Vercel AI Gateway

# Fix list: Vercel AI Gateway

From Anchor Terminal's listing at https://www.anchorterminal.com/tools/vercel-ai-gateway, the October 2026 research run, assessed 17 October 2026. Grade B, 66.7 out of 100.

This is everything the published grade says the listing lacks, the biggest possible gain to the total first. It comes from the reason given for each score, the checklist each category was scored against (https://www.anchorterminal.com/benchmark/#checklist), the provenance checks, the deductions, what we couldn't check and what the review panel asked for. A fix counts at the next check, once it's public.

For a coding agent working on Vercel AI Gateway: work through the items below in the product, its docs and its public pages. Each category gives the reason for its score, with the points each checklist item earned, and the checklist itself, so the gap is the items that earned less than their points. Change the product, not the wording, and keep a note of what you changed and where it's published.

## 1. Payments & pricing, 20 out of 100, up to 10 more on the total

Why it scored 20: No x402, MPP or L402 (0). Per-token prices for every model are public in the keyless model list and the catalogue, and add-on prices are on the pricing page (20). A monthly free credit exists, but the getting-started page and the FAQ say the team must add a valid payment method before using it (0). A person signs up in a browser. Keys can then be created through `POST /v1/api-keys`, which needs a Vercel access token from that account (0).

The checklist (https://www.anchorterminal.com/benchmark/#checklist-payments):

The published rubric, also on the [x402 page](https://www.anchorterminal.com/x402/).

- 40, a machine payment protocol (x402, MPP or L402) on the tool's own endpoints. 10 to 30 when it covers only some endpoints or only goes through a third party, and the note says which.
- 20, per-call or per-unit pricing published without a login. 10 for public plan-only pricing, 0 for "contact sales" or prices behind a login.
- 20, a free tier or trial that doesn't need a card.
- 20, autonomous onboarding, meaning an agent can get access without a person signing up in a browser (keyless use, x402, a programmatic key API).

Payment platforms and agent wallets rarely charge for their own API over a machine protocol, so the first line has steps for them, and the highest one that applies counts. 40 when x402, MPP or L402 runs on all their own endpoints, 30 when it runs on part of their own API, 25 when their merchants can accept one, 20 for running a facilitator, 15 for paying as a buyer, and 0 when the only protocol is their own. Merchant acceptance sits above a facilitator because the platform's own customers can charge agents through it, while a facilitator settles for sellers who wire up the protocol themselves. The counter-argument (a facilitator does more for the protocol as a whole) has a point. Each note says which step applied.

Open-source software you run yourself is scored on its hosted or paid option if it has one. A free, self-hosted package with nothing to buy gets 20, 20 and 20 for the last three lines, and 0 to 40 for the first only if it ships a payment protocol.

## 2. Reliability, 74 out of 100, up to 5.2 more on the total

Why it scored 74: Hosted reading. AI Gateway is a component on www.vercel-status.com (20). The status history feed covers 23 July to 12 October 2026 with 25 incidents, and none names AI Gateway in its title or text. Two Drains incidents (23 July, 16 to 17 September) touched trace delivery. Component tags sit in the status API, which robots.txt disallows, so they were not used (25 of 30). The rate-limit page says it describes behaviour rather than fixed numbers. The paid tier has no gateway limit, and the free tier's per-model limits are not published (5 of 15). A 429 has a documented JSON body, some carry `retry-after`, the docs give backoff code and separate a 429 from a 402 budget rejection, and failed provider attempts are retried on other providers (14 of 15). The Enterprise SLA excludes the APIs and CLI, and no SLA naming AI Gateway was found (0). Generally available since 21 August 2025. Token Pass is early access and the Python SDK is in beta (10).

The checklist (https://www.anchorterminal.com/benchmark/#checklist-reliability):

Hosted APIs, MCP servers, models and platforms.

