What does the Palo Alto Networks acquisition of Portkey mean for buyers?

Palo Alto Networks announced it had completed the acquisition on 29 May 2026 and sells the product as Prisma AIRS AI Gateway, positioned as the enforcement point for agent traffic inside its AI security platform. Existing capabilities continue, but the roadmap now follows a security vendor. The MIT gateway repository remains public, though its commit activity has slowed since mid-2026. If you depend on the open-source core, check its activity yourself. Write data-portability and exit terms into any new contract.

Is LiteLLM still safe to run in production after its 2026 security incidents?

It can be, if you run it like critical infrastructure. In March 2026, malicious PyPI versions 1.82.7 and 1.82.8 were published, reportedly after attackers obtained credentials through a compromised CI dependency; they were removed from PyPI. In October 2026, a master key left unrevoked led to a hijacked release pipeline and a malicious 1.107.0 on PyPI, Docker Hub and GHCR, live for about two hours before being pulled. The controls apply to any self-hosted gateway: pin exact versions and image digests, pull from an internal mirror, keep the gateway's provider keys in a secrets manager, and rotate them after any suspected exposure.

Do we need a separate MCP gateway?

Not necessarily. LiteLLM, Portkey and Kong now govern MCP traffic in the same product as LLM traffic, with per-team or per-tool access control and OAuth. Cloudflare handles it in a separate Zero Trust product (MCP server portals). A dedicated MCP gateway is worth evaluating only if you need finer per-tool policy, or identity integration, than your LLM gateway provides.

Should we enable semantic caching?

Be selective. Semantic caches return a stored answer for a similar prompt above a similarity threshold. That works for repetitive single-shot queries (FAQ bots, classification) but is risky for agentic or personalised traffic. LiteLLM's own docs warn it can go badly wrong on agentic workloads. Start with exact-match caching, which is the only mode Cloudflare offers, and enable semantic caching per route after measuring hit rate and answer quality.

LLM Gateway Comparison: LiteLLM vs Portkey vs Kong AI Gateway vs Cloudflare AI Gateway

Once you have decided to put a gateway in front of your LLM traffic, the choice comes down to who runs it and what you already own. LiteLLM is the default open-source, self-hosted option. Portkey, now part of Palo Alto Networks as Prisma AIRS AI Gateway, is the governance-heavy managed option. Kong AI Gateway extends an API-management platform you may already run. Cloudflare AI Gateway is a managed edge service with near-zero setup. 2026 changed the field: one vendor was acquired, one shipped compromised releases twice, and all four now pitch MCP governance. Choose on operating model and security posture, not feature checklists.

Last reviewed: 2026-11-08

What we're comparing

LiteLLM
Open-source (MIT core) proxy and SDK from BerriAI that exposes 100+ providers behind an OpenAI-compatible API. Self-hosted; paid Enterprise license adds SSO, audit logs and support.
Portkey
AI gateway with built-in observability, guardrails, prompt management and an MCP gateway. Acquired by Palo Alto Networks (completion announced May 2026) and now sold as Prisma AIRS AI Gateway. MIT-licensed open-source gateway core.
Kong AI Gateway
AI capabilities (multi-provider proxy, semantic cache, guardrails, MCP proxy) delivered as plugins on Kong Gateway. Managed via Konnect or self-hosted; key AI plugins (semantic cache, PII sanitizer, MCP proxy) are Enterprise-only.
Cloudflare AI Gateway
Managed gateway running on Cloudflare's edge. Caching, rate and spend limits, DLP, guardrails and logging configured from the Cloudflare dashboard. No self-host option.

