Top 5 AI gateways for Claude Code, Codex CLI and Cursor in 2026

A Claude Code proxy is a gateway that sits between a coding agent and the model provider, so that the agent authenticates with a per-developer credential while the organisation’s provider key, budgets, rate limits and logs live in one place. Anthropic now documents the pattern officially, OpenAI publishes a gateway rollout guide for Codex, and Cursor accepts an overridden OpenAI base URL. This ranking is for platform teams that have to govern all three tools at once, and it compares five AI gateways on how well they handle the specific problems coding agents create: base-URL overrides, per-developer keys and budgets, model swapping, MCP tool governance and the cost of agent loops.

The cost problem is real but bounded. Anthropic’s own cost guidance puts average enterprise Claude Code spend at about $13 per developer per active day and $150 to $250 per developer per month, with 90 per cent of users under $30 a day. The spread matters more than the average: a single autonomous session that loops on a failing test can cost more than a week of normal use, and without a gateway nobody sees it until the invoice arrives.

Every capability claim below comes from the vendor’s own documentation, read between 7 and 10 October 2026. GenAI Brief did not run these gateways; where a vendor does not publish something, the tables say “Not published”.

How this ranking was built

The ranking uses seven criteria that reflect what a platform team actually has to configure when it puts coding agents behind a gateway. Agent coverage and per-developer governance carry the most weight, because a gateway that cannot serve all three clients, or cannot tell developers apart, does not solve the problem.

Readers new to the category can start with the site’s explainer on what an AI gateway is. For a ranking of gateways on general production traffic rather than coding agents, see the top AI gateways in 2026.

How each agent reaches a gateway

Claude Code, Codex CLI and Cursor each speak a different API and are redirected in a different place, so a coding-agent gateway has to serve three request formats and survive three sets of client quirks. This section sets out the mechanics, because they explain most of the differences between the five gateways.

Claude Code: ANTHROPIC_BASE_URL and friends

Claude Code reads its endpoint from environment variables. Anthropic’s gateway compatibility guide lists three supported formats: the Anthropic Messages API selected by ANTHROPIC_BASE_URL, Amazon Bedrock’s InvokeModel format selected by ANTHROPIC_BEDROCK_BASE_URL with CLAUDE_CODE_USE_BEDROCK=1, and Google Cloud’s rawPredict format selected by ANTHROPIC_VERTEX_BASE_URL. The credential goes in ANTHROPIC_AUTH_TOKEN, which Claude Code sends as a bearer token.

Two details from Anthropic’s documentation shape every rollout. First, setting a gateway credential takes the session off the developer’s claude.ai subscription: usage is billed per token to whoever owns the provider credential behind the gateway. Setting only the base URL, without a credential, leaves the subscription active. Second, a managed settings file can make the gateway mandatory. Setting allowedProviders to ["customEndpoint"] alongside the gateway’s base URL makes Claude Code refuse sessions pointed anywhere else, including Anthropic directly, from v2.1.285 onwards, according to the Other LLM gateways page.

The compatibility guide is also blunt about streaming. A gateway that buffers responses makes Claude Code stall, and one that strips the upstream’s SSE ping events can trip Claude Code’s idle timeout during a long thinking pause. Claude Code adds headers with each release, so a separately maintained gateway has to keep forwarding them.

Anthropic also ships its own option. Claude apps gateway is built into the claude binary, signs developers in through the corporate identity provider, enforces model access by IdP group and emits OpenTelemetry usage metrics. Its upstreams are Anthropic’s API, Amazon Bedrock, Claude Platform on AWS, Google Cloud and Microsoft Foundry, and it has no service-token flow for CI. For an organisation that only runs Claude Code on Claude models, it deserves a look before any third-party product. It is not in the ranking because it does not serve Codex or Cursor.

