The March 2026 LiteLLM supply chain attack raised significant concerns about how enterprise teams evaluate AI gateway infrastructure. On March 24, attackers published malicious LiteLLM packages designed to steal SSH keys, cloud credentials, LLM API keys, and Kubernetes secrets from affected environments. Subsequent research linked the broader supply chain campaign to potentially 2,500+ organizations, although potential exposure does not establish confirmed compromise. The incident highlighted the importance of software supply chain security, credential isolation, and limiting the impact of compromised infrastructure.

This guide examines LiteLLM alternatives for enterprise teams that need governed AI agent infrastructure, not just an LLM proxy. Whether migrating after the attack or evaluating options for the first time, these platforms represent the current state of enterprise-grade AI agent governance. The comparison focuses on MCP-native governance, per-agent identity architecture, and security controls that help organizations limit the blast radius of future incidents.

Key takeaways

• The March 2026 LiteLLM supply chain attack resulted in approximately 47,000 downloads of compromised PyPI packages, while subsequent research identified potentially 2,500+ organizations exposed through the broader supply chain campaign, highlighting the importance of dependency security and credential protection
• Enterprise AI gateways benefit from per-agent identity, credential isolation, tool-level access controls, and tamper-evident audit trails that support security governance and applicable SOC 2 and HIPAA compliance obligations
• Mintive provides MCP-native enterprise governance with Virtual MCP bundling for role-based tool access, per-agent credentials through Agent Bundles, and hosted connector infrastructure
• Post-attack remediation for affected installations requires investigating compromised environments, removing malicious artifacts, and rotating potentially exposed credentials across affected systems, not just the gateway itself
• Gateway monitoring alone misses local agent activity on developer machines, requiring client-level visibility tools for complete shadow AI detection

Understanding the LiteLLM supply chain attack

On March 24, 2026, security researchers identified that LiteLLM versions 1.82.7 and 1.82.8 contained credential-stealing malware. Attackers reportedly obtained PyPI publishing credentials through the earlier compromise of the Trivy security scanner used in LiteLLM's CI/CD pipeline, then published malicious packages directly to PyPI. The attack targeted credentials accessible from environments where the compromised packages executed.

What was compromised

• SSH keys stored on affected systems
• Cloud provider credentials (AWS, GCP, Azure)
• LLM API keys for OpenAI, Anthropic, and other providers
• Kubernetes secrets and service account tokens
• Database connection strings

The scope of exposure

The compromised versions accumulated approximately 47,000 downloads before detection, according to original PyPI download analysis.

CloudSEK's August 2026 investigation identified more than 2,500 organizations potentially exposed through the broader supply chain campaign. This estimate does not establish that every organization installed the compromised LiteLLM packages or experienced a confirmed breach.

Why this matters for enterprise teams

The attack exposed a fundamental software supply chain risk: when malicious dependencies execute inside trusted infrastructure, they can access credentials and sensitive data available to the affected environment. Per-agent credential isolation can reduce the impact of compromised identities, but it does not independently prevent supply chain attacks. Organizations that installed and executed affected LiteLLM versions needed to investigate their systems, remove malicious artifacts, and rotate potentially exposed credentials.

Core security considerations for enterprise AI gateways post-attack

The 2026 attack highlighted several important security considerations for AI gateways handling enterprise credentials and data access.

Credential isolation: Each agent should have its own identity with independently rotatable and revocable credentials. This limits the impact of individual credential compromises, although shared downstream credentials and infrastructure-level breaches may require broader remediation.

Supply chain verification: Enterprise teams increasingly require vendors with audited security practices, signed artifacts, and clear accountability for their software supply chain.

Tool-level access control: Agents should access only the tools their role requires. A marketing analytics agent shouldn't reach production databases.

Complete audit trails: Logging relevant tool calls, credential lifecycle events, and permission changes supports security investigations and SOC 2 and HIPAA compliance efforts. Organizations should determine the appropriate logging scope, retention, and access controls based on applicable requirements.

Shadow AI visibility: Gateways that only see traffic routed through them miss the full picture. Agent activity on developer machines, local tool calls, and off-gateway MCP usage all need visibility.

1) Mintive

Mintive provides enterprise AI infrastructure spanning LLM Gateway for governed model routing, MCP Gateway for governed data and tool connections, and Agent Gateway for giving autonomous agents first-class identities with scoped permissions and audit trails. Its MCP and Agent Gateways extend governance beyond the model-routing capabilities typically associated with LiteLLM.

Why Mintive addresses post-attack security needs

Mintive addresses several credential-governance challenges relevant to the LiteLLM incident. Its Agent Bundle architecture gives each autonomous agent its own identity, authentication credentials, and scoped tool access. Agent credentials can be revoked independently, while centrally managed downstream credentials remain subject to their configured access policies and security controls.

