Arcjet vs LiteLLM

Arcjet vs LiteLLM

LiteLLM, maintained by BerriAI, is an open-source Python SDK and a self-hosted proxy server (AI gateway) that gives applications one OpenAI-format API across more than 100 model providers, with virtual keys, budgets, cost tracking, load balancing, guardrails, and MCP and A2A gateways. Arcjet is an AI agent runtime security platform that enforces policy in the path of the action: in your code before a tool call runs, and in the hooks that Claude Code, GitHub Copilot, Cursor, and OpenAI Codex fire before a shell command, file access, URL fetch, or MCP call. The key difference is where each one decides. LiteLLM decides on the model requests and responses that pass through the proxy, including the tool calls a model proposes. Arcjet decides on the tool call your code or coding agent is about to execute, with the arguments that will run. Choose LiteLLM to self-host a gateway for model traffic and spend, choose Arcjet to decide whether an agent's action runs, and use both when you need each.

Arcjet publishes this comparison. Competitor details come from LiteLLM's public documentation, reviewed on September 25, 2026.

Arcjet vs LiteLLM at a glance

Arcjet differs from LiteLLM in where it enforces, how it's deployed, and which detectors it includes. The following table compares the two products by area.

What does LiteLLM do?

LiteLLM is an open-source AI gateway project with two parts: a Python SDK and a proxy server. The Python SDK gives your code a single completion() interface across providers. The LiteLLM proxy server is a self-hosted, OpenAI-compatible AI gateway for organizations that manage model access across teams. The GitHub repository is under the MIT License, with a separate commercial license for the enterprise folder.

The LiteLLM proxy issues virtual keys so that teams don't hold provider credentials, and it enforces budgets per key, user, team, team member, customer, model, and agent. After a key crosses its maximum budget, requests fail until the budget resets. The proxy also provides cost tracking, caching, and load balancing with retries and fallbacks.

LiteLLM guardrails run in one of four modes: pre_call on input before the model call, during_call in parallel with it, post_call on input and output after it, and logging_only, which scans logs without changing the response. Guardrail integrations include Aporia, Lakera, Presidio, AWS Bedrock, Azure Content Safety, OpenAI Moderation, and Pillar Security. Some controls, such as per-key guardrails and model-level guardrail assignment, require LiteLLM Enterprise.

The Tool Permission Guardrail controls which tool calls a model is allowed to invoke, with allow and deny rules and regex checks on arguments. In pre_call mode, the guardrail removes disallowed tools from the request, and in post_call mode it blocks or rewrites the tool calls in the model's response.

The MCP gateway exposes MCP tools through one endpoint, with access restricted by key, team, or organization, plus logging and cost tracking. MCP guardrails run pre_mcp_call on tool inputs or during_mcp_call, and can block or mask values such as credit card numbers. The A2A agent gateway routes agent-to-agent messages with logging, guardrails, and spend tracking, and agent permissions restrict which keys and teams can call which agents.

For coding agents, LiteLLM documents routing Claude Code through the proxy by setting ANTHROPIC_BASE_URL and ANTHROPIC_AUTH_TOKEN, which gives centralized model management, usage tracking, and cost controls.

LiteLLM Enterprise adds SSO, SCIM, audit logs, RBAC, and support SLAs, and lists SOC 2 Type 2 and ISO 27001. LiteLLM Enterprise pricing is by contact, with a 30-day free trial.

What does Arcjet do?

Arcjet is an AI agent runtime security platform that discovers the agents running in your organization, enforces policy across every action, prompt, and tool call, and keeps the evidence of what happened. Arcjet enforces in the path of the action rather than on the network.

• Coding agents. Arcjet enforces policy on Claude Code, GitHub Copilot, Cursor, and OpenAI Codex through the hooks each agent already fires, with no SDK and no code change. One policy covers all four, and each policy runs on a tool call, a prompt, or a model switch. Twelve starter policies cover destructive commands, rewriting git history, protected paths, credential access, piped installers, an MCP server allowlist, an egress allowlist, destination threats, a model allowlist, sensitive information, prompt injection, and npm publish. Administrators install the hooks through managed settings or MDM.
• Custom agents. The JavaScript, TypeScript, Python, and Go SDKs call guard() for tool calls, queues, MCP handlers, and any action with no HTTP request, and protect() for HTTP routes. Arcjet has integrations for 15 agent frameworks, including LangChain, LangGraph, CrewAI, the OpenAI Agents SDK, the Claude Agent SDK, and the Vercel AI SDK.
• Policy. Guard policies are centrally managed, written in Rego or a builder, and published from the Arcjet Console or MCP server. Guard policies run in dry run before they go live and take effect in real time.
• Detectors. Prompt injection, sensitive information, destination threat analysis, token and spend budgets, and rate limits.
• Evidence. The Arcjet Console records every decision and session. SIEM export to Datadog, Splunk, SentinelOne, Panther, and Amazon S3 is available on the Enterprise plan.

