LiteLLM vs OpenRouter

LiteLLM 60

Read with the self-hosted rule, since an agent uses the free gateway and Enterprise is a sales-led licence for the same software. No x402, MPP or L402 (0). MIT with no account and no card, so 20, 20 and 20 on the last three lines. Model calls cost what the operator's provider keys cost.

OpenRouter 40

No machine payment protocol found in the docs index. Credits can be bought in USDC through Coinbase, but calls draw on a prepaid balance (0). Per-token prices published per model without a login (20). 25 or more free models with no card, per the listing (20). Browser sign-up for the first key (0). Management API keys and OAuth PKCE mint keys in code, but only after a person has an account.

LiteLLM 70

Read with the local-software lines, since the gateway runs on the operator's hardware and BerriAI hosts nothing an agent calls. litellm on PyPI states Python 3.10 to 3.14, and the gateway ships as a Docker image, a Helm chart and Terraform modules, with GHCR images signed by cosign (20). 51 GitHub Actions workflows plus a CircleCI config cover unit, proxy-database, end-to-end, chaos, mutation and UI tests. The GitHub API was rate-limited for our reader on 6 November and Actions pages refused it on 6 October, so we couldn't confirm main is passing (15 of 25). The issue tracker showed 1,674 open issues on 6 November, with eight bug reports among the 15 newest, seven of them with a reply, against a project that tags several releases a day (10 of 25, down from an unchecked 12). Release notes carry breaking-change bullets, but breaking changes land in weekly minor releases on the 1.x line, so version numbers don't signal them (10 of 15). 1.108.1, past 1.0 (15).

OpenRouter 55

Status page at status.openrouter.ai, which rendered only in a browser with its feed and JSON paths answering 403 on 1 and 2 October. On 1 November its robots.txt answered 403 AccessDenied, so the host is treated as blocked and the page was not read (10 of 20, per the 2 October check, and 5 for the incident line, no readable history). The limits page gives 20 requests a minute on free models, 50 a day below $10 of lifetime purchases and 1,000 a day above, no platform cap on paid models, and a key endpoint that reports what's left (15). The errors page says 429, 503 and 402 responses from the in-flight spending budget carry Retry-After, tells clients to honour it, and says the official SDKs already do (15). The pricing page lists 'Contractual SLAs' for Enterprise without publishing terms, which we count as no published SLA (0). The chat completions API is GA (10). Model fallbacks through a models list soften an upstream outage, which this checklist doesn't score.

LiteLLM 63

MIT for everything outside enterprise/, which has its own licence (25 of 30). The data security page (updated 6 November 2026) and security.md agree that a self-hosted gateway sends no data or telemetry to BerriAI, and the gateway stores prompts and spend in the operator's own Postgres. We found no terms of service or privacy policy on litellm.ai for its site, trial or Enterprise licence (20 of 30). A version support policy since 29 June 2026 (four stable minor lines), deprecated pages labelled in the docs, and release notes with breaking-change bullets (15 of 20). Usage telemetry, new in v1.107.0, is off by default, lists every field it can send and goes only to a table or endpoint the operator sets. A main-branch commit of 23 October 2026 made the Admin UI chat post a hashed user id to chat-telemetry.litellm.ai, and it was removed on 24 October before any tagged release contained it, so it isn't deducted. The start-up fetch of the price map from GitHub is documented with an opt-out (17 of 20).

OpenRouter 72

Closed service with clear terms, SDKs Apache-2.0 (15). Data collection page and privacy policy agree that content isn't stored unless you opt in, but training defaults for upstream providers sit on other pages we didn't read (15 of 30). An API versioning page states how deprecations are announced (in the changelog, with the field or endpoint marked deprecated in the reference) and the changelog dates each one, but no notice period is promised (12 of 20). Each provider's data policy is shown per endpoint per the listing, and EU or US in-region routing is part of the Business plan. No subprocessor list checked (15 of 20).

LiteLLM 79

Read with the API lines for the gateway an agent calls. Responses size through the usual max_tokens and streaming, and the MCP gateway can replace a large tool catalogue with four virtual tools (tool search) or filter tools by semantic relevance, which cuts context cost (20 of 25). Key, team and spend listings page and filter, though we didn't check every list call (15 of 20). Errors keep the OpenAI envelope with a string code, gateway 429s carry retry-after, rate_limit_type and reset_at, management routes answer RFC 9457 problem+json, and a table says which errors are safe to retry (20). Retries, cooldowns and fallbacks run inside the gateway and the docs say which errors to retry, but there are no idempotency keys for the management writes (12 of 20). Any OpenAI or Anthropic SDK works by changing the base URL, but the only first-party client is the Python SDK, and keys and spend need Postgres and a master key before the first call (12 of 15).

OpenRouter 85

Model reading of the checklist (tool use, structured output, caching, context, batch, SDKs, errors). Tool calling documented, behaviour depends on the routed model (15 of 20). Structured outputs depend on the upstream model (10 of 15). Prompt caching documented, discount set by each provider (10 of 15). Routes to models with 1M-token context, a judgement call since a router has no default model (15). Batch API, usually half price per the listing (10). Official SDKs in TypeScript, Python and Go (10). Errors and debugging page (15).

LiteLLM 72

Read with the tool checklist for self-hosted software. Virtual keys are hashed, revocable and blockable, with model, route, MCP server, budget, rate and expiry limits, and a proxy_admin_viewer read-only role exists. Rotation with a grace period is Enterprise only, so 25, less 10 because the docs pass a key as ?key= on /key/info and on the Claude Code marketplace manifest (15 of 30). allowed_routes, MCP permissions by key and team, an approval queue for submitted MCP servers and stdio MCP servers off by default from 1.104.0 (15 of 20). Guardrails can run before a model call and on MCP tool results, and an OWASP LLM Top 10 page maps each risk to a control, but prompt-injection detectors such as Lakera need an Enterprise licence and all of it is off by default (12 of 15). Request and spend logs per key in the open-source build; audit logs of admin actions are Enterprise only (12 of 15). security.md with GitHub private reporting, a bug bounty from $500 to $3,000 for P0 and P1 reports, a security announcements list, SOC 2 Type II per the data security page, CodeQL, OSV and Scorecard workflows, and advisories published on GitHub. No security.txt, and reports without a video are closed unread (18 of 20).

OpenRouter 67

Model reading. Bearer keys with per-key credit limits, Management API keys for creating and rotating keys in code, and OAuth PKCE for user-delegated keys. No permission scopes on keys (25 of 30). OpenRouter doesn't store or use prompts unless you opt in for a 1% discount, but the routing reference, re-read on 1 November 2026, still sets data_collection to 'allow' by default, which admits providers that may store and train on data. An account privacy setting can switch that off, and the docs don't say what a new account starts with (5 of 20). Prompts not stored by default and a per-request zdr filter (15). Request metadata kept for reporting, per-call logs not confirmed (10 of 15). security.txt, read on 1 November 2026, is valid to 12 August 2027 with security@openrouter.ai and a PGP key, and says reports confirmed as high-impact get an invitation to a private HackerOne bug bounty. The private bounty counts as a bounty, as other listings' invitation-only programmes do (activepieces, fireflies, mixpanel). No certification or public advisory was found, so 12, above blockrun-ai's 10 (valid security.txt, no bounty) and below activepieces' 13 (a private bounty and nine public advisories) (12 of 20).