Which vendors offer a managed SaaS control plane, self-hosted or hybrid agent gateway?

As of October 27, 2026: fully managed — Cloudflare AI Gateway (core features free, DLP scanning free) and AWS Bedrock AgentCore Gateway (pay per API call); self-hosted — LiteLLM (open-source AI gateway, Enterprise licence adds SSO and audit logs in your VPC) and agentgateway (Apache 2.0, LLM, MCP and A2A traffic in one binary, v1.6.0); hybrid, with a SaaS control plane and data planes you run — Kong Konnect (Plus from $25 a month plus usage) and Portkey Enterprise (private cloud and VPC deployment options).

What is a hybrid agent gateway?

A hybrid gateway splits the control plane from the data plane. The vendor hosts the console where you configure routes, policies, keys and budgets; the gateway processes that actually carry prompts, tool calls and responses run in your own cloud or data centre. Prompts never pass through the vendor, but you do not operate the management layer yourself.

Should I self-host my LLM or MCP gateway?

Self-host when prompts and tool results must stay inside your network, when you need to route to on-premise models, or when request volume makes per-request SaaS pricing expensive. Choose managed when a small team needs caching, rate limits and logs today without running infrastructure. Hybrid is the usual compromise for regulated enterprises.

Does an agent gateway handle MCP and A2A, or only LLM calls?

It depends on the product. agentgateway, Kong's AI gateway and AWS AgentCore Gateway handle MCP tool traffic as well as model calls, and agentgateway and Kong also cover agent-to-agent (A2A) traffic. LLM-first gateways such as LiteLLM, Portkey and Cloudflare AI Gateway focus on model routing, caching, budgets and logs.

Quick Answer

Managed vs Self-Hosted vs Hybrid Agent Gateway Vendors

Published: October 27, 2026

The short answer

Decide where prompts are allowed to flow first; the vendor follows. Agent gateway vendors by deployment model, as of October 27, 2026:

Managed SaaS: Cloudflare AI Gateway (cheapest start — core features free) and AWS Bedrock AgentCore Gateway (best if agents run on AWS).
Self-hosted: LiteLLM (best open-source LLM gateway, with an Enterprise licence for SSO and audit) and agentgateway (best open-source gateway for LLM, MCP and A2A traffic together).
Hybrid (vendor-hosted control plane, your data plane): Kong Konnect (best for teams that already run Kong for APIs) and Portkey Enterprise (best for guardrails and prompt management with private deployment).

For the narrower question of which gateway to use for model routing alone, see our best LLM gateway ranking.

The comparison

Prices and versions from vendor pages and GitHub on October 27, 2026.

Vendor	Deployment	Traffic covered	Price	Best for
Cloudflare AI Gateway	Managed SaaS	LLM calls (caching, rate limits, DLP, logs)	Core features free on all plans; logs per Workers Logs pricing	Fast start, global edge
AWS AgentCore Gateway	Managed (AWS)	Tools, models and other agents; MCP	Consumption-based per API call, search query and indexed target	Agents already on AWS
LiteLLM	Self-hosted (open source)	100+ LLM APIs, budgets, keys, guardrails	Open source free; Enterprise licence by quote (SOC 2 Type II)	Platform teams, VPC-only data
agentgateway	Self-hosted (Apache 2.0, v1.6.0)	HTTP/gRPC services, LLM, MCP, A2A	Free	One data plane for services and agents
Kong Konnect	Hybrid (SaaS control plane, your gateways)	LLM, MCP and A2A traffic plus APIs	Plus from $25/month plus usage; Enterprise custom	Existing Kong or API-management estates
Portkey	Managed, or hybrid/private on Enterprise	LLM routing, guardrails, prompts, logs	Developer free (10k logs/month); Production $49/month; Enterprise custom	Guardrails and prompt management

Managed SaaS: start in an afternoon

Cloudflare AI Gateway sits in front of OpenAI, Anthropic, Google, Workers AI and others with one line of code. Analytics, caching and rate limiting are free on all plans, and DLP scanning is free too; accounts that created their first gateway on or after September 24, 2026 store logs in Workers Logs and pay its rates. AWS AgentCore Gateway lets agents reach tools, models and other agents through one governed endpoint, with no upfront commitment: you pay for operations such as listing and invoking tools, search queries and indexed targets, and AgentCore Policy checks each tool call against your rules. The trade-off for both is that every prompt passes through the vendor’s infrastructure.

Self-hosted: prompts never leave

LiteLLM is the most widely deployed open-source LLM gateway (about 62,000 GitHub stars, release v1.106.4 on October 25, 2026). The open-source gateway gives virtual keys, budgets, fallbacks and cost tracking; LiteLLM Enterprise is a licence key on the same image that adds SSO/SCIM, audit logs, delegated admin and support, aimed at organisations with 100+ users or 10+ production AI use cases. agentgateway (Apache 2.0, a Linux Foundation project) is the newer option built for agent traffic: one binary routes services, LLM providers, self-hosted inference, MCP servers and A2A calls, with mTLS, OIDC, token budgets and an audit trail of tool invocations.

Hybrid: the enterprise compromise

Kong Konnect runs the control plane as a service — configuration, developer portal, analytics — while the gateways themselves run in your clusters, so traffic stays local. Its AI Management plan covers LLM, MCP and A2A traffic from $25 a month plus usage, with a 30-day free trial; Enterprise adds agent identity management and runs workloads “everywhere”. Portkey is SaaS by default; its Enterprise tier adds private cloud deployment, VPC hosting, data isolation, custom BAAs and SSO, which is the hybrid path for regulated teams that want Portkey’s guardrails.

How to choose

Small team, no data-residency rule: Cloudflare AI Gateway, then add Portkey Production if you need guardrails.
All agents on AWS: AgentCore Gateway with AgentCore Policy.
Prompts must stay in your VPC, platform team available: LiteLLM for models plus agentgateway for MCP and A2A.
Regulated enterprise with an API-management team: Kong Konnect hybrid.
Governing agents from many vendors, not just traffic: pair the gateway with a control plane; see best AI agent control planes and API gateway vendors extending into agent governance.

Last verified: October 27, 2026.