AI gateway vs Arcjet
An AI gateway is a proxy between your applications and model providers. It routes, caches, and meters model calls, holds provider keys, and applies guardrails to the prompts and responses that pass through it. Arcjet is an AI agent runtime security platform that enforces policy in the path of the action itself: inside your code for custom agents, and in the hooks that Claude Code, GitHub Copilot, Cursor, and OpenAI Codex already fire. The key difference between an AI gateway and Arcjet is what each one sees. An AI gateway sees model traffic, including the tool calls a model proposes. Arcjet sees the tool call, prompt, or model switch with the arguments that will run, and decides before it runs. Choose an AI gateway to govern model traffic, choose Arcjet to decide whether an agent's action runs, and run both when you need model governance and action-level enforcement.
Arcjet publishes this comparison. Competitor details come from Cloudflare's, Kong's, Portkey's, and LiteLLM's public documentation, reviewed on September 25, 2026.
This page covers the category. For vendor-specific detail, see Arcjet vs Portkey, Arcjet vs LiteLLM, Arcjet vs Kong AI Gateway, and Cloudflare vs Arcjet.
AI gateway vs Arcjet at a glance
Arcjet differs from an AI gateway in three ways: where it enforces, what it sees, and which functions it offers. The following table compares the two approaches on those points. The AI gateway column describes the category as documented by Cloudflare AI Gateway, Kong AI Gateway, Portkey, and LiteLLM. Individual gateways differ, and the vendor pages have the detail.
| Area | AI gateway | Arcjet |
|---|---|---|
| Where it enforces | On traffic routed through the proxy: model requests and responses, and MCP or agent-to-agent calls when you route those through it too | In the path of the action: in your code before a tool call runs, and in the hooks that coding agents fire before a tool call, prompt, or model switch |
| Coding agents | Point the agent's model base URL at the gateway for credentials, budgets, logging, and prompt scanning | One policy across Claude Code, GitHub Copilot, Cursor, and OpenAI Codex, evaluated before each shell command, file access, URL fetch, or MCP call. Installed through managed settings or MDM |
| Custom agents | Route model calls from your application through the gateway | JavaScript, TypeScript, Python, and Go SDKs. |
| Tool calls | Sees the tool calls a model proposes in its response. Execution happens elsewhere | Decides at the call site, with the arguments that will run, before the side effect |
| Model routing, caching, and failover | Core function | Not offered. Arcjet isn't a proxy |
| Provider key management | Core function | Not offered |
| Budgets | Spend and token limits per key, team, or metadata dimension | Token and spend budgets, and rate limits keyed on any value you pass |
| Prompt injection | Varies by gateway; LiteLLM integrates partner guardrails such as Lakera | Built-in detector for custom agents and for coding-agent prompts |
| Sensitive information | PII detection or redaction on prompts and responses | SDK-local detection keeps the raw body in your process; a server-side detector covers coding-agent prompts |
| Destination threat intelligence | Not documented by the four gateways reviewed | Scores each host an agent is about to contact against Arcjet threat intelligence |
| Web app security | Not in scope for an AI gateway | Bot detection, rate limiting, Shield WAF, email validation, and signup form protection |
What does an AI gateway do?
An AI gateway, sometimes called an LLM proxy, sits between application code and one or more model providers. Applications send model requests to the gateway instead of to the provider, and the gateway forwards them. Because every routed request passes through one place, an AI gateway can apply the following controls:
- Routing and resilience. One API across multiple providers, with load balancing, retries, and fallback to another model. Portkey documents fallbacks and load balancing, Cloudflare documents dynamic routing, and Kong documents AI Proxy Advanced.
- Caching. Cloudflare can serve repeated requests from cache, and Kong and Portkey document semantic caching (Kong, Portkey).
- Provider keys. The gateway stores provider credentials and issues its own scoped keys. LiteLLM calls these virtual keys, and Cloudflare documents bring your own keys.
- Budgets and rate limits. Cloudflare spend limits block requests with a
429response after cumulative spend reaches a limit, scoped by model, provider, or metadata such as user or team. Kong's AI Rate Limiting Advanced plugin limits by token count or cost. - Guardrails on prompts and responses. Cloudflare Guardrails evaluate prompts and responses for harmful content, and DLP scans them for sensitive data. LiteLLM runs guardrails before the call, during it, or after it, with integrations such as Lakera, Presidio, and AWS Bedrock.
- Logging and cost attribution. Every routed request is logged with its model, tokens, latency, and cost.
Three of the four gateways reviewed also extend the same proxy model beyond model calls. Portkey, LiteLLM, and Kong each document an MCP gateway and an agent-to-agent (A2A) gateway: Portkey Agent Gateway, LiteLLM Agent Gateway, and Kong A2A support.