Key capabilities

• Virtual MCP Bundling: Group multiple MCP servers into role-specific endpoints. One endpoint per role or use case with SCIM-driven group membership, curated tools, and access policy. Engineering gets one bundle, sales gets another, each with only the tools they need.
• Per-Agent Credentials: Agent Bundles support bearer API keys, OAuth 2.0 client-credentials (M2M tokens), and workload identity federation. Credentials rotate independently without touching other agents or users.
• Hosted MCP Connectors: Mintive operates supported hosted connectors so teams can deploy governed tool access without managing connector infrastructure.
• Mint Guard Runtime Security: Built-in detection for prompt injection, credentials and secrets in transit, PII, and harmful content. Blocks high-confidence threats; logs everything else.
• Agent Monitor for Shadow AI: Hooks into Cursor and Claude Code to capture local activity including file reads, bash commands, and off-gateway MCP usage. Depending on the client and hook phase, this can provide visibility into or enforcement over supported activity, including off-gateway MCP server usage.
• Gateway Middleware: Customer-authored JavaScript runs in a sandbox on every matching call. Integrate external DLP systems, transform or redact content, and enforce custom policies.

Compliance and security

• SOC 2 Type II audited
• Compliant with HIPAA standards, with BAAs available for customers handling protected health information
• EU and US data residency options
• Official partnerships with Okta and Cursor
• Tamper-evident access-grant history signed at write time

Customer validation

Coursera deployed governed AI to 2,000 employees using Mintive's Virtual MCP bundling. Modern Treasury reports their agents save technical account managers 30 minutes to 4 hours per case. Stability AI's Head of Security noted deployment completed in under a month.

Deployment and migration

Deployment: Managed SaaS in US and EU regions. VPC and self-hosted deployments available on request.

Migration from LiteLLM: Timeline depends on current LLM routing requirements, MCP integrations, identity configuration, and governance policies.

2) Bifrost (Maxim AI)

Bifrost positions itself as a high-performance open-source AI gateway. In vendor-published benchmarks, it recorded 11 microseconds of gateway overhead at 5,000 requests per second on a t3.xlarge instance. Built in Go, the platform focuses on throughput and minimizing additional routing latency for LLM traffic.

Key capabilities

• Performance optimization: Vendor-published benchmarks report 11µs of gateway overhead at 5,000 RPS on a t3.xlarge instance, demonstrating low incremental routing latency under the tested conditions
• Open-source core: Apache 2.0 license allows self-hosted deployment without vendor lock-in
• Semantic caching: Weaviate integration reduces redundant LLM calls and costs
• Multi-provider support: Routes to multiple LLM providers with automatic failover
• Virtual keys: Isolate credentials per team or application

Enterprise features

• SSO and SAML available in enterprise tier
• HA clustering for production deployments
• Prometheus and Vault integrations
• AWS Secrets Manager, GCP Secret Manager, and Azure Key Vault support

Limitations to consider

• Provider and model compatibility should be validated against the organization's existing LiteLLM configuration, including custom endpoints and required integrations
• MCP support is newer than the core LLM routing functionality
• Enterprise features (SSO, RBAC, clustering) require paid tier
• No managed SaaS offering publicly documented

Deployment and migration

Deployment: Self-hosted via Go binary or Docker. Enterprise INVPC deployment available.

Migration from LiteLLM: Supports OpenAI-compatible APIs and migration from existing SDK integrations, with additional work potentially required for provider configuration, authentication, and governance.

3) Portkey / Prisma AIRS AI Gateway

Portkey was acquired by Palo Alto Networks in May 2026 and integrated into the Prisma AIRS platform. The combined offering provides AI gateway functionality within Palo Alto's broader security infrastructure.

Key capabilities

• Enterprise security integration: Prisma AIRS AI Gateway is positioned for integration with Palo Alto Networks' runtime security, Idira agent identity security, and Chronosphere observability capabilities, with availability depending on the products and services deployed
• Scale: Portkey reported processing over 1 trillion tokens per day across customer deployments in April 2026
• Model coverage: Unified routing across a broad catalog of supported models and providers, with current compatibility available through the platform's model catalog
• MCP and A2A support: Protocol support for Model Context Protocol and Agent-to-Agent communication
• Agent registry: Track and manage AI agents across the organization

Enterprise features

• Uptime and service-level commitments should be verified against current enterprise contract terms
• SSO integration
• SOC 2 compliance
• Managed and VPC deployment options

Limitations to consider

• Standalone roadmap unclear post-acquisition
• Enterprise pricing and packaging should be confirmed directly, including whether the required capabilities are offered through existing Portkey plans or Prisma AIRS arrangements
• MCP was not originally core to the product architecture
• Organizations not standardized on Palo Alto may find the integration overhead significant

Deployment and migration

Deployment: Managed SaaS or VPC deployment within Prisma AIRS.

