{ "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-07", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "tool": { "slug": "litellm", "name": "LiteLLM", "vendor": "BerriAI", "vendorUrl": "https://www.litellm.ai", "kind": "router", "category": "inference", "summary": "Open-source Python SDK and self-hosted AI gateway from BerriAI that puts 100+ model providers behind one OpenAI-compatible API, with virtual keys, spend tracking, budgets, fallbacks, guardrails and an MCP gateway.", "url": "https://www.anchorterminal.com/tools/litellm", "markdownUrl": "https://www.anchorterminal.com/tools/litellm.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/litellm.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/litellm.json", "dns": "litellm.grade.anchorterminal.com", "repo": "https://github.com/BerriAI/litellm", "license": "MIT, except the enterprise/ directory, which is under its own licence and needs an Enterprise licence key", "transports": [ "http" ], "packages": [ { "registry": "pypi", "name": "litellm" }, { "registry": "docker", "name": "docker.litellm.ai/berriai/litellm" } ], "auth": "api-key", "authNotes": "The gateway takes a Bearer key. `LITELLM_MASTER_KEY` is required at start-up and has full admin rights. Virtual keys, stored hashed, carry model, route, MCP server, budget, rate-limit and expiry limits and can be blocked. Key rotation with a grace period, SSO beyond five users, SCIM and JWT/OIDC auth need an Enterprise licence. `/key/info` takes the key being looked up as a `?key=` query parameter.", "pricing": "freemium", "pricingNotes": "Free to self-host under MIT, with no account or card. Model calls bill at each upstream provider's own prices on the operator's keys. Enterprise (SSO, audit logs, key rotation, team-scoped guardrails, support SLAs) is an annual licence priced through sales, with a 30-day trial key emailed after a form and no card (https://www.litellm.ai/pricing, https://www.litellm.ai/enterprise).", "priceSummary": "Freemium", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the docs index or the llms-full.txt file, read 2026-10-06. The gateway forwards to providers on the operator's keys.", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 62841, "npmWeekly": null, "pypiWeekly": 22493278, "asOf": "2026-11-06" }, "docsUrl": "https://docs.litellm.ai", "llmsTxt": "https://docs.litellm.ai/llms.txt", "openapi": "https://docs.litellm.ai/api-reference/", "capabilities": [ "inference.router", "obs.gateway", "agent.mcp-client", "guard.pii" ], "tags": [ "self-hosted", "open-source", "router", "gateway", "mcp", "openapi", "llms-txt", "python", "docker", "bug-bounty", "soc2" ], "lastRelease": "2026-11-05", "graded": true, "anchor": { "graded": true, "score": 62.4, "grade": "B", "agentReady": false, "rank": 557, "ranked": true, "rankOf": 1486, "categoryRank": 20, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 79, "maintenance": 82, "payments": 60, "reliability": 70, "schema": 91, "security": 72, "transparency": 63 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 70, "points": 14, "reason": "Read with the local-software lines, since the gateway runs on the operator's hardware and BerriAI hosts nothing an agent calls. litellm on PyPI states Python 3.10 to 3.14, and the gateway ships as a Docker image, a Helm chart and Terraform modules, with GHCR images signed by cosign (20). 51 GitHub Actions workflows plus a CircleCI config cover unit, proxy-database, end-to-end, chaos, mutation and UI tests. The GitHub API was rate-limited for our reader on 6 November and Actions pages refused it on 6 October, so we couldn't confirm main is passing (15 of 25). The issue tracker showed 1,674 open issues on 6 November, with eight bug reports among the 15 newest, seven of them with a reply, against a project that tags several releases a day (10 of 25, down from an unchecked 12). Release notes carry breaking-change bullets, but breaking changes land in weekly minor releases on the 1.x line, so version numbers don't signal them (10 of 15). 