Codex CLI: a model_providers entry

Codex reads custom providers from ~/.codex/config.toml. The advanced configuration page shows a provider block with a base_url, an env_key naming the variable that holds the credential, optional HTTP headers, and a command-backed auth option that fetches short-lived bearer tokens from a helper. For a simple proxy in front of OpenAI, openai_base_url is enough. For security, Codex ignores model_provider, model_providers and openai_base_url in a repository’s .codex/config.toml, so a cloned project cannot silently redirect a developer’s traffic.

OpenAI’s gateway rollout guide sets a higher bar than “it answers a request”. The gateway must accept POST /v1/responses, stream server-sent events without buffering through to response.completed, preserve replayed conversation input and keep function_call_output items matched to their calls. The guide states plainly that a health endpoint, a /v1/models response or one plain-text reply does not qualify a gateway. Custom model names need a model_catalog_json file, or Codex falls back to generic metadata.

Cursor: an overridden OpenAI base URL, called from Cursor’s servers

Cursor is the odd one out. Its bring-your-own-key documentation says every request is routed through Cursor’s servers for final prompt building, custom keys only apply to chat models, and Tab completion keeps using Cursor’s own models. Gateways connect through the “Override OpenAI Base URL” toggle in Cursor’s model settings, which the gateway vendors’ guides document. The consequence is that the gateway must be reachable from the public internet: a gateway behind a VPN or on a private address fails before any request reaches it.

Two more Cursor details matter to platform teams. On Teams and Enterprise plans, every third-party model request, including those made with the team’s own key, carries the Cursor Token Rate of $0.25 per million tokens. And Cursor’s Zero Data Retention policy does not apply to requests made with your own keys; data handling follows the provider’s policy instead. Cursor Enterprise can also block personal keys entirely and enforce an MCP allowlist, according to its model and integration management page.

Figure 1: The gateway has to speak three dialects and meet three sets of streaming and reachability requirements, which is where the five products differ most.

The five gateways at a glance

The table compares the five on the criteria above. “Not published” means the vendor’s documentation, as read for this article, does not describe the capability for that agent or feature; it does not mean the feature cannot be built.

Bifrost receives the longest treatment below because its documentation covers every criterion in the table, for all three agents, in the open-source tier; the other entries are written to the same standard from their own documentation.

1. Bifrost

Bifrost is an open-source AI gateway written in Go by Maxim AI, released under Apache 2.0 with a paid enterprise tier. It exposes OpenAI-, Anthropic- and Gemini-compatible endpoints in front of 25+ providers and 10,000+ models through one OpenAI-compatible API, and its documentation has a dedicated section for CLI agents and editors, covering Claude Code, Codex CLI, Cursor, Gemini CLI, Qwen Code, Opencode, Zed, Roo Code and GitHub Copilot.

Claude Code. The Claude Code guide sets ANTHROPIC_BASE_URL to the gateway’s /anthropic path and ANTHROPIC_AUTH_TOKEN to a Bifrost virtual key, which means developers need no Anthropic account at all. Model swapping works two ways. Static pinning sets Claude Code’s Haiku and Sonnet slots to provider-prefixed models such as bedrock/global.anthropic.claude-sonnet-4-6, vertex/claude-sonnet-4-6 or openai/gpt-5.5. Dynamic aliasing sends arbitrary names such as sonnet-model and lets a routing rule, matched on the model name and a claude-cli user agent, decide the target at request time, so the platform team can change what Claude Code runs on without touching laptops. The /model command switches provider mid-session. The guide also notes that any non-Claude model must handle Claude Code’s tool calls, and that Claude-specific server-side tools such as web search and computer use may be missing elsewhere.

Codex CLI. The Codex guide uses a named model_providers entry pointing at /openai/v1 with wire_api = "responses", and explains why a named provider beats openai_base_url when Bedrock is upstream. Non-OpenAI models such as anthropic/claude-sonnet-4-5 or gemini/gemini-2.5-pro need HTTPS mode, because Codex’s WebSocket transport expects server-held conversation state. The guide also shows how to build a model catalogue so non-OpenAI models appear in Codex’s picker with correct context windows.