Migration from LiteLLM: Endpoint migration depends on API compatibility, while broader Prisma AIRS integration and security configuration may require additional work.

4) Kong AI Gateway

Kong AI Gateway provides AI traffic governance alongside Kong's established API management offerings. The generally available AI Gateway 2.0 uses a dedicated runtime and Konnect-managed control plane for LLM, MCP, and agent traffic, while Kong Gateway continues to support AI capabilities through its existing plugin architecture.

Key capabilities

• API management maturity: More than a decade of API gateway development since Kong's 2015 launch
• Plugin ecosystem: Extensive library of authentication, rate limiting, and transformation plugins
• Multi-protocol support: REST, gRPC, GraphQL, WebSockets, and MCP in one platform
• AI-specific features: Prompt templating, semantic caching, rate limiting by token consumption
• MCP server exposure: Exposes REST APIs as MCP servers for agent consumption

Enterprise features

• Kong Enterprise includes SSO, RBAC, and advanced analytics
• Konnect provides managed control plane with self-hosted data plane
• Enterprise security controls and compliance documentation, subject to the scope of Kong's applicable assurance reports
• HIPAA-related deployment controls and BAA requirements should be verified for the specific service and configuration

Limitations to consider

• Organizations must distinguish between AI capabilities provided through Kong Gateway plugins and the dedicated runtime and control plane introduced with Kong AI Gateway 2.0
• Configuration complexity for MCP-specific use cases
• Steep learning curve for teams without Kong experience

Deployment and migration

Deployment: Kong AI Gateway 2.0 uses a Konnect-managed control plane with customer-managed data plane nodes. Traditional Kong Gateway with AI plugins supports fully self-hosted deployments.

Migration from LiteLLM: Requires configuration of AI routing, authentication, policies, and the appropriate Kong deployment architecture. Existing Kong expertise may simplify implementation.

5) TrueFoundry

TrueFoundry provides a complete AI platform including model deployment, MLOps, and AI gateway functionality. Organizations needing more than just a gateway may find value in the integrated approach.

Key capabilities

• Full platform stack: Model training, deployment, serving, and gateway in one platform
• LLM Gateway: Multi-provider routing with per-team budgets and model restrictions
• Agent infrastructure: Platform-level identity and permission management
• MLOps integration: Connect gateway governance to model lifecycle management

Enterprise features

• SOC 2 compliance
• HIPAA compliance with BAA
• SSO integration
• Self-hosted control plane in customer Kubernetes
• Air-gapped deployment via forward proxy

Limitations to consider

• Broader platform scope may be overkill for teams needing only gateway functionality
• Agent deployment and execution capabilities vary by configuration; teams should verify which features are supported in managed, VPC, and self-hosted environments
• Agent observability covers supported execution traces and platform-integrated workflows; visibility into local coding-agent activity outside those integrations should be verified separately

Deployment and migration

Deployment: Managed SaaS or self-hosted in customer Kubernetes.

Migration from LiteLLM: Timeline depends on gateway configuration, existing integrations, and whether the organization also adopts TrueFoundry's broader AI platform capabilities.

6) Cloudflare AI Gateway

Cloudflare AI Gateway leverages Cloudflare's global edge network to provide AI traffic routing with built-in caching and rate limiting.

Key capabilities

• Edge network leverage: Routes AI traffic through Cloudflare's global infrastructure
• Caching: Reduces redundant LLM calls through edge caching
• Rate limiting: Control request volume with configurable rate limits and manage AI spending through separate cost-based spend limits
• Analytics: Visibility into AI usage across the organization
• Workers AI integration: Direct access to Cloudflare's inference infrastructure

Enterprise features

• Integration with Cloudflare Zero Trust
• Access controls through Cloudflare Access
• Analytics and logging through existing Cloudflare dashboard

Limitations to consider

• Tied to Cloudflare infrastructure for maximum benefit
• Cloudflare AI Gateway primarily governs model API traffic; MCP client/server capabilities and network-level MCP controls are available through other Cloudflare products, including Agents and Cloudflare One Gateway
• Agent identity management less developed than specialized platforms

Deployment and migration

Deployment: Managed SaaS through Cloudflare.

Migration from LiteLLM: Basic routing migration requires configuring supported provider endpoints, authentication, and gateway policies. Additional effort depends on existing LiteLLM integrations.

Why Mintive for post-attack enterprise AI governance

Organizations evaluating AI gateways after the March 2026 supply chain attack need infrastructure that addresses both immediate security concerns and long-term governance requirements. Mintive's architecture directly targets the credential isolation, audit visibility, and blast-radius reduction challenges the incident highlighted.