1.108.1, past 1.0 (15).", "checked": "2026-11-06" }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 91, "points": 14.79, "reason": "Every gateway serves Swagger at /, ReDoc at /redoc and the raw schema at /openapi.json, and the docs host a public Swagger explorer (25). llms.txt, llms-full.txt and a Markdown twin of every page via `.md` (10). Pages say what a feature is for and where its limits are, and the key-auth page explains how permissions are inherited and where they aren't, but the reference is very large for a model to navigate (16 of 20). OpenAI-shaped request schemas from Pydantic models, with `metadata`, `litellm_params` and config blocks left as free-form objects (10 of 15). A full error reference with the envelope, every status, response headers and how to tell gateway limits from provider limits, plus examples on every page (15). Release notes per version with dates, newest v1.108.0 and v1.106.7 on 4 November 2026 (15).", "checked": "2026-11-06" }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 79, "points": 12.84, "reason": "Read with the API lines for the gateway an agent calls. Responses size through the usual `max_tokens` and streaming, and the MCP gateway can replace a large tool catalogue with four virtual tools (tool search) or filter tools by semantic relevance, which cuts context cost (20 of 25). Key, team and spend listings page and filter, though we didn't check every list call (15 of 20). Errors keep the OpenAI envelope with a string `code`, gateway 429s carry `retry-after`, `rate_limit_type` and `reset_at`, management routes answer RFC 9457 problem+json, and a table says which errors are safe to retry (20). Retries, cooldowns and fallbacks run inside the gateway and the docs say which errors to retry, but there are no idempotency keys for the management writes (12 of 20). Any OpenAI or Anthropic SDK works by changing the base URL, but the only first-party client is the Python SDK, and keys and spend need Postgres and a master key before the first call (12 of 15).", "checked": "2026-11-06" }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 72, "points": 12.6, "reason": "Read with the tool checklist for self-hosted software. Virtual keys are hashed, revocable and blockable, with model, route, MCP server, budget, rate and expiry limits, and a `proxy_admin_viewer` read-only role exists. Rotation with a grace period is Enterprise only, so 25, less 10 because the docs pass a key as `?key=` on `/key/info` and on the Claude Code marketplace manifest (15 of 30). `allowed_routes`, MCP permissions by key and team, an approval queue for submitted MCP servers and stdio MCP servers off by default from 1.104.0 (15 of 20). Guardrails can run before a model call and on MCP tool results, and an OWASP LLM Top 10 page maps each risk to a control, but prompt-injection detectors such as Lakera need an Enterprise licence and all of it is off by default (12 of 15). Request and spend logs per key in the open-source build; audit logs of admin actions are Enterprise only (12 of 15). security.md with GitHub private reporting, a bug bounty from $500 to $3,000 for P0 and P1 reports, a security announcements list, SOC 2 Type II per the data security page, CodeQL, OSV and Scorecard workflows, and advisories published on GitHub. No security.txt, and reports without a video are closed unread (18 of 20).", "checked": "2026-11-06" }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 60, "points": 7.5, "reason": "Read with the self-hosted rule, since an agent uses the free gateway and Enterprise is a sales-led licence for the same software. No x402, MPP or L402 (0). MIT with no account and no card, so 20, 20 and 20 on the last three lines. Model calls cost what the operator's provider keys cost.", "checked": "2026-11-06" }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 82, "points": 7.18, "reason": "v1.108.1 tagged on 5 November 2026, v1.108.0 and v1.106.7 on 3 and 4 November (30). 125 tags between 8 August and 6 November, stable, patch, release-candidate and dev builds, with patch releases for four minor lines at once (20). Reply times not measured. On the issues page 7 of the 15 newest had a reply on the day, workflows auto-close duplicates and label issues, and Discord is the listed community channel (12 of 25). The package is the official SDK, current, with OpenAI and Anthropic SDKs working against the gateway (12 of 15). Dependency and image scanning (OSV, zizmor, Scorecard, grype) run in CI, with pass state unchecked (8 of 10).", "checked": "2026-11-06" }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 63, "points": 5.51, "note": "editorial 77, provenance 49", "reason": "MIT for everything outside enterprise/, which has its own licence (25 of 30). The data security page (updated 6 November 2026) and security.md agree that a self-hosted gateway sends no data or telemetry to BerriAI, and the gateway stores prompts and spend in the operator's own Postgres. We found no terms of service or privacy policy on litellm.ai for its site, trial or Enterprise licence (20 of 30). A version support policy since 29 June 2026 (four stable minor lines), deprecated pages labelled in the docs, and