- 20, a public status page with component history (Statuspage, Instatus, BetterStack or the vendor's own).
- 0 to 30, the incident record for the last 90 days on that page. 30 for a clean record or trivial incidents only, 20 for minor incidents only, 10 for one major outage (an hour or more of a core API down, or errors across the board), 0 for several. 5 when there's no history we could read, and the note says so.
- 15, rate limits documented with numbers.
- 15, documented 429 or overload handling (Retry-After, backoff guidance), and idempotency keys or safe-retry guidance where writes are involved.
- 10, an SLA published for any paid tier.
- 10, the surface agents use is generally available, not beta or preview.

Local packages, SDKs, frameworks and stdio MCP servers.

- 20, installs from an official package with supported runtimes stated.
- 25, a public CI and test suite, passing on the default branch.
- 0 to 25, open crash or regression issues relative to activity (25 for few and handled, 0 for many, old and unanswered).
- 15, semver discipline and breaking changes called out in a changelog.
- 15, version 1.0 or later, or declared stable.

Protocols are read from their reference implementations, the public facilitators or servers, spec stability and test vectors.

## 3. Schema & documentation, 74 out of 100, up to 4.2 more on the total

Why it scored 74: Router, scored on the API lines. Vercel's OpenAPI 3.0.3 document has AI Gateway management paths (budgets, routing rules, virtual model configs, routers) and `POST /api-keys`. It does not cover the inference routes on ai-gateway.vercel.sh or `/v1/models`, `/v1/credits`, `/v1/generation` and `/v1/report`, which follow the OpenAI and Anthropic formats and the REST reference page (12 of 25). Every docs page is served as Markdown, and vercel.com/llms.txt lists AI Gateway and the keyless model list (10). The docs say when to use AI Gateway, which API format suits which client, and what each control leaves out, such as BYOK spend outside budgets (16 of 20). `providerOptions.gateway` fields are documented in tables with types, and the model list names each model's supported parameters. The request bodies have no published schema of their own (9 of 15). cURL, TypeScript and Python examples on most pages, and error tables in the FAQ, the REST reference and the Token Pass pages. The Chat Completions error list omits 402 (13 of 15). Paths carry `/v1`, the changelog is dated with 103 AI Gateway entries from 19 July to 17 October 2026, and `@ai-sdk/gateway` keeps a CHANGELOG. The changelog sitemap dates one AI Gateway entry to 25 March 2025, before the alpha (14 of 15).

The checklist (https://www.anchorterminal.com/benchmark/#checklist-schema):

APIs and MCP servers.

- 25, a machine-readable contract (a public OpenAPI file or similar; for MCP, typed JSON Schema inputs on every tool).
- 10, llms.txt or Markdown docs served for agents.
- 0 to 20, descriptions that say what a tool is for, when to use it and when not to, read from the tool definitions in the source or the API reference.
- 0 to 15, typed inputs with enums, constraints and required fields, and no free-form JSON blobs.
- 0 to 15, examples and documented error responses.
- 15, versioning and a public changelog.

Models are read from the API reference, the OpenAPI file, llms.txt, the structured-output and tool-use docs and the model cards. Frameworks from docs a model can follow, typed interfaces, examples and the API reference.

## 4. Security & auth, 79 out of 100, up to 3.7 more on the total

Why it scored 79: Router, read on the model lines. AI Gateway API keys belong to a team, can be limited to one project and given an expiry and a budget, are deactivated when their creator leaves the team, and can be revoked without authentication by reporting a leaked key. Keys carry no per-model or read-only scope apart from the Token Pass key type. On Vercel, project OIDC tokens replace long-lived keys (24 of 30). Vercel says it does not train on prompts, and the AI Product Terms make that a warranty only for Enterprise subscriptions. Provider training is filtered only when `disallowPromptTraining` or ZDR is set, the filter does not apply to BYOK, and the terms say Stealth Model providers may train on inputs (12 of 20). The gateway does not keep prompt or response content. Provider ZDR is free per request on Pro and Enterprise and not available on Hobby, and BYOK keys are skipped under ZDR unless marked (12 of 15). Per-request logs record status, provider attempts, tokens, cost and authentication method, with routing details kept 30 days and Trace Drains and spend reports on paid plans (13 of 15). Valid security.txt with HackerOne, SOC 2 Type 2 and ISO 27001:2022 as Vercel states them, and a public bulletin for the April 2026 incident, closed on 16 October 2026 (18 of 20).