Cursor. The Cursor guide puts a virtual key in Cursor’s OpenAI API key field and the gateway’s public /cursor URL in the base URL override. Because Cursor assigns models per feature, a team can route Agent mode to a frontier model and inline edits to a cheaper one, all through provider/model names.

Governance. Every agent authenticates with a virtual key, and that key carries the policy: allowed providers and models, a dollar budget with a reset period from one minute to one year, token and request rate limits, and an optional expiry. Keys sit in a customer, team and key hierarchy, and a request must clear every budget above it. For agent loops, the per-key request and token limits are the useful control, because they stop a runaway session within a window rather than at month end. Claude Code and Codex send a session header that Bifrost adopts for session affinity, which keeps a session on the same provider and key so it keeps hitting the same prompt cache.

MCP. Bifrost serves every connected MCP server behind one /mcp endpoint that Claude Code adds with claude mcp add --transport http. MCP tool filtering is deny-by-default: a virtual key with no MCP configuration sees no tools, unless a server is marked allow-by-default, and the allow-list is enforced again at execution time. A developer’s key can therefore reach the GitHub and documentation servers but not the production database server, regardless of what the agent asks for.

Rollout. The Bifrost CLI launches Claude Code, Codex CLI, Gemini CLI or Opencode against the gateway with the base URL, key and model set automatically, fetches the model list from the gateway, stores virtual keys in the operating system keyring, and attaches Bifrost’s MCP server to Claude Code. All agent traffic appears in the gateway’s log view, filterable by provider and model.

Performance. Bifrost’s published benchmark reports 11 µs of added overhead per request at 5,000 RPS on an AWS t3.xlarge. For a coding agent that makes dozens of sequential calls per task, gateway overhead compounds, so the figure is more relevant here than for chat traffic.

Enterprise tier. SSO through OIDC providers such as Okta and Entra, RBAC, audit logs, budget alerting, clustering, in-VPC deployment and access profiles that issue a virtual key to every user in a role automatically come with Bifrost Enterprise.

Best for: platform teams that want one self-hosted gateway to govern Claude Code, Codex CLI and Cursor together, with per-developer budgets, MCP allow-lists and the freedom to change models without reconfiguring laptops.

2. LiteLLM

LiteLLM is an open-source Python proxy and SDK from BerriAI, and its documentation now carries more Claude Code material than any other gateway reviewed here: a quickstart, Okta SSO, a budget status line, prompt-cache routing, customer tracking and a cost-cutting guide among them.

Strengths. The Claude Code quickstart offers a unified endpoint or an Anthropic pass-through endpoint, accepts a master key or a virtual key in ANTHROPIC_AUTH_TOKEN, and supports Claude Code’s apiKeyHelper so a script can fetch a short-lived JWT per developer. A separate Claude Code Gateway tutorial implements the same sign-in protocol as Anthropic’s Claude apps gateway: /login opens a browser SSO flow and every request afterwards carries a token tied to the developer’s user and team. A status-line script shows each developer their remaining budget inside Claude Code, which is a small feature with a large effect on behaviour. The Codex setup defines LiteLLM as a Responses API provider, recommends raising stream idle timeouts for long agent turns, and registers LiteLLM’s MCP gateway in the same file. The MCP gateway controls tool access by key, team and organisation.

Trade-offs. The Cursor guide states that “Cursor does not officially support AI Gateways” and that LiteLLM’s support is best effort from reverse engineering. Agent mode through the base URL override needs LiteLLM v1.97.0 or later, the Cursor CLI cannot target LiteLLM at all, and newer Cursor builds do not show the override on every plan, in which case LiteLLM documents an Azure OpenAI fallback. SSO sign-in for Claude Code is an enterprise feature beyond five users, and every key, team and user budget is enforced against spend held in PostgreSQL, so a database-less deployment caps nothing. Python is a sensible choice for a team that already operates Python services and a less natural one for a platform team standardised on Go or Kubernetes operators.

Best for: Python-first platform teams that want the deepest library of Claude Code recipes and are prepared to track Cursor’s moving target themselves.