release notes with breaking-change bullets (15 of 20). Usage telemetry, new in v1.107.0, is off by default, lists every field it can send and goes only to a table or endpoint the operator sets. A main-branch commit of 23 October 2026 made the Admin UI chat post a hashed user id to chat-telemetry.litellm.ai, and it was removed on 24 October before any tagged release contained it, so it isn't deducted. The start-up fetch of the price map from GitHub is documented with an opt-out (17 of 20).", "checked": "2026-11-06" } ], "assessment": { "date": "2026-11-06", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "Read with the API lines for the gateway an agent calls. Responses size through the usual `max_tokens` and streaming, and the MCP gateway can replace a large tool catalogue with four virtual tools (tool search) or filter tools by semantic relevance, which cuts context cost (20 of 25). Key, team and spend listings page and filter, though we didn't check every list call (15 of 20). Errors keep the OpenAI envelope with a string `code`, gateway 429s carry `retry-after`, `rate_limit_type` and `reset_at`, management routes answer RFC 9457 problem+json, and a table says which errors are safe to retry (20). Retries, cooldowns and fallbacks run inside the gateway and the docs say which errors to retry, but there are no idempotency keys for the management writes (12 of 20). Any OpenAI or Anthropic SDK works by changing the base URL, but the only first-party client is the Python SDK, and keys and spend need Postgres and a master key before the first call (12 of 15).", "maintenance": "v1.108.1 tagged on 5 November 2026, v1.108.0 and v1.106.7 on 3 and 4 November (30). 125 tags between 8 August and 6 November, stable, patch, release-candidate and dev builds, with patch releases for four minor lines at once (20). Reply times not measured. On the issues page 7 of the 15 newest had a reply on the day, workflows auto-close duplicates and label issues, and Discord is the listed community channel (12 of 25). The package is the official SDK, current, with OpenAI and Anthropic SDKs working against the gateway (12 of 15). Dependency and image scanning (OSV, zizmor, Scorecard, grype) run in CI, with pass state unchecked (8 of 10).", "payments": "Read with the self-hosted rule, since an agent uses the free gateway and Enterprise is a sales-led licence for the same software. No x402, MPP or L402 (0). MIT with no account and no card, so 20, 20 and 20 on the last three lines. Model calls cost what the operator's provider keys cost.", "reliability": "Read with the local-software lines, since the gateway runs on the operator's hardware and BerriAI hosts nothing an agent calls. litellm on PyPI states Python 3.10 to 3.14, and the gateway ships as a Docker image, a Helm chart and Terraform modules, with GHCR images signed by cosign (20). 51 GitHub Actions workflows plus a CircleCI config cover unit, proxy-database, end-to-end, chaos, mutation and UI tests. The GitHub API was rate-limited for our reader on 6 November and Actions pages refused it on 6 October, so we couldn't confirm main is passing (15 of 25). The issue tracker showed 1,674 open issues on 6 November, with eight bug reports among the 15 newest, seven of them with a reply, against a project that tags several releases a day (10 of 25, down from an unchecked 12). Release notes carry breaking-change bullets, but breaking changes land in weekly minor releases on the 1.x line, so version numbers don't signal them (10 of 15). 1.108.1, past 1.0 (15).", "schema": "Every gateway serves Swagger at /, ReDoc at /redoc and the raw schema at /openapi.json, and the docs host a public Swagger explorer (25). llms.txt, llms-full.txt and a Markdown twin of every page via `.md` (10). Pages say what a feature is for and where its limits are, and the key-auth page explains how permissions are inherited and where they aren't, but the reference is very large for a model to navigate (16 of 20). OpenAI-shaped request schemas from Pydantic models, with `metadata`, `litellm_params` and config blocks left as free-form objects (10 of 15). A full error reference with the envelope, every status, response headers and how to tell gateway limits from provider limits, plus examples on every page (15). Release notes per version with dates, newest v1.108.0 and v1.106.7 on 4 November 2026 (15).", "security": "Read with the tool checklist for self-hosted software. Virtual keys are hashed, revocable and blockable, with model, route, MCP server, budget, rate and expiry limits, and a `proxy_admin_viewer` read-only role exists. Rotation