OpenRouter is a multi-tenant cloud service rather than private infrastructure. It lacks deep enterprise governance primitives such as Okta directory synchronization, private VPC peering, native Model Context Protocol proxying, and localized data loss prevention (DLP) guardrails. It is best treated as a flexible cloud router rather than an enterprise infrastructure gatekeeper.
Best for: Individual developers, consultants, and early-stage development shops wanting easy access to diverse model providers without managing infrastructure.
Technical Walkthrough: Configuring Claude Code with a Private Gateway
Configuring Claude Code to connect through your gateway infrastructure can be done using temporary shell variables, persistent configuration files, or dedicated CLI utilities.
Method 1: Persistent Configuration via settings.json
To make your gateway configuration persistent across all terminal sessions, edit the global Claude Code settings file located at ~/.claude/settings.json (macOS/Linux) or %USERPROFILE%\.claude\settings.json (Windows):
{
"env": {
"ANTHROPIC_BASE_URL": "https://gateway.internal.net/anthropic",
"ANTHROPIC_AUTH_TOKEN": "bifrost-vk-eng-team-4482",
"CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY": "1"
}
}
Note: If your gateway expects standard API keys rather than Bearer tokens, specify ANTHROPIC_API_KEY instead of ANTHROPIC_AUTH_TOKEN. If both variables exist, ANTHROPIC_AUTH_TOKEN takes precedence.
Method 2: Dynamic Shell Script Wrapper
For engineering teams working across multiple projects with isolated billing codes, creating a wrapper script ensures correct virtual key assignment:
#!/usr/bin/env bash
set -euo pipefail
# Project-specific gateway configuration
export ANTHROPIC_BASE_URL="https://bifrost.corp.local/anthropic"
export ANTHROPIC_AUTH_TOKEN=$(vault read -field=token secret/ai/claude-code)
export CLAUDE_CODE_MAX_OUTPUT_TOKENS="65536"
# Verify gateway connectivity before launching
if ! curl -sf "${ANTHROPIC_BASE_URL}/healthz" > /dev/null; then
echo "Error: AI Gateway unreachable at ${ANTHROPIC_BASE_URL}" >&2
exit 1
fi
exec claude "$@"
Method 3: Instant Launch with Bifrost CLI
The most streamlined approach for teams utilizing Bifrost is its dedicated command-line runner, which configures base URLs and security tokens automatically:
# Run Bifrost CLI without manual installation
npx -y @maximhq/bifrost-cli
The CLI inspects your gateway's /v1/models catalog, configures the environment, attaches centralized MCP servers, and launches Claude Code inside an integrated terminal session.
Managing Endpoint Governance with Bifrost Edge
While a centrally deployed gateway provides robust controls for servers, continuous integration pipelines, and obedient terminal environments, human developers frequently bypass proxy configurations. Developers might unset shell variables, use browser-based interfaces, or install separate desktop applications, recreating shadow AI risks inside corporate networks.
Bifrost Edge addresses this gap by extending gateway policies directly to developer workstations. Operating as a lightweight background agent on macOS, Windows, and Linux, Bifrost Edge automatically routes all AI traffic through the organization's central Bifrost control plane without requiring manual environment variable configurations.
+-------------------------------------------------------------------------+
| Developer Workstation |
| |
| +---------------+ +-----------------+ +---------------------------+ |
| | Claude Code | | Claude Desktop | | Cursor / IDEs | |
| +---------------+ +-----------------+ +---------------------------+ |
| \ | / |
| v v v |
| +-------------------------------------------------------------+ |
| | Bifrost Edge | |
| | - Silent transparent routing (No manual proxy configs) | |
| | - Local app & MCP server discovery | |
| | - Device-level allow/deny policy enforcement | |
| +-------------------------------------------------------------+ |
+------------------------------------|------------------------------------+
| Encrypted Corporate Egress
v
+-----------------------------+
| Bifrost AI Gateway |
| - Virtual Keys & Budgets |
| - Guardrails & Auditing |
+-----------------------------+
How the Combined Architecture Works
- Central Policy Engine: Platform administrators configure virtual keys, rate limits, model routing rules, and guardrails within the Bifrost AI gateway.
- Endpoint Extension: Bifrost Edge, currently in alpha, installs via enterprise Mobile Device Management (MDM) platforms such as Jamf, Microsoft Intune, or Kandji.
-
Transparent Interception: The agent intercepts outgoing requests from Claude Code, Claude Desktop, and IDE agents, applying corporate policies even if a developer clears their
ANTHROPIC_BASE_URL. - Fleet MCP Visibility: Edge discovers unmanaged MCP servers configured across local environments, providing administrators with an approval catalog through MCP governance to block unauthorized tools before execution.
Frequently Asked Questions
What environment variables are required to route Claude Code through a gateway?
Claude Code primarily requires ANTHROPIC_BASE_URL pointing to your gateway instance (for example, http://localhost:8080/anthropic) and ANTHROPIC_AUTH_TOKEN containing your gateway virtual key. You can also configure CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY=1 to allow Claude Code's internal /model picker to query models directly from the gateway's /v1/models endpoint.
Does routing Claude Code through an AI gateway break streaming?
No, provided the gateway properly supports HTTP Server-Sent Events (SSE). Claude Code depends on real-time streaming tokens to provide an interactive user experience. High-performance gateways like Bifrost pass SSE chunks through without buffer delays, preserving prompt caching tokens and sub-second terminal rendering.
Can I route Claude Code to Amazon Bedrock or Google Vertex AI?
Yes. Gateways such as Bifrost and LiteLLM natively translate Anthropic Messages API schemas into Amazon Bedrock or Google Cloud Vertex AI formats. This capability allows teams to use the standard Claude Code CLI while drawing down enterprise cloud commitments on AWS or GCP.
How does an AI gateway handle Model Context Protocol (MCP) traffic?
Standard gateways ignore MCP traffic because MCP operates over local STDIO or separate SSE/HTTP streams. However, advanced gateways like Bifrost feature dedicated MCP gateways that multiplex multiple backend tool servers into a unified /mcp endpoint, giving security teams visibility into tool invocations and file access.
Why not use a standard reverse proxy like NGINX for Claude Code?
While NGINX can forward basic HTTP traffic, it lacks LLM-specific capabilities such as token counting, dynamic streaming body inspection, multi-provider rate-limit retries, semantic caching, and virtual key budget enforcement. A dedicated AI gateway provides operational visibility tailored to generative inference.
How do I stop developers from bypassing the gateway?
Developers can easily unset shell variables in local environments. To guarantee compliance, organizations deploy endpoint governance tools such as Bifrost Edge, which transparently directs all desktop and terminal AI traffic through the company's central gateway using system-level routing.
Final Recommendation
Routing Claude Code through your own infrastructure provides essential control over API spending, operational reliability, and source code privacy. While hosted tools like Cloudflare AI Gateway and OpenRouter offer fast setup for lightweight use cases, enterprise development environments require deep protocol fidelity, robust security guardrails, and negligible proxy overhead.
Bifrost stands out as the premier gateway for Claude Code. Its Go-based architecture introduces an imperceptible 11 microseconds of overhead, its integrated MCP gateway streamlines tool deployments, and its virtual key system enforces rigorous budget attribution. For teams scaling agentic coding across their engineering fleet, Bifrost pairs performance with enterprise-grade governance.
Teams evaluating gateway options can request a Bifrost demo or explore the project directly in the open-source repository.
Top comments (0)