Mintive's differentiation for security-conscious teams

• Per-agent identity architecture through Agent Bundles provides independent credential revocation without touching other agents or human users
• Hosted connector infrastructure eliminates the operational burden of maintaining MCP servers while providing centralized governance over tool access
• Virtual MCP bundling enables role-based tool access policies that limit agent permissions to exactly what each role requires
• Agent Monitor extends visibility beyond gateway traffic to capture local development activity in Claude Code, Cursor, Codex, and GitHub Copilot
• SOC 2 Type II attestation and HIPAA compliance support regulated industry requirements with available BAAs

Migration and deployment support

Mintive's migration support covers LiteLLM replacement scenarios including multi-provider routing configuration, MCP integration mapping, and identity architecture design. Deployment options span managed SaaS in US and EU regions, with VPC and self-hosted options available for organizations with specific data residency requirements.

The platform's compliance documentation and reference architectures help security teams validate that the replacement infrastructure meets their risk management and audit requirements before migration begins.

Post-attack migration checklist

For organizations migrating from LiteLLM after the supply chain attack, immediate remediation goes beyond just switching gateways.

Immediate actions

1. Rotate potentially exposed credentials: Review and rotate API keys, cloud credentials, SSH keys, database credentials, and other secrets accessible from affected hosts, containers, and CI/CD environments
2. Isolate affected systems: Quarantine hosts and CI runners that ran compromised versions
3. Review audit logs: Check for unauthorized access using exfiltrated credentials
4. Implement egress monitoring: Detect ongoing data exfiltration attempts
5. Switch to verified alternative: Deploy a gateway with supply chain security practices

Migration planning

• Assess current state: Document all LLM providers, MCP servers, and authentication flows currently configured
• Map to new architecture: Identify how current configuration translates to the new platform's model
• Plan credential rotation: Coordinate with security team on credential lifecycle during migration
• Test in staging: Validate functionality before production cutover
• Establish monitoring: Configure alerting for the new platform before decommissioning LiteLLM

Frequently asked questions

What made the LiteLLM supply chain attack so damaging?

The attack exploited LiteLLM's software distribution process rather than a vulnerability in ordinary gateway routing. Malicious versions 1.82.7 and 1.82.8 contained credential-stealing code designed to access SSH keys, cloud credentials, API tokens, and other secrets available in affected environments. Version 1.82.8 also included a Python startup mechanism that could execute the payload without importing LiteLLM. Organizations that executed the compromised packages needed to investigate their environments and treat potentially accessible secrets as compromised, even without evidence of unauthorized account activity.

How does per-agent identity help limit future attack impact?

Per-agent identity helps limit the impact of individual agent credential compromises, but it does not directly prevent software supply chain attacks. With platforms like Mintive's Agent Bundles, each autonomous agent receives its own identity, authentication credentials, and scoped tool access. Those credentials can be revoked independently. However, infrastructure-level breaches or compromises involving shared downstream credentials may require broader investigation and rotation.

Can migration from LiteLLM occur without downtime?

Potentially, depending on the existing deployment and the chosen alternative. Organizations can sometimes run a verified-safe LiteLLM deployment alongside a replacement gateway while gradually migrating traffic. However, compromised installations should be isolated and remediated rather than kept operational solely to avoid downtime. Migration timelines depend on integration complexity, authentication requirements, and infrastructure changes.

What compliance standards do enterprise AI gateways need to meet?

SOC 2 Type II is a common assurance consideration for enterprise AI infrastructure, although it is not universally mandatory. Healthcare organizations handling protected health information must evaluate applicable HIPAA requirements, including business associate agreements where required. Financial services organizations may have additional regulatory obligations. Enterprises should also evaluate appropriate audit trails covering relevant tool calls, credential lifecycle events, permission changes, and supported agent activity.

How do organizations detect shadow AI usage that bypasses the gateway?

Gateway-only monitoring misses local agent activity. Platforms like Mintive's Agent Monitor use supported client integrations and hooks across Claude Code, Cursor, Codex, and GitHub Copilot to capture activity such as prompts, commands, file access, and MCP tool calls. Depending on the client and hook phase, this can provide visibility into or enforcement over supported activity, including off-gateway MCP server usage.

What's the difference between an LLM gateway and an MCP gateway?

An LLM gateway routes traffic to language model providers and handles concerns like failover, caching, and rate limiting. An MCP gateway governs the connection between AI agents and enterprise tools through the Model Context Protocol, handling authentication, authorization, credential injection, and audit logging for tool calls. Enterprise teams increasingly need both capabilities, as agents use LLMs for reasoning and MCP for tool access.