3. Vercel AI Gateway

Vercel AI Gateway is a hosted gateway that has turned coding-agent setup into a single command. Its documentation lists dedicated guides for Claude Code, OpenAI Codex, Cursor, OpenCode, Cline, Aider, GitHub Copilot CLI and others.

Strengths. Running npx vercel ai-gateway setup detects the agents installed on a machine, shows a diff of every change before writing it, stores the key in the macOS Keychain rather than plaintext config, backs up changed files and copies existing Claude Desktop and Codex Desktop sessions across. For Claude Code it writes ANTHROPIC_BASE_URL=https://ai-gateway.vercel.sh/claude-code and enables gateway model discovery so the catalogue appears in the /model picker. For Codex it writes a vercel provider using the Responses API. For Cursor it uses a dedicated /cursor/v1 compatibility endpoint, because Cursor’s override sends request bodies that the standard OpenAI schema rejects. Budgets apply at team, project, API-key and user level, and the gateway checks every budget in scope before each request and rejects further requests once a limit is exceeded.

Trade-offs. It is a hosted service, so source code in prompts leaves the network for Vercel before reaching the provider, and it cannot be self-hosted. The documentation read for this article does not describe an MCP gateway or per-developer MCP tool governance. Per-user budgets depend on requests being attributed to a team member, which works best when each developer has their own key.

Best for: teams that want every coding agent on every laptop pointed at a governed endpoint in an afternoon, and are comfortable with a hosted gateway.

4. Cloudflare AI Gateway

Cloudflare AI Gateway runs on Cloudflare’s network and publishes coding-agent guides for Claude Code, Claude Desktop, OpenAI Codex, Gemini CLI, GitHub Copilot CLI, OpenCode, VS Code and Xcode. Its pitch for coding agents is observability, caching, rate limiting, cost tracking and data loss prevention.

Strengths. The Claude Code guide points ANTHROPIC_BASE_URL at the gateway’s Anthropic endpoint and passes a gateway token in a cf-aig-authorization custom header, with variants for Bedrock and Vertex upstreams. DLP is the distinctive feature: it scans prompts and responses for secrets and credentials, which matters when agents send whole configuration files to a provider. Spend limits can be split by custom metadata such as a user or agent ID, so each developer gets an independent dollar budget, with up to 20 rules per gateway. User Insights flags sessions that cost more than twice a user’s own 95th-percentile session and more than the organisation’s 99th percentile, which is a direct answer to the runaway-loop problem, although it alerts rather than blocks.

Trade-offs. Cloudflare’s Codex guide notes that Codex custom providers only use the Responses API, so through this configuration only OpenAI models work; Anthropic and Google models do not. No Cursor guide is published. Spend limits are eventually consistent, so a burst of concurrent requests can briefly exceed a cap. Enabling DLP response scanning buffers the full response, which raises time-to-first-token for streaming agents; Cloudflare suggests scanning requests only for latency-sensitive traffic. The documentation does not describe an MCP gateway in AI Gateway.

Best for: teams already on Cloudflare that care most about secret scanning and spend anomalies for Claude Code and Codex, and do not need Cursor or model swapping through the gateway.

5. Kong AI Gateway

Kong AI Gateway is a set of AI plugins on Kong Gateway, and Kong publishes how-to guides for routing both Claude Code and Codex CLI through it.

Strengths. For organisations that already run Kong, coding-agent traffic lands in the same declarative configuration, consumer model and logging pipeline as every other API, managed with decK. The Claude Code guide uses the AI Proxy plugin and file logging to inspect traffic; the Codex guide adds AI Proxy Advanced and a request transformer to normalise upstream paths. The AI MCP Proxy plugin can proxy upstream MCP servers, convert REST APIs into MCP tools and control tool access with consumer and consumer-group ACLs, which gives a Kong shop one place to govern both model and tool traffic.