Key differences between LiteLLM and Arcjet

Arcjet differs from LiteLLM in four ways: which tool call each one sees, whether it covers coding-agent actions on the developer's machine, who operates it, and where its detectors come from.

A proposed tool call versus the executed action

LiteLLM's Tool Permission Guardrail works on the tool calls in a model request or response, which are proposals. The agent's runtime executes the tool afterwards, and the LiteLLM proxy isn't in that step. Arcjet's guard() runs at the call site, immediately before the side effect, with the arguments that will run, including any changes your code made after the model responded. For more information about where each enforcement point sits, see AI agent security architecture.

Coding agents on the developer's machine

LiteLLM's Claude Code integration changes where the agent sends model requests. Shell commands, file reads, and URL fetches run on the developer's machine and don't pass through the proxy as model traffic. LiteLLM's public documentation doesn't describe evaluating those actions before they run. Arcjet evaluates each one from the agent's own PreToolUse or equivalent hook and returns a denial the agent acts on. For more information, see how to secure AI coding agents.

Operating the gateway versus using a service

LiteLLM runs in your infrastructure, so model traffic, logs, and keys stay there, and you operate, patch, and scale the proxy. Arcjet is a hosted service. Arcjet's SDK-local sensitive-information detection keeps the raw body in your process, and prompt-injection detection runs in the Arcjet Cloud API. If every component must run in your own infrastructure, LiteLLM fits that requirement and Arcjet, as a hosted service, doesn't.

Detectors you bring versus detectors built in

LiteLLM's guardrail framework orchestrates checks from providers you configure, such as Lakera or Presidio. Arcjet includes its own prompt-injection, sensitive-information, and destination threat detectors, and applies the same policy to coding-agent hooks and to your own agents.

When to choose LiteLLM, Arcjet, or both

Choose LiteLLM to self-host a gateway for model traffic, Arcjet to decide agent actions before they run, and both when you need each. The following sections list the signals for each choice.

When to choose LiteLLM

Choose LiteLLM if any of the following apply:

• You want an open-source gateway that you self-host, including in an air-gapped environment.
• You need one OpenAI-format API across more than 100 providers, with virtual keys, budgets, and cost tracking.
• You want to pick your own guardrail providers and orchestrate them at the gateway.
• You want MCP and A2A traffic behind the same proxy, with per-key and per-team access.

When to choose Arcjet

Choose Arcjet if any of the following apply:

• You need to stop a coding agent's shell command, file access, URL fetch, or MCP call before it runs.
• You want one policy across Claude Code, GitHub Copilot, Cursor, and OpenAI Codex, installed so developers can't remove it.
• You need a decision at the executed tool call rather than the proposed one.
• You want built-in prompt-injection, sensitive-information, and destination threat detectors without operating a proxy.
• You also need bot detection, rate limiting, and a WAF on your HTTP routes.

Using LiteLLM and Arcjet together

LiteLLM and Arcjet cover different points in the same workflow. Keep LiteLLM on model traffic for keys, routing, budgets, and prompt and response guardrails. Add Arcjet hooks to coding agents and guard() calls to your own agents so that each action is decided before it runs.

A model allowlist or team budget fits LiteLLM. A rule about a command, a path, an MCP server, or a destination host fits Arcjet. For more information about layering a gateway with Arcjet, see AI gateway vs Arcjet.

LiteLLM alternatives

If you're looking for a LiteLLM alternative, the right one depends on whether you need a gateway or action-level enforcement:

• Arcjet. Enforces policy on agent actions in code and in coding-agent hooks, with no proxy to run. Choose it for security on tool calls, and pair it with a gateway if you also need routing.
• Portkey. A managed AI gateway, with an open-source self-hosted option, that Palo Alto Networks acquired in 2026. For more information, see Arcjet vs Portkey.
• Kong AI Gateway. AI plugins on Kong Gateway, for teams that already run Kong for APIs. For more information, see Arcjet vs Kong AI Gateway.
• Cloudflare AI Gateway. A managed gateway on Cloudflare's network with caching, spend limits, Guardrails, and DLP. For more information, see Cloudflare vs Arcjet.