with a grace period is Enterprise only, so 25, less 10 because the docs pass a key as `?key=` on `/key/info` and on the Claude Code marketplace manifest (15 of 30). `allowed_routes`, MCP permissions by key and team, an approval queue for submitted MCP servers and stdio MCP servers off by default from 1.104.0 (15 of 20). Guardrails can run before a model call and on MCP tool results, and an OWASP LLM Top 10 page maps each risk to a control, but prompt-injection detectors such as Lakera need an Enterprise licence and all of it is off by default (12 of 15). Request and spend logs per key in the open-source build; audit logs of admin actions are Enterprise only (12 of 15). security.md with GitHub private reporting, a bug bounty from $500 to $3,000 for P0 and P1 reports, a security announcements list, SOC 2 Type II per the data security page, CodeQL, OSV and Scorecard workflows, and advisories published on GitHub. No security.txt, and reports without a video are closed unread (18 of 20).", "transparency": "MIT for everything outside enterprise/, which has its own licence (25 of 30). The data security page (updated 6 November 2026) and security.md agree that a self-hosted gateway sends no data or telemetry to BerriAI, and the gateway stores prompts and spend in the operator's own Postgres. We found no terms of service or privacy policy on litellm.ai for its site, trial or Enterprise licence (20 of 30). A version support policy since 29 June 2026 (four stable minor lines), deprecated pages labelled in the docs, and release notes with breaking-change bullets (15 of 20). Usage telemetry, new in v1.107.0, is off by default, lists every field it can send and goes only to a table or endpoint the operator sets. A main-branch commit of 23 October 2026 made the Admin UI chat post a hashed user id to chat-telemetry.litellm.ai, and it was removed on 24 October before any tagged release contained it, so it isn't deducted. The start-up fetch of the price map from GitHub is documented with an opt-out (17 of 20)." }, "sources": [ { "what": "docs index", "url": "https://docs.litellm.ai/llms.txt", "seen": "2026-11-06" }, { "what": "full docs text, error reference, rate limits, OpenAPI switches", "url": "https://docs.litellm.ai/llms-full.txt", "seen": "2026-10-06" }, { "what": "data privacy and security, legal entity, telemetry", "url": "https://docs.litellm.ai/docs/data_security.md", "seen": "2026-11-06" }, { "what": "security.md, disclosure policy and bug bounty", "url": "https://github.com/BerriAI/litellm/blob/main/security.md", "seen": "2026-10-06" }, { "what": "supply-chain incident report", "url": "https://docs.litellm.ai/blog/security-update-march-2026.md", "seen": "2026-10-06" }, { "what": "malware advisory", "url": "https://api.osv.dev/v1/vulns/GHSA-5mg7-485q-xm76", "seen": "2026-10-06" }, { "what": "advisories for the litellm package", "url": "https://api.osv.dev/v1/query", "seen": "2026-11-06" }, { "what": "enterprise extras, support SLAs, version support policy", "url": "https://docs.litellm.ai/docs/enterprise.md", "seen": "2026-10-06" }, { "what": "virtual keys, rotation, blocking", "url": "https://docs.litellm.ai/docs/proxy/virtual_keys.md", "seen": "2026-10-06" }, { "what": "gateway quickstart", "url": "https://docs.litellm.ai/docs/proxy/docker_quick_start.md", "seen": "2026-10-06" }, { "what": "Claude Code client setup", "url": "https://docs.litellm.ai/docs/proxy/client_setup/claude_code.md", "seen": "2026-10-06" }, { "what": "release notes", "url": "https://docs.litellm.ai/release_notes", "seen": "2026-11-06" }, { "what": "pricing", "url": "https://www.litellm.ai/pricing", "seen": "2026-11-06" }, { "what": "enterprise trial", "url": "https://www.litellm.ai/enterprise", "seen": "2026-11-06" }, { "what": "PyPI releases", "url": "https://pypi.org/pypi/litellm/json", "seen": "2026-10-06" }, { "what": "PyPI downloads", "url": "https://pypistats.org/api/packages/litellm/recent", "seen": "2026-11-06" }, { "what": "repository, LICENSE, workflows, source", "url": "https://github.com/BerriAI/litellm", "seen": "2026-11-06" }, { "what": "RDAP for litellm.ai", "url": "https://rdap.identitydigital.services/rdap/domain/litellm.ai", "seen": "2026-10-06" }, { "what": "usage telemetry", "url": "https://docs.litellm.ai/docs/proxy/telemetry.md", "seen": "2026-11-06" }, { "what": "advisory GHSA-7hp6-4w63-5g45", "url": "https://api.osv.dev/v1/vulns/GHSA-7hp6-4w63-5g45", "seen": "2026-11-06" }, { "what": "advisory GHSA-g5ff-637f-6q2m", "url": "https://api.osv.dev/v1/vulns/GHSA-g5ff-637f-6q2m", "seen": "2026-11-06" }, { "what": "issue