An AI gateway is a good place for model routing, provider keys, and model spend controls, because every routed model call passes through it. The Arcjet learning center covers where the gateway fits in a layered design in AI agent security architecture.
What doesn't an AI gateway see?
An AI gateway governs only the traffic routed through it, so it doesn't see four kinds of agent activity: tool execution, coding-agent actions on a developer's machine, unrouted MCP and A2A traffic, and calls that bypass the gateway. These limits follow from the proxy design rather than from any one product.
Tool calls the agent executes
A model doesn't run tools. It returns a proposed tool call, and the agent's own code or runtime executes it. An AI gateway sees the proposal in the model response, but not whether the tool runs, whether application code changes the arguments first, or what the tool touches.
LiteLLM documents this boundary directly: its Tool Permission Guardrail applies allow and deny rules to the tool calls a model is allowed to invoke, by filtering the request or rewriting the response. A tool that runs in a background job after the model call, or a deterministic tool with no model call at all, never reaches the gateway.
Coding agent actions on the developer's machine
Claude Code, GitHub Copilot, Cursor, and OpenAI Codex run shell commands, read and write files, fetch URLs, and call MCP servers from the developer's laptop or a cloud sandbox. Gateways integrate with coding agents by changing the agent's model endpoint. For example, Kong's guide points ANTHROPIC_BASE_URL at the gateway, and Cloudflare lists observability, caching, rate limiting, cost tracking, and DLP as the benefits of routing a coding agent through AI Gateway.
Routing a coding agent through a gateway governs the model request. The four gateways' public documentation doesn't describe evaluating a local rm -rf, a read of ~/.aws/credentials, or a git push --force before it runs, because those actions don't leave the machine as model traffic.
Agent-to-agent and MCP traffic that isn't routed
An MCP gateway or A2A gateway covers the servers and agents that you register with it and route through it. A developer who adds a local MCP server to their editor, or an agent that calls another agent directly, is outside that path. For more information about finding MCP servers that no one registered, see rogue MCP server detection.
Calls that bypass the gateway
An AI gateway's coverage depends on every client using the gateway's endpoint. A script with a direct provider key, a developer signed in to a personal Claude or ChatGPT account, or an application that someone configured before the gateway existed sends model traffic straight to the provider. Enforcing the route takes egress controls and credential discipline in addition to the gateway.
How Arcjet enforces in the path of the action
Arcjet evaluates each action where the action happens, in your code or in the coding agent's hook, rather than on the network. Arcjet has no proxy to route through and no endpoint to keep every client pointed at.
- Coding agents. Arcjet enforces policy on Claude Code, GitHub Copilot, Cursor, and OpenAI Codex through the hooks each agent already fires, with no SDK and no code change. One policy covers all four. Each policy runs on a tool call, a prompt, or a model switch, and decides before the action runs. Twelve starter policies cover destructive commands, rewriting git history, protected paths, credential access, piped installers, an MCP server allowlist, an egress allowlist, destination threats, a model allowlist, sensitive information, prompt injection, and
npm publish. Administrators install the hooks through managed settings or MDM, so developers can't remove them without admin access. For more information, see how to secure AI coding agents. - Custom agents. The JavaScript, TypeScript, Python, and Go SDKs call
guard()at the tool call, queue consumer, or MCP handler, with the arguments that will run. Arcjet has integrations for 15 agent frameworks, including the Claude Agent SDK, LangChain, LangGraph, the OpenAI Agents SDK, the Vercel AI SDK, Mastra, and CrewAI. For more information, see how to secure AI agents in production. - Policy. Guard policies are written in Rego or a builder, published from the Arcjet Console or MCP server, run in dry run before they go live, and take effect in real time.
- Detectors. Prompt injection, sensitive information, destination threat analysis against Arcjet threat intelligence, token and spend budgets, and rate limits.
- Evidence. The Arcjet Console records every decision and session. SIEM export to Datadog, Splunk, SentinelOne, Panther, and Amazon S3 is available on the Enterprise plan.
- Discovery without enforcement. OpenTelemetry ingest and the Claude Compliance API show coding-agent sessions that the hooks didn't reach. For more information, see Observe.
Arcjet evaluates coding-agent hooks at the edge in over 300 data centers. Each hook adds one request of latency, typically a few tens of milliseconds.
Arcjet's hook coverage has limits that come from the coding-agent vendors, and they matter when you plan coverage. Claude Code and Copilot HTTP hooks fail open by vendor design, and Cursor and Codex use a fail-closed command wrapper. Copilot drops prompt-hook output, and Codex hosted tools skip PreToolUse. A hook can't withhold a tool result from the model, and personal accounts don't load organization hooks, so block those at the network or device.
How to run an AI gateway and Arcjet together
An AI gateway and Arcjet sit at different points in the same workflow, so a team with a gateway can keep it and add Arcjet at the action. A layered setup has the following four steps:
- Keep the gateway on model traffic. Use it for provider keys, routing, failover, caching, spend accounting, and prompt and response guardrails.