Trade-offs. The Claude Code guide requires Kong Gateway Enterprise and version 3.13 or later, and both AI Proxy Advanced and AI MCP Proxy are “only available as part of our AI Gateway Enterprise offering”. The how-tos are written as tutorials for a single developer rather than rollout guides for a fleet, Kong publishes no Cursor guide, and the coding-agent pages do not cover per-developer budgets or model swapping for Claude Code.

Best for: organisations already licensed for Kong AI Gateway Enterprise that want coding agents under the same API policy as the rest of their traffic.

Other options

OpenRouter appears often in “claude code openrouter” searches as a way to reach many models from one key. It is a hosted model marketplace rather than a governance layer, and Bifrost’s Claude Code guide notes that OpenRouter did not stream tool-call arguments correctly at the time of writing, which breaks Claude Code file operations. Several community projects named claude-code-proxy translate Claude Code’s requests to OpenAI or Gemini for individual use; they solve model access for one developer, not governance for a team.

What actually differs between the five

On paper all five gateways “support Claude Code”. In practice they differ on five things that decide whether a rollout survives contact with real developers.

Model swapping, and Anthropic’s position on it

Running Claude Code against non-Anthropic models is the most searched and least supported use of a gateway. Anthropic’s gateway documentation states that it “doesn’t support routing Claude Code to non-Claude models through any gateway”. Bifrost, LiteLLM and Vercel all make it possible regardless: Bifrost through provider-prefixed model names and routing-rule aliases, LiteLLM through any model in its config, Vercel through its catalogue. The practical constraint is tool calling. Claude Code edits files and runs commands through tools, so a model that handles chat well but streams tool arguments badly will fail on the first edit. Treat each non-Claude model as a separate qualification exercise.

Model swapping in the other direction is similar. Codex expects the Responses API, so a gateway must translate Responses requests to Anthropic or Google formats for Codex to run Claude or Gemini. Bifrost and LiteLLM document that translation; Cloudflare’s guide says its Codex configuration supports OpenAI models only.

Per-developer identity and budgets

Every vendor agrees on the pattern Anthropic recommends: one gateway credential per developer, so usage is attributed and offboarding revokes one key. The differences are in what hangs off that credential.

For a deeper treatment of AI governance at the gateway layer, including how identity, budgets and audit trails fit together, the vendor’s own overview is a useful reference alongside this table.

Figure 2: Budgets stop overspending at the end of a period; per-key rate limits stop a runaway loop within minutes.

Agent loops and where to stop them

A coding agent turns one instruction into a loop of reads, edits, test runs and retries. When the loop gets stuck, it keeps calling the model with a growing context, and cost rises faster than linearly. Anthropic’s cost page notes that agent teams use tokens roughly in proportion to team size, because each teammate runs its own context window.

Three gateway controls address this, in increasing order of speed: monthly budgets, which cap the damage; anomaly alerts such as Cloudflare’s User Insights, which tell someone; and per-key token or request rate limits, which stop the loop within a window by returning HTTP 429. Bifrost and LiteLLM attach rate limits to the individual developer’s key, and LiteLLM’s budget documentation adds agent budgets with session-level caps on iterations and dollars. Cloudflare applies a request rate limit per gateway and spend limits per metadata value. Most teams will want all three layers, with the rate limit set generously enough not to interrupt normal sessions.

MCP tool governance

Coding agents increasingly reach internal systems through MCP servers, and a gateway that governs model calls but not tool calls leaves half the risk ungoverned. Bifrost and LiteLLM both put an MCP gateway in their open-source tiers, with tool access tied to the same keys that carry budgets; Bifrost’s allow-list is deny-by-default per key. Kong’s AI MCP Proxy offers consumer ACLs in its enterprise tier. Vercel and Cloudflare do not document an MCP gateway in their AI gateway products.

Cursor adds its own layer: Cursor Enterprise can enforce an MCP allowlist in server:tool syntax, distributed through MDM. The two approaches complement each other. Cursor’s allowlist decides which servers the editor may run; a gateway decides which tools each developer’s key may call on servers it fronts, across every agent. The site’s MCP gateway explainer covers the mechanism in depth.