tracker", "url": "https://github.com/BerriAI/litellm/issues", "seen": "2026-11-06" }, { "what": "pull request removing chat telemetry", "url": "https://github.com/BerriAI/litellm/pull/48225", "seen": "2026-11-06" } ], "openQuestions": [ "unchecked: whether CI passes on main, since the GitHub API was rate-limited for our reader on 6 November and Actions and CircleCI refused it on 6 October", "unchecked: reply times on issues and pull requests and who answered them; only the first page of the issue list was read on 6 November", "No terms of service or privacy policy found on www.litellm.ai for the site, the trial or LiteLLM Cloud, which security.md still describes", "SOC 2 Type II is a vendor claim; the report sits behind trust.litellm.ai and wasn't read", "The kind is `router` to match openrouter, but it's self-hosted software, so reliability uses the local-software lines" ] }, "negative": -12, "negativeNotes": [ "2026-03-24, -6. litellm 1.82.7 and 1.82.8 were uploaded to PyPI with a credential stealer that read environment variables, SSH keys, cloud and Kubernetes credentials and sent them to models.litellm.cloud. They were live for about 40 minutes before PyPI quarantined them, after a token leaked through the Trivy compromise. BerriAI published indicators, checksums and a rebuilt pipeline (v1.83.0, 30 March). A supply-chain incident that reached users, fixed, documented and six months old. https://docs.litellm.ai/blog/security-update-march-2026, https://api.osv.dev/v1/vulns/GHSA-5mg7-485q-xm76", "2026-04-24, -2. GHSA-r75f-5x8p-qvmc (CVE-2026-42208, critical). An unauthenticated SQL injection through the `Authorization` header in proxy key verification, affecting 1.81.16 up to 1.83.7. Fixed and published, inside six months. https://api.osv.dev/v1/vulns/GHSA-r75f-5x8p-qvmc", "2026-06-16, -2. GHSA-4xpc-pv4p-pm3w (CVE-2026-49468, critical). A crafted Host header could reach protected management routes without authentication where nothing upstream normalises Host. Fixed in 1.84.0. https://api.osv.dev/v1/vulns/GHSA-4xpc-pv4p-pm3w", "2026-08-27, -2. GHSA-6wvf-77m9-58rm (CVE-2026-37004, critical). Server-side template injection in /prompts/test let unauthenticated callers run OS commands in 1.82.4 and earlier, fixed in 1.83.7. Published months after the fix. https://api.osv.dev/v1/vulns/GHSA-6wvf-77m9-58rm", "Not deducted separately. 26 other GitHub advisories published between 6 November 2025 and 6 November 2026 (one more critical, ten high, six moderate and nine low), among them an OIDC cache-key collision (GHSA-jjhc-v7c2-5hh6), authenticated credential exfiltration through request-body routing (GHSA-3cv6-jpf6-8222, 30 September 2026) and, on 27 October 2026, privilege escalation from internal_user to proxy_admin through reuse of the salt key (GHSA-7hp6-4w63-5g45, high) and an arbitrary local file read by internal_user_viewer (GHSA-g5ff-637f-6q2m, high). All handled in public with fixes. https://api.osv.dev/v1/query" ], "verdict": "An MIT-licensed gateway that puts 100+ model providers behind one OpenAI-compatible API, with virtual keys, budgets, fallbacks and an MCP gateway, released several times a week. Its security record is the main limitation. Two PyPI releases carried a credential stealer on 24 March 2026, and 30 GitHub advisories followed in 12 months, five of them critical.", "bestFor": "Teams that want one OpenAI-compatible endpoint over many providers on their own infrastructure, with per-key budgets, model allowlists and an MCP gateway.", "strengths": [ "MIT core, self-hosted, with no telemetry when self-hosted per the data security page", "Virtual keys limited by model, route, MCP server, budget, rate and expiry, and blockable at once", "Every proxy serves Swagger, ReDoc and /openapi.json, and the docs have llms.txt with a Markdown twin of every page", "Error reference tells a gateway 429 (with `retry-after`, `rate_limit_type`, `reset_at`) from a provider 429", "v1.108.1 on 5 November 2026, 125 tags since 8 August, and four stable minor lines supported with patches" ], "weaknesses": [ "litellm 1.82.7 and 1.82.8 on PyPI carried a credential stealer for about 40 minutes on 24 March 2026", "30 GitHub advisories from 6 November 2025 to 6 November 2026, five critical, including unauthenticated SQL injection fixed in 1.83.7", "Key rotation, audit logs and SSO beyond five users need an Enterprise licence, priced only through sales", "Breaking changes ship in weekly minor releases on the 1.x line, and lines older than the latest four stop getting fixes", "The default Docker image runs as root, and the Swagger, ReDoc and OpenAPI pages are public until