Iniciar sesión
Bifrost logo

Bifrost

Activo

Open-source AI gateway that puts 20+ LLM providers and MCP tools behind one OpenAI-compatible API

Visitar sitio webComparar
Condicional

Bifrost is a free, Apache 2.0 AI gateway from Maxim that puts 20+ model providers behind one OpenAI-compatible API, with virtual-key budgets, semantic caching, fallbacks and an MCP gateway. Conditional on hardening: management authentication is off by default, and JFrog disclosed two unauthenticated code-execution flaws that rely on it, CVE-2026-90898 (CVSS 9.8, fixed in 2.1.0) and CVE-2026-86242 (CVSS 8.1, fixed in 2.0.0). Right for platform teams that enable auth and patch.

Con IA

A self-hosted gateway forwards OpenAI-compatible requests to 20+ LLM providers and wraps them in keys, budgets, routing and caching.

¿Es adecuada para ti?

Bueno para

  • Moving an app across providers by changing only the base URL, through one OpenAI-compatible API over 20+ providers
  • Controlling spend per key, team and customer with virtual keys, budgets and rate limits in the free edition
  • Governing agent tool access: MCP gateway with tool approval controls and per-key MCP tool allow-lists
  • Keeping traffic on your own infrastructure, with Docker, Kubernetes or Go binary deployment and air-gapped support on Enterprise

No recomendado para

  • Deployments left on defaults: management authentication is disabled by default, which JFrog says makes every caller a local admin
  • Unpatched installs: HTTP transport releases before 2.1.0, including 1.6.x through 1.6.11, allow unauthenticated command execution through stdio MCP client registration (CVE-2026-90898, CVSS 9.8)
  • Dynamically linked builds before 2.0.0 left on defaults: an unauthenticated POST to /api/plugins can make Bifrost download and load a remote shared object (CVE-2026-86242, CVSS 8.1)
  • Buyers who need published enterprise pricing: Enterprise is priced through a demo request

Nuestra experiencia

We haven't tested Bifrost ourselves. This profile is based on public documentation, user reviews, and community feedback.

Precios

Código abierto
Open Source$0
  • Apache 2.0, self-hosted on Docker, Kubernetes or a Go binary
  • Virtual keys with budgets and rate limits
  • Routing, failover and semantic caching
  • MCP gateway with code mode
EnterpriseCustom
  • Guardrails and cluster mode
  • SAML and OpenID Connect SSO, RBAC and audit logs
  • In-VPC, on-premises or air-gapped deployment
  • 14-day trial
Ver precios completos

Recetas de flujo de trabajo

Close CVE-2026-90898 and CVE-2026-86242 on an existing gateway

Harden a Bifrost deployment along the lines JFrog recommends

  1. Upgrade the HTTP transport to 2.1.0 or later, which is past both fixes
  2. Set governance.auth_config.is_enabled to true
  3. Use strong credentials for the management API
  4. Restrict management API access to trusted networks
  5. If you do not need plugins, run the statically linked binary or the official Docker image rather than a dynamically linked build
  6. If the instance ever ran exposed with authentication off, treat it as compromised and rotate virtual keys and provider credentials

Usa estas en su lugar para tareas concretas

OpenRouter: OpenRouter is a hosted API reaching hundreds of models through one endpoint, so there is no gateway for you to deploy, expose or patch

Historial de veredictos

23 sept 2026
conditional -> conditional (second CVE added): No rating change. JFrog Security Research advisory JFSA-2026-001684572, published 6 September 2026 and fetched 23 September 2026, discloses CVE-2026-86242 (CVSS 8.1): Bifrost HTTP transport before 2.0.0 accepts an enabled custom plugin whose path is an HTTP URL through unauthenticated POST /api/plugins when management authentication is disabled (the default), leading to code execution on dynamically linked builds. The standing verdict already conditions on enabling auth and patching; a second flaw with the same precondition and an available fix reinforces that condition rather than moving the rating.

Fuentes

Registro de verificación

  • Precios· Sin cambios

    Agente automatizado

  • Precios· Sin cambios

    Agente automatizado

  • Perfil· Sin cambios

    Agente automatizado

Cómo evaluamos

¿La quieres funcionando en tu empresa?

Hemos probado esta herramienta y construimos con herramientas así cada día. Cuéntanos el flujo de trabajo y la instalamos, la integramos y te la entregamos funcionando.

Cuéntanos qué necesitas (se abre en una pestaña nueva)Mira lo que construimos

La conversación funciona con Gnosari, una de las herramientas de este directorio. Una conversación real, no un guion de ventas.