- Add Arcjet at the action. Install Arcjet hooks on coding agents through managed settings, and call
guard()before consequential tool calls in your own agents. - Split policies by what each layer sees. A model allowlist or provider budget belongs on the gateway. A rule about a shell command, a file path, an MCP server, or a destination host belongs in Arcjet, because Arcjet sees those values before the action runs.
- Close the bypass paths. Refuse personal accounts at the network or device, and use OpenTelemetry or Claude Compliance API ingest to find sessions that neither layer reached.
Sensitive data benefits from both layers: minimize it in code before dispatch, and let the gateway scan what still reaches the provider.
When to choose an AI gateway, Arcjet, or both
Choose an AI gateway to govern model traffic, Arcjet to decide agent actions, and both when you need each. The following sections list the signals for each choice.
When to choose an AI gateway
Choose an AI gateway if any of the following apply:
- You need one API across multiple model providers, with routing, failover, and caching.
- You want provider keys held centrally, with scoped keys issued to teams.
- Your main concern is model spend and usage attribution by team or developer.
- You want guardrails on prompts and responses, or on MCP tool inputs and outputs that you route through the gateway.
When to choose Arcjet
Choose Arcjet if any of the following apply:
- You need to stop a coding agent's shell command, file read, URL fetch, or MCP call before it runs.
- You want one policy across Claude Code, GitHub Copilot, Cursor, and OpenAI Codex, installed so developers can't remove it.
- You're building agents and need a decision at the tool call, with the arguments that will run.
- You want destination threat analysis on the hosts an agent contacts.
- You also want bot detection, rate limiting, and a WAF on your HTTP routes from the same platform.
When to use both
Use both when you have a gateway for model governance and need enforcement on what agents do with the model's output. The AI gateway answers which model a team can call and what it costs. Arcjet answers whether a specific action runs.
AI gateway alternatives
If you're looking for an AI gateway alternative for security rather than model routing, consider the following options:
- Arcjet. Enforces policy in the path of the action, in code and in coding-agent hooks, with no proxy. It complements a gateway rather than replacing routing or caching.
- In-code guardrail libraries. Frameworks such as the OpenAI Agents SDK include guardrails that run in your process. For more information, see OpenAI Agents SDK guardrails vs Arcjet.
- Guardrail APIs. Services such as Lakera Guard and Datadog AI Guard evaluate content that your application sends them. For more information, see Lakera alternatives and Datadog AI Guard vs Arcjet.
If you need model routing, the gateway vendors compete with each other: Portkey, LiteLLM, Kong AI Gateway, and Cloudflare AI Gateway. For a map of the wider market, see AI agent security platforms.
Frequently asked questions
What is the difference between an AI gateway and Arcjet?
An AI gateway is a proxy between applications and model providers that handles routing, caching, provider keys, budgets, and guardrails on the prompts and responses routed through it. Arcjet enforces policy in the path of the action: in code before a tool call runs, and in the hooks that Claude Code, GitHub Copilot, Cursor, and OpenAI Codex fire. A gateway governs model traffic; Arcjet decides whether an agent's action runs.
Is Arcjet an alternative to an AI gateway?
Arcjet is an alternative to an AI gateway for agent security, not for model routing. Arcjet doesn't route, cache, or fail over model calls, and it doesn't hold provider keys. Arcjet enforces policy on tool calls, prompts, and model switches where they happen, which a gateway sees only as model traffic.
Can an AI gateway stop a coding agent's shell command?
An AI gateway governs a coding agent's model requests, not its shell commands. Gateways integrate with coding agents by changing the agent's model endpoint. The public documentation for Cloudflare AI Gateway, Kong AI Gateway, Portkey, and LiteLLM doesn't describe evaluating a local shell command or file read before it runs, because those actions run on the developer's machine. Arcjet evaluates those actions from the agent's own hooks before the tool runs.
Can you use an AI gateway and Arcjet together?
Yes. Keep the gateway on model traffic for keys, routing, spend, and prompt and response guardrails. Add Arcjet hooks to coding agents and guard() calls to your own agents to decide each action before it runs. Put model and provider rules on the gateway, and rules about commands, paths, MCP servers, and destination hosts in Arcjet.
Does an AI gateway see the tool calls an agent makes?
A gateway sees the tool calls a model proposes in its response. The agent's own runtime executes them afterwards, outside the gateway. LiteLLM's Tool Permission Guardrail, for example, filters the tools in a request or rewrites the tool calls in a response. Arcjet's guard() runs at the call site with the arguments that will run.
AI runtime security in your code
Protect your AI agent workflows with Arcjet
Arcjet runs inside your application, where it can use runtime context to enforce agent actions and budgets, detect prompt injection, and protect sensitive information before a workflow acts.