switched off" ], "agentNotes": [ "Pin an exact litellm version or image digest, verify the cosign signature, and never install an unpinned latest in CI", "Give each agent a virtual key limited to its models, routes and MCP servers, with a budget and an expiry", "Treat a 429 with `retry-after` as the gateway's own limit and wait that long; a 429 without it came from the provider", "Set `NO_DOCS`, `NO_REDOC` and `NO_OPENAPI` to True in production, and use the `-non_root` image variant", "Set `LITELLM_LOCAL_MODEL_COST_MAP=True` where egress is blocked, since start-up otherwise fetches the price map from GitHub" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 62.4 } ], "editorialScores": { "ergonomics": 79, "maintenance": 82, "payments": 60, "reliability": 70, "schema": 91, "security": 72, "transparency": 77 }, "provenanceScore": 49, "checked": { "categories": { "ergonomics": "2026-11-06", "maintenance": "2026-11-06", "payments": "2026-11-06", "reliability": "2026-11-06", "schema": "2026-11-06", "security": "2026-11-06", "transparency": "2026-11-06" }, "last": "2026-11-06", "oldest": "2026-11-06", "stale": false, "staleAfterDays": 90 }, "scoreHistory": [ { "date": "2026-11-06", "grade": "B", "kind": "listed", "method": "0.7", "score": 62.4 } ] }, "connect": { "install": "pip install litellm # SDK; gateway: curl -sSLO https://github.com/BerriAI/litellm/raw/main/docker/docker-compose.quickstart.yml \u0026\u0026 docker compose -f docker-compose.quickstart.yml up -d", "http": "curl http://localhost:4000/v1/chat/completions \\\n -H 'Authorization: Bearer sk-\u003cyour-virtual-key\u003e' \\\n -H 'Content-Type: application/json' \\\n -d '{\n \"model\": \"gpt-5.6-terra\",\n \"messages\": [{\"role\": \"user\", \"content\": \"Say hello in five words.\"}]\n }'", "claudeCode": "export ANTHROPIC_BASE_URL=\"http://localhost:4000\"\nexport ANTHROPIC_AUTH_TOKEN=\"sk-\u003cyour-virtual-key\u003e\"\nexport ANTHROPIC_MODEL=\"\u003ca model_name from your config\u003e\"\nclaude" }, "letme": { "capability": "https://letme.dev/inference.router", "tool": "https://letme.dev/litellm" }, "notable": [ "On 24 March 2026 litellm 1.82.7 and 1.82.8 were uploaded to PyPI with a credential stealer after a publishing token leaked through the Trivy compromise. They were live for about 40 minutes and the official Docker image wasn't affected (https://docs.litellm.ai/blog/security-update-march-2026)", "GitHub advisory GHSA-5mg7-485q-xm76 (critical) covers the two releases, and v1.83.0 on 30 March was the first release from the rebuilt CI/CD pipeline (https://api.osv.dev/v1/vulns/GHSA-5mg7-485q-xm76)", "OSV lists 30 GitHub advisories for litellm published from 6 November 2025 to 6 November 2026, five critical, ten high, six moderate and nine low. Three came on 27 October 2026, among them a privilege escalation from internal_user to proxy_admin fixed in 1.100.4, 1.101.3, 1.102.2 and 1.103.1 (https://api.osv.dev/v1/vulns/GHSA-7hp6-4w63-5g45)", "security.md runs a bug bounty of $500 to $3,000 for supply-chain and unauthenticated-access reports, and closes any report sent without a reproduction video (https://github.com/BerriAI/litellm/blob/main/security.md)", "The four most recent stable minor lines get patch releases, and a new minor line ships roughly every week, per the policy in effect since 29 June 2026 (https://docs.litellm.ai/docs/enterprise.md)", "The package fetches its model price map from raw.githubusercontent.com at start-up unless `LITELLM_LOCAL_MODEL_COST_MAP=True` is set (https://github.com/BerriAI/litellm/blob/main/litellm/__init__.py). Usage telemetry, added in v1.107.0, is off by default and goes only to the operator's own table or endpoint (https://docs.litellm.ai/docs/proxy/telemetry)", "v1.108.0 (4 November 2026) and v1.108.1 (5 November) are the newest stable tags. Release notes from 4 November say v1.106.7 removes the Lens beta, so `lensWorker.enabled` must come out of Helm values before upgrading (https://docs.litellm.ai/release_notes)" ], "area": "models", "details": [ { "label": "Surfaces", "value": "Python SDK (`litellm.completion()` and async versions) and a self-hosted gateway on port 4000 with OpenAI, Anthropic Messages, MCP and A2A endpoints, an Admin UI at /ui and Postgres for keys and spend" }, { "label": "Routing", "value": "Load balancing, retries, cooldowns and fallbacks across deployments and providers, tag-based routing and an auto router" }, { "label": "Credentials", "value": "Master key with full admin rights. Virtual keys with model, route, MCP server, budget, rate and expiry limits, blockable. Rotation with a grace period is