The checklist (https://www.anchorterminal.com/benchmark/#checklist-security):

- 0 to 30, the credential model. 30 for OAuth 2.1 with scopes, or scoped and revocable keys with rotation. 20 for plain revocable API keys. 10 for one all-powerful key. 10 off when a secret can travel in a URL query string as a documented option.
- 0 to 20, read-only or least-privilege modes, and confirmation or approval for destructive actions.
- 0 to 15, prompt-injection posture where the tool returns untrusted content (documented mitigations or guidance). A tool that returns no untrusted content gets 10.
- 0 to 15, audit logs or per-call visibility for the operator.
- 0 to 20, a security programme. security.txt or a disclosure policy, a bug bounty, SOC 2 or ISO 27001, advisories handled in public.

Models are read for retention, whether API data trains models (and whether that's off by default), zero-retention options and certifications. Frameworks for telemetry defaults, approval hooks, guardrails and sandboxing.

## 5. Agent ergonomics, 83 out of 100, up to 2.8 more on the total

Why it scored 83: Router, read on the model lines. Tool calling is documented on all six surfaces and 303 of 474 models carry the tool-use tag, with behaviour depending on the model routed (16 of 20). Structured output is documented per surface and tagged on 277 models (13 of 15). `caching: 'auto'` adds Anthropic cache markers, `cache_ttl` asks for one-hour entries, `x-session-affinity` keeps a conversation on one provider, and cache-read prices are listed per model (14 of 15). 155 models list a context of one million tokens or more, a judgement call since a router has no default model (15). The SDK source has a `gateway-batch.ts` file, but no batch endpoint or batch discount was found in the docs (2 of 10). The AI SDK for TypeScript, the AI SDK for Python in beta, and the OpenAI and Anthropic SDKs with a changed base URL (10). Errors return `message` and `type`, an exceeded budget answers 402 apart from a 429, the SDK has ten typed `Gateway*Error` classes, and the FAQ maps each status to a fix (13 of 15).

The checklist (https://www.anchorterminal.com/benchmark/#checklist-ergonomics):

- 0 to 25, context cost. For MCP, the number and size of the tool definitions (25 for ten or fewer compact tools, 15 for 11 to 30, 5 for more than 30, plus up to 10 back for toolsets, dynamic loading or read-only subsets). For APIs, whether responses can be sized (field selection, limits, summaries).
- 20, pagination, filtering and output-size controls.
- 20, actionable, documented error responses, codes and messages an agent can recover from.
- 20, idempotency or safe retries, and for MCP the `readOnlyHint` and `destructiveHint` annotations.
- 15, sensible defaults, few required parameters, and official SDKs in at least two languages.

Models are read for tool use, structured output, prompt caching, context length, batch and SDKs. Frameworks for how much code and how many defaults a tool-calling agent with MCP needs.

## 6. Transparency & trust, 70 out of 100, up to 2.6 more on the total

Made of editorial 55, provenance 84.

Why it scored 70: Closed service under the Terms of Service of 1 June 2026, the AI Product Terms with an AI Gateway section, and Token Pass terms on its docs page. Routed models carry the terms of 64 providers listed in the Notices and Licence Information, and the SDK is Apache-2.0 (18 of 30). The FAQ, the ZDR page and the logs page agree that prompt and response content is not kept. The terms place content sent to providers under the providers' own terms