Side-by-side

Attribute	LiteLLM	Portkey	Kong AI Gateway	Cloudflare AI Gateway
Deployment model	Self-hosted proxy (you run it, plus Postgres / Redis for keys, spend and caching); air-gapped option on Enterprise	Managed SaaS, hybrid (data plane in your network, SaaS control plane), or private enterprise deployment; OSS gateway self-runs via npx / Docker	Konnect control plane with self-managed or Kong-hosted data planes, or fully self-managed Kong Gateway	Managed only, on Cloudflare's network
License & 2025-26 changes	MIT outside the enterprise/ directory; Enterprise license for paid features. Malicious PyPI releases in Mar 2026 (1.82.7-1.82.8) and Oct 2026 (1.107.0 plus Docker images)	Gateway repo MIT. Palo Alto Networks announced completion of the acquisition on 29 May 2026; product rebranded Prisma AIRS AI Gateway	Kong Gateway core Apache 2.0, but 3.10+ builds need a license (community reports 3.9 as last OSS image); AI semantic cache, PII sanitizer and MCP proxy are Enterprise	Proprietary service
Routing, fallback, load balancing	Load balancing across deployments, retries, fallbacks	Fallbacks on chosen error types, retries with backoff, weighted load balancing, conditional routing	Multi-provider load balancing with failover to another provider or model	Dynamic routes with conditional flows, percentage traffic splits, model fallback
Caching	Exact-match (Redis / Valkey, S3, GCS, local) and semantic (Redis, Valkey, Qdrant)	Simple cache in OSS; semantic cache on hosted / enterprise	AI Semantic Cache plugin (Enterprise) on Redis / Valkey or pgvector	Exact-match only; semantic caching stated as planned
Cost controls	Virtual keys with budgets and rate limits per key / team / user; spend tracking by key, team, user, tag	Virtual keys, budget limits, cost tracking	AI Rate Limiting Advanced; token quotas and budgets per consumer group	Request rate limiting; spend limits by provider, model or metadata over daily / weekly / monthly windows
Guardrails & PII	Request / response guardrails incl. PII masking via built-in and third-party integrations	40+ built-in checks plus BYO; PII redaction listed as enterprise	Prompt Guard, Semantic Prompt / Response Guard, AI Sanitizer for PII (Enterprise); AWS Guardrails, Azure Content Safety, GCP Model Armor integrations	Guardrails moderating prompts and responses; DLP scanning of prompts and responses
Observability	Admin UI logs; callbacks to OpenTelemetry, Langfuse, Datadog, Prometheus	Built-in dashboards and request logs; OTLP ingest; gateway OTel export is experimental (enterprise / self-hosted)	GenAI OTLP spans and metrics across LLM, MCP and A2A traffic; audit logs; Konnect dashboards	Request logs with retention, Logpush, OTLP trace export (JSON or protobuf)
MCP gateway	Built into proxy: per key / team / org server permissions, OAuth 2.0, HTTP / SSE (stdio opt-in)	MCP Gateway: central auth, team / user access control, per-call logging, identity forwarding	AI MCP Proxy (Enterprise, 3.12+): proxies MCP servers, converts REST APIs to MCP tools, per-tool ACLs (3.13+), OAuth2	Not in AI Gateway; separate MCP server portals in Cloudflare One (Zero Trust) with Access SSO and per-tool allowlists
SSO / RBAC	SSO / SAML, SCIM and audit logs on Enterprise license	SSO and hierarchical RBAC	Konnect teams / roles with IdP group mapping; RBAC with OIDC group mapping in self-managed Kong Manager	Gateway auth tokens; dashboard access through your Cloudflare account

When to use which

Use LiteLLM
You need the gateway inside your own perimeter (on-prem, air-gapped, sovereign cloud) and have a platform team to run it. Treat it as supply-chain-critical software: pin versions and image digests, mirror artifacts internally, and isolate its credentials.
Use Portkey
You want managed governance, observability and guardrails without building them, and a security-vendor roadmap fits your stack. Especially natural if you already buy Palo Alto Networks; confirm post-acquisition pricing, deployment options and OSS roadmap before signing.
Use Kong AI Gateway
You already run Kong for API management and want LLM, MCP and A2A traffic under the same policy, identity and observability model. Budget for Enterprise licensing: semantic cache, PII sanitizer and MCP proxy require it.
Use Cloudflare AI Gateway
You already use Cloudflare, want caching, spend limits and logs in minutes, and can accept a managed-only service. Pair with MCP server portals in Cloudflare One for agent tool access.

FAQs

What does the Palo Alto Networks acquisition of Portkey mean for buyers?
Palo Alto Networks announced it had completed the acquisition on 29 May 2026 and sells the product as Prisma AIRS AI Gateway, positioned as the enforcement point for agent traffic inside its AI security platform. Existing capabilities continue, but the roadmap now follows a security vendor. The MIT gateway repository remains public, though its commit activity has slowed since mid-2026. If you depend on the open-source core, check its activity yourself. Write data-portability and exit terms into any new contract.
Is LiteLLM still safe to run in production after its 2026 security incidents?
It can be, if you run it like critical infrastructure. In March 2026, malicious PyPI versions 1.82.7 and 1.82.8 were published, reportedly after attackers obtained credentials through a compromised CI dependency; they were removed from PyPI. In October 2026, a master key left unrevoked led to a hijacked release pipeline and a malicious 1.107.0 on PyPI, Docker Hub and GHCR, live for about two hours before being pulled. The controls apply to any self-hosted gateway: pin exact versions and image digests, pull from an internal mirror, keep the gateway's provider keys in a secrets manager, and rotate them after any suspected exposure.
Do we need a separate MCP gateway?
Not necessarily. LiteLLM, Portkey and Kong now govern MCP traffic in the same product as LLM traffic, with per-team or per-tool access control and OAuth. Cloudflare handles it in a separate Zero Trust product (MCP server portals). A dedicated MCP gateway is worth evaluating only if you need finer per-tool policy, or identity integration, than your LLM gateway provides.
Should we enable semantic caching?
Be selective. Semantic caches return a stored answer for a similar prompt above a similarity threshold. That works for repetitive single-shot queries (FAQ bots, classification) but is risky for agentic or personalised traffic. LiteLLM's own docs warn it can go badly wrong on agentic workloads. Start with exact-match caching, which is the only mode Cloudflare offers, and enable semantic caching per route after measuring hit rate and answer quality.

We re-review comparisons as tools and pricing move. One practical GenAI note per month, plus alerts on material changes. Unsubscribe anytime.

Related comparisons

Framework dimensions

Free tools

Whitepapers

LLM Cost Optimization Patterns

Next steps

Take the assessment— See where you stand

For developers

Call this framework and its tools from your own agent via the Model Context Protocol (MCP) server. Works with Claude Desktop, Cursor, Zed, Continue, and the OpenAI Agents SDK.