Iniciar sessão
Bifrost logo

Bifrost

Ativo

Open-source AI gateway that puts 20+ LLM providers and MCP tools behind one OpenAI-compatible API

Visitar siteComparar
Condicional

Bifrost is a free, Apache 2.0 AI gateway from Maxim that puts 20+ model providers behind one OpenAI-compatible API, with virtual-key budgets, semantic caching, fallbacks and an MCP gateway. Conditional on hardening: management authentication is off by default, and JFrog disclosed two unauthenticated code-execution flaws that rely on it, CVE-2026-90898 (CVSS 9.8, fixed in 2.1.0) and CVE-2026-86242 (CVSS 8.1, fixed in 2.0.0). Right for platform teams that enable auth and patch.

Com IA

A self-hosted gateway forwards OpenAI-compatible requests to 20+ LLM providers and wraps them in keys, budgets, routing and caching.

É adequada para ti?

Bom para

  • Moving an app across providers by changing only the base URL, through one OpenAI-compatible API over 20+ providers
  • Controlling spend per key, team and customer with virtual keys, budgets and rate limits in the free edition
  • Governing agent tool access: MCP gateway with tool approval controls and per-key MCP tool allow-lists
  • Keeping traffic on your own infrastructure, with Docker, Kubernetes or Go binary deployment and air-gapped support on Enterprise

Não recomendado para

  • Deployments left on defaults: management authentication is disabled by default, which JFrog says makes every caller a local admin
  • Unpatched installs: HTTP transport releases before 2.1.0, including 1.6.x through 1.6.11, allow unauthenticated command execution through stdio MCP client registration (CVE-2026-90898, CVSS 9.8)
  • Dynamically linked builds before 2.0.0 left on defaults: an unauthenticated POST to /api/plugins can make Bifrost download and load a remote shared object (CVE-2026-86242, CVSS 8.1)
  • Buyers who need published enterprise pricing: Enterprise is priced through a demo request

A nossa experiência

We haven't tested Bifrost ourselves. This profile is based on public documentation, user reviews, and community feedback.

Preços

Código aberto
Open Source$0
  • Apache 2.0, self-hosted on Docker, Kubernetes or a Go binary
  • Virtual keys with budgets and rate limits
  • Routing, failover and semantic caching
  • MCP gateway with code mode
EnterpriseCustom
  • Guardrails and cluster mode
  • SAML and OpenID Connect SSO, RBAC and audit logs
  • In-VPC, on-premises or air-gapped deployment
  • 14-day trial
Ver preços completos

Receitas de fluxo de trabalho

Close CVE-2026-90898 and CVE-2026-86242 on an existing gateway

Harden a Bifrost deployment along the lines JFrog recommends

  1. Upgrade the HTTP transport to 2.1.0 or later, which is past both fixes
  2. Set governance.auth_config.is_enabled to true
  3. Use strong credentials for the management API
  4. Restrict management API access to trusted networks
  5. If you do not need plugins, run the statically linked binary or the official Docker image rather than a dynamically linked build
  6. If the instance ever ran exposed with authentication off, treat it as compromised and rotate virtual keys and provider credentials

Usa estas em alternativa para tarefas específicas

OpenRouter: OpenRouter is a hosted API reaching hundreds of models through one endpoint, so there is no gateway for you to deploy, expose or patch

Histórico de veredictos

23/09/2026
conditional -> conditional (second CVE added): No rating change. JFrog Security Research advisory JFSA-2026-001684572, published 6 September 2026 and fetched 23 September 2026, discloses CVE-2026-86242 (CVSS 8.1): Bifrost HTTP transport before 2.0.0 accepts an enabled custom plugin whose path is an HTTP URL through unauthenticated POST /api/plugins when management authentication is disabled (the default), leading to code execution on dynamically linked builds. The standing verdict already conditions on enabling auth and patching; a second flaw with the same precondition and an available fix reinforces that condition rather than moving the rating.

Fontes

Registo de verificação

  • Preços· Sem alterações

    Agente automatizado

  • Preços· Sem alterações

    Agente automatizado

  • Perfil· Sem alterações

    Agente automatizado

Como avaliamos

Quer isto a funcionar na sua empresa?

Testámos esta ferramenta e construímos com ferramentas assim todos os dias. Diga-nos o fluxo de trabalho e nós instalamos, integramos e entregamos a funcionar.

Diga-nos o que precisa (abre num novo separador)Veja o que construímos

A conversa funciona com Gnosari, uma das ferramentas deste diretório. Uma conversa real, não um guião de vendas.