# Bifrost

Open-source AI gateway that puts 20+ LLM providers and MCP tools behind one OpenAI-compatible API

**Verdict: conditional.** Bifrost is a free, Apache 2.0 AI gateway from Maxim that puts 20+ model providers behind one OpenAI-compatible API, with virtual-key budgets, semantic caching, fallbacks and an MCP gateway. Conditional on hardening: management authentication is off by default, and JFrog disclosed two unauthenticated code-execution flaws that rely on it, CVE-2026-90898 (CVSS 9.8, fixed in 2.1.0) and CVE-2026-86242 (CVSS 8.1, fixed in 2.0.0). Right for platform teams that enable auth and patch. Last verified 2026-09-27.

Bifrost is an open-source AI gateway from Maxim, licensed Apache 2.0, that puts 20+ model providers behind one OpenAI-compatible API, so an application switches to it by changing only its base URL. The docs list 23 providers, among them OpenAI, Anthropic, AWS Bedrock, Google Vertex, Azure OpenAI, Mistral, Groq, Ollama, OpenRouter and vLLM. Virtual keys are its governance unit: each carries access permissions, budgets and rate limits, with hierarchical cost control at key, team and customer level and per-key MCP tool allow-lists. It also acts as an MCP gateway, both client and server, with tool approval controls, an agent mode and a code mode, and it adds semantic caching, automatic fallbacks, load balancing, OpenTelemetry tracing and a built-in web UI. It runs through npx, Docker, Kubernetes or a Go binary, and it can be embedded as a Go SDK. The open-source edition is free. Enterprise, priced through a demo request with a 14-day trial, adds guardrails, cluster mode, adaptive load balancing, SAML and OpenID Connect SSO, vault integrations, role-based access control, audit logs, and in-VPC, on-premises or air-gapped deployment. Management authentication is disabled by default. In HTTP transport releases before 2.1.0 that let a single unauthenticated POST to /api/mcp/client register a stdio MCP client, which Bifrost launched immediately as the gateway process user, with the stored provider API keys in reach. The flaw is CVE-2026-90898, CVSS 9.8, published by JFrog on September 14, 2026 and fixed in 2.1.0. A second JFrog advisory, CVE-2026-86242, CVSS 8.1, published on September 6, 2026 and fixed in 2.0.0, covers dynamically linked builds: with authentication off, an unauthenticated POST to /api/plugins can register a custom plugin whose path is an HTTP URL, which Bifrost downloads and loads as a shared object. JFrog recommends the statically linked binary or the official Docker image where plugins are not needed.

## Strengths

- Moving an app across providers by changing only the base URL, through one OpenAI-compatible API over 20+ providers
- Controlling spend per key, team and customer with virtual keys, budgets and rate limits in the free edition
- Governing agent tool access: MCP gateway with tool approval controls and per-key MCP tool allow-lists
- Keeping traffic on your own infrastructure, with Docker, Kubernetes or Go binary deployment and air-gapped support on Enterprise
- Deployments left on defaults: management authentication is disabled by default, which JFrog says makes every caller a local admin
- Unpatched installs: HTTP transport releases before 2.1.0, including 1.6.x through 1.6.11, allow unauthenticated command execution through stdio MCP client registration (CVE-2026-90898, CVSS 9.8)
- Dynamically linked builds before 2.0.0 left on defaults: an unauthenticated POST to /api/plugins can make Bifrost download and load a remote shared object (CVE-2026-86242, CVSS 8.1)
- Buyers who need published enterprise pricing: Enterprise is priced through a demo request

## Pricing

- Model: open-source
- Open Source: $0
- Enterprise: Custom

Website: https://www.getmaxim.ai/bifrost

## Sources

- [The Hacker News: Critical Bifrost AI Gateway flaw (Sep 22, 2026)](https://thehackernews.com/2026/09/critical-bifrost-ai-gateway-flaw-lets.html)
- [Bifrost docs: Overview (official)](https://docs.getbifrost.ai/overview)
- [Bifrost pricing page](https://www.getmaxim.ai/bifrost/pricing)
- [JFrog Security Research: Bifrost unauthenticated RCE via custom plugin HTTP path, CVE-2026-86242 (Sep 6, 2026)](https://research.jfrog.com/vulnerabilities/bifrost-is-vulnerable-to-unauthenticated-remote-code-execution-via-a-custom-plugin-http-path-on-dynamically-linked-builds-cve-2026-86242-jfsa-2026-001684572/)
- [Bifrost GitHub releases (official)](https://github.com/maximhq/bifrost/releases)
- [JFrog Security Research: Bifrost unauthenticated RCE via MCP stdio client registration, CVE-2026-90898 (Sep 14, 2026)](https://research.jfrog.com/vulnerabilities/bifrost-is-vulnerable-to-unauthenticated-remote-code-execution-via-mcp-stdio-client-registration-cve-2026-90898/)
- [Bifrost GitHub repository (official)](https://github.com/maximhq/bifrost)
- [Maxim: Bifrost product site (official)](https://www.getmaxim.ai/bifrost)

Canonical: https://neomanex.com/directory/bifrost