Se connecter
Bifrost logo

Bifrost

Actif

Open-source AI gateway that puts 20+ LLM providers and MCP tools behind one OpenAI-compatible API

Visiter le siteComparer
Conditionnel

Bifrost is a free, Apache 2.0 AI gateway from Maxim that puts 20+ model providers behind one OpenAI-compatible API, with virtual-key budgets, semantic caching, fallbacks and an MCP gateway. Conditional on hardening: management authentication is off by default, and JFrog disclosed two unauthenticated code-execution flaws that rely on it, CVE-2026-90898 (CVSS 9.8, fixed in 2.1.0) and CVE-2026-86242 (CVSS 8.1, fixed in 2.0.0). Right for platform teams that enable auth and patch.

Dopé à l’IA

A self-hosted gateway forwards OpenAI-compatible requests to 20+ LLM providers and wraps them in keys, budgets, routing and caching.

Est-ce fait pour vous ?

Recommandé pour

  • Moving an app across providers by changing only the base URL, through one OpenAI-compatible API over 20+ providers
  • Controlling spend per key, team and customer with virtual keys, budgets and rate limits in the free edition
  • Governing agent tool access: MCP gateway with tool approval controls and per-key MCP tool allow-lists
  • Keeping traffic on your own infrastructure, with Docker, Kubernetes or Go binary deployment and air-gapped support on Enterprise

Déconseillé pour

  • Deployments left on defaults: management authentication is disabled by default, which JFrog says makes every caller a local admin
  • Unpatched installs: HTTP transport releases before 2.1.0, including 1.6.x through 1.6.11, allow unauthenticated command execution through stdio MCP client registration (CVE-2026-90898, CVSS 9.8)
  • Dynamically linked builds before 2.0.0 left on defaults: an unauthenticated POST to /api/plugins can make Bifrost download and load a remote shared object (CVE-2026-86242, CVSS 8.1)
  • Buyers who need published enterprise pricing: Enterprise is priced through a demo request

Notre expérience

We haven't tested Bifrost ourselves. This profile is based on public documentation, user reviews, and community feedback.

Tarifs

Open source
Open Source$0
  • Apache 2.0, self-hosted on Docker, Kubernetes or a Go binary
  • Virtual keys with budgets and rate limits
  • Routing, failover and semantic caching
  • MCP gateway with code mode
EnterpriseCustom
  • Guardrails and cluster mode
  • SAML and OpenID Connect SSO, RBAC and audit logs
  • In-VPC, on-premises or air-gapped deployment
  • 14-day trial
Voir tous les tarifs

Recettes de flux de travail

Close CVE-2026-90898 and CVE-2026-86242 on an existing gateway

Harden a Bifrost deployment along the lines JFrog recommends

  1. Upgrade the HTTP transport to 2.1.0 or later, which is past both fixes
  2. Set governance.auth_config.is_enabled to true
  3. Use strong credentials for the management API
  4. Restrict management API access to trusted networks
  5. If you do not need plugins, run the statically linked binary or the official Docker image rather than a dynamically linked build
  6. If the instance ever ran exposed with authentication off, treat it as compromised and rotate virtual keys and provider credentials

Utilisez plutôt ceux-ci pour des tâches spécifiques

OpenRouter: OpenRouter is a hosted API reaching hundreds of models through one endpoint, so there is no gateway for you to deploy, expose or patch

Historique des verdicts

23 sept. 2026
conditional -> conditional (second CVE added): No rating change. JFrog Security Research advisory JFSA-2026-001684572, published 6 September 2026 and fetched 23 September 2026, discloses CVE-2026-86242 (CVSS 8.1): Bifrost HTTP transport before 2.0.0 accepts an enabled custom plugin whose path is an HTTP URL through unauthenticated POST /api/plugins when management authentication is disabled (the default), leading to code execution on dynamically linked builds. The standing verdict already conditions on enabling auth and patching; a second flaw with the same precondition and an available fix reinforces that condition rather than moving the rating.

Sources

Journal de vérification

  • Tarifs· Aucun changement

    Agent automatisé

  • Tarifs· Aucun changement

    Agent automatisé

  • Profil· Aucun changement

    Agent automatisé

Comment nous évaluons

Vous le voulez en marche dans votre entreprise ?

Nous avons testé cet outil et nous construisons avec des outils comme lui chaque jour. Dites-nous le flux de travail : nous l’installons, nous l’intégrons et nous vous le livrons fonctionnel.

Dites-nous ce qu’il vous faut (s’ouvre dans un nouvel onglet)Voir ce que nous construisons

La conversation tourne sur Gnosari, l’un des outils de ce répertoire. Une vraie conversation, pas un script de vente.