Hosted versus self-hosted, and the Cursor wrinkle

Coding agents send source code, configuration and sometimes secrets in every prompt. A self-hosted gateway (Bifrost, LiteLLM, Kong) keeps that traffic inside the network until it reaches the provider; a hosted one (Vercel, Cloudflare) adds a third party to the data path. Cursor complicates the picture for everyone, because its requests already pass through Cursor’s servers and must reach a public gateway URL. A self-hosted gateway serving Cursor therefore needs a public, authenticated endpoint, even if Claude Code and Codex reach it privately.

Configuration that developers cannot quietly undo

The most overlooked difference is not in the gateways but in the clients. Anthropic’s allowedProviders managed setting can pin Claude Code to the gateway, and Codex refuses provider overrides from repository config files. Cursor Enterprise can block personal API keys. Combined with a gateway, these settings turn “please use the gateway” into enforced policy. Without them, any developer can unset an environment variable and go direct.

For laptops where the agent is not configured at all, the gap is wider. Bifrost pairs the gateway with Bifrost Edge, currently in early access, which runs on each machine and routes AI traffic from Claude Code, Codex CLI, Cursor and other supported applications through the gateway without per-app base-URL changes, so the same virtual keys, budgets and audit logs apply. The site’s analysis of shadow AI governance covers why endpoint coverage has become part of the gateway question.

Figure 3: The constraint you cannot change usually decides the shortlist before any feature comparison.

Recommendations keyed to constraints

• You must govern Claude Code, Codex CLI and Cursor together, self-hosted. Bifrost. It is the only gateway here with documented setups for all three in its open-source tier, per-developer virtual keys with budgets and rate limits, and deny-by-default MCP tool filtering. LiteLLM is the alternative for Python-first teams.
• You want to run Claude Code on Bedrock, Vertex or Azure without touching laptops. Point Claude Code at a gateway’s Anthropic Messages endpoint and change the upstream in gateway configuration. Bifrost, LiteLLM, Vercel and Cloudflare all document a Bedrock path; Anthropic’s own docs explain why the single Anthropic-format endpoint is what keeps provider changes off developer machines.
• You want Claude Code on non-Anthropic models. Anthropic’s documentation rules this configuration out of its support scope. Pick a gateway that translates formats (Bifrost, LiteLLM or Vercel) and qualify each model on real repository tasks before allowing it in a virtual key’s model list.
• You want zero operations. Vercel AI Gateway, whose CLI configures most agents in one command. Plan for the fact that prompts containing code will transit Vercel.
• Secret leakage worries you more than cost. Cloudflare AI Gateway’s DLP scans prompts for credentials. Scan requests only if streaming latency matters.
• You already run Kong Enterprise. Extend it, and budget for the enterprise plugins the coding-agent guides depend on.
• You only use Claude Code on Claude models. Evaluate Anthropic’s Claude apps gateway first; it ships with the CLI and tracks Claude Code’s headers release by release.

Whichever gateway you choose, distribute the configuration through managed settings rather than onboarding documents, issue one credential per developer, and set a per-key rate limit before the first long weekend.

The verdict

The coding-agent gateway is a narrower problem than the general AI gateway, and it rewards different things: support for three client dialects, identity per developer, controls that act within minutes, and MCP governance alongside model governance. Bifrost leads on those criteria because its documentation covers all of them for Claude Code, Codex CLI and Cursor in an Apache 2.0 gateway that teams can run inside their own network, with model swapping and the lowest published overhead in the group. LiteLLM is a strong second with the richest Claude Code recipes and a less settled Cursor story. Vercel and Cloudflare are the right answer when a hosted gateway is acceptable, and Kong when the Kong licence already exists.

The deciding question for most platform teams is not which Claude Code proxy is fastest, but which one they can put in front of every agent, on every laptop, with a budget and a tool allow-list per developer, and still change the model underneath next quarter without a single configuration change on a developer machine.