Enterprise only" }, { "label": "Errors", "value": "OpenAI-shaped `error` envelope with a string `code`. Gateway 429s carry `retry-after`, `rate_limit_type` and `reset_at`; provider 429s don't. Management API answers RFC 9457 problem+json" }, { "label": "MCP gateway", "value": "One endpoint for registered MCP servers with access by key, team or organisation, OAuth patterns, guardrails before and after tool calls, and a tool-search mode that exposes four virtual tools" }, { "label": "Telemetry", "value": "None by default. Usage telemetry (v1.107.0 and later) counts requests and Admin UI page views only when the operator turns groups on and picks their own table or HTTP endpoint, with `LITELLM_TELEMETRY_DISABLED=true` to lock it off. Start-up fetches the model price map from GitHub unless `LITELLM_LOCAL_MODEL_COST_MAP=True`" }, { "label": "Release support", "value": "The four most recent stable minor lines get patches. A new minor line ships roughly weekly. Release notes carry a breaking changes section" }, { "label": "Image security", "value": "GHCR images signed with cosign; the signing key changed in the 24 October 2026 patch releases. No SBOM or provenance attestation, and the default image runs as root (a `-non_root` variant exists)" }, { "label": "Enterprise", "value": "Annual licence through sales. SSO beyond five users, SCIM, audit logs, key rotation, IP allowlists, team-scoped guardrails, 72-hour security patch SLA. 30-day trial with no card" }, { "label": "Certifications", "value": "SOC 2 Type II per the data security page, report through trust.litellm.ai" } ], "provenance": { "legalEntity": "Berrie AI Incorporated", "domain": "litellm.ai", "domainRegistered": "2023-08-07", "endpointOnVendorDomain": false, "terms": "", "privacy": "https://docs.litellm.ai/docs/data_security", "statusPage": "", "changelog": "https://docs.litellm.ai/release_notes", "securityTxt": "none", "checked": "2026-11-06", "notes": [ "The data security page names the legal entity as Berrie AI Incorporated, with krrish@berri.ai as the security contact.", "The gateway is software the operator runs, so there's no vendor endpoint and no status page.", "No terms of service or privacy policy found on www.litellm.ai (/terms, /privacy and /legal return 404). The data security page in the docs covers self-hosted data handling.", "www.litellm.ai/.well-known/security.txt and the docs host both return 404. Reports go to GitHub private vulnerability reporting under security.md.", "RDAP for litellm.ai gives a registration date of 2023-08-07.", "Rechecked 2026-11-06: www.litellm.ai/terms, /privacy, /legal, /terms-of-service and /privacy-policy all return 404, and neither host serves security.txt. Both robots.txt files allow all." ], "score": 49, "checks": [ { "check": "Legal entity named", "value": "Berrie AI Incorporated", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "litellm.ai, registered 2023-08-07 (3 years)", "points": 7, "max": 15, "state": "part" }, { "check": "Endpoint on the vendor's domain", "value": " is not on litellm.ai", "points": 0, "max": 15, "state": "no" }, { "check": "Terms of service", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "Privacy policy", "value": "read, states 0 of the 8 things a reader expects", "points": 4, "max": 10, "state": "part" }, { "check": "Status page", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "Changelog", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "security.txt", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "People named", "value": "2 named with their role, 2 with a public profile", "points": 10, "max": 10, "state": "ok" }, { "check": "Support route", "value": "a support address, help pages, a community", "points": 5, "max": 5, "state": "ok" } ], "policies": [ { "kind": "terms", "url": "", "state": "none-found", "points": 0, "max": 10 }, { "kind": "privacy", "url": "https://docs.litellm.ai/docs/data_security", "state": "read", "readAt": "2026-11-06", "words": 864, "points": 4, "max": 10, "expected": [ { "key": "privacy.date", "label": "Gives the date it was last updated", "found": false }, { "key": "privacy.collected", "label": "Says what personal data is collected", "found": false }, { "key": "privacy.retention", "label": "Says how long data is kept", "found": false }, { "key": "privacy.processors", "label": "Says who else receives the data", "found": false }, { "key": "privacy.sale", "label": "Says whether personal data is sold or shared for advertising", "found": false }, { "key": "privacy.rights", "label": "Says what rights people have over their data", "found": false }, { "key": "privacy.contact", "label": "Gives a privacy contact", "found": false }, { "key": "privacy.transfers", "label": "Says where data is transferred or stored", "found": false } ] } ] }, "humans": { "slug": "litellm", "checked": "2026-11-06", "company": "Berrie AI Incorporated (LiteLLM)", "people": [ { "name": "Krrish Dholakia", "role": "Co-founder and CEO", "founder": true, "linkedin": "https://www.linkedin.com/in/krish-d/", "x": "https://x.com/krrish_dh", "github": "https://github.com/krrish-berri-2", "page": "/people/krrish-dholakia/" }, { "name": "Ishaan Jaffer", "role": "Co-founder and CTO", "founder": true, "linkedin": "https://www.linkedin.com/in/reffajnaahsi/", "x": "https://x.com/ishaan_jaff", "github": "https://github.com/ishaan-jaff", "page": "/people/ishaan-jaffer/" } ], "peopleNote": "Founders, roles and their LinkedIn, X and GitHub links are from LiteLLM's about page (read 6 November 2026), which names Berrie AI Incorporated, a Y Combinator Winter 2023 company in San Francisco. The data security page names the same entity and krrish@berri.ai as the security contact. Funding is the about page's own statement of a $1.6M seed round from Y Combinator, Gravity Fund and Pioneer Fund; no later round was found on the about, pricing or enterprise pages. No other data/humans file covers BerriAI. A web search on 6 November 2026 found no later round and no stated valuation, only database pages, which aren't used.", "companySocial": { "linkedin": "https://www.linkedin.com/company/90867735", "x": "https://x.com/litellm", "github": "https://github.com/BerriAI" }, "support": { "emails": [ "support@berri.ai" ], "urls": [ "https://docs.litellm.ai", "https://github.com/BerriAI/litellm/issues" ], "community": [ { "label": "Discord", "url": "https://discord.com/invite/wuPM9dRgDw", "kind": "discord" }, { "label": "Slack", "url": "https://litellmossslack.slack.com/", "kind": "slack" }, { "label": "GitHub issues", "url": "https://github.com/BerriAI/litellm/issues", "kind": "github" } ], "contactUrls": [ "https://www.litellm.ai/enterprise" ] }, "sources": [ "https://www.litellm.ai/about", "https://docs.litellm.ai/docs/data_security.md", "https://www.litellm.ai/enterprise" ], "ownership": { "status": "private", "totalRaised": { "amount": "$1.6M", "asOf": "2026-11-06", "source": "https://www.litellm.ai/about" }, "checked": "2026-11-06", "sources": [ "https://www.litellm.ai/about", "https://docs.litellm.ai/docs/data_security.md" ] }, "investors": [ { "name": "Y Combinator", "kind": "accelerator", "rounds": [ "Winter 2023 batch", "Seed" ], "url": "https://www.ycombinator.com", "source": "https://www.litellm.ai/about", "quote": "The company got a $1.6M seed round from Y Combinator, Gravity Fund and Pioneer Fund.", "page": "/investors/y-combinator/" }, { "name": "Gravity Fund", "firm": "Gravity VC", "kind": "vc", "rounds": [ "Seed" ], "source": "https://www.litellm.ai/about", "quote": "The company got a $1.6M seed round from Y Combinator, Gravity Fund and Pioneer Fund.", "page": "/investors/gravity-vc/" }, { "name": "Pioneer Fund", "kind": "vc", "rounds": [ "Seed" ], "source": "https://www.litellm.ai/about", "quote": "The company got a $1.6M seed round from Y Combinator, Gravity Fund and Pioneer Fund.", "page": "/investors/pioneer-fund/" } ] }, "pageJsonUrl": "https://www.anchorterminal.com/tools/litellm.json", "live": { "slug": "litellm", "versions": [ { "registry": "github", "name": "BerriAI/litellm", "version": "v1.108.2", "released": "2026-11-06", "seenAt": "2026-11-06T23:40:24.985518384Z" }, { "registry": "pypi", "name": "litellm", "version": "1.108.2", "released": "2026-11-06", "seenAt": "2026-11-06T23:40:24.735967257Z" } ], "githubStars": 62845, "pypiWeekly": 22493278, "securityTxt": { "url": "https://litellm.ai/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T16:01:25.60777972Z" }, "llmsTxt": { "url": "https://docs.litellm.ai/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:32:52.845519783Z" }, "pages": [ { "url": "https://docs.litellm.ai/release_notes", "kind": "changelog", "status": 200, "checkedAt": "2026-11-07T14:06:55.608946935Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "e493aadf92b2" }, { "url": "https://www.litellm.ai/pricing", "kind": "pricing", "status": 200, "checkedAt": "2026-11-07T14:30:56.79408028Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "45e60222905c" }, { "url": "https://docs.litellm.ai/docs/data_security", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T14:06:53.531435979Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "a2363610f7ad" } ], "updatedAt": "2026-11-07T16:01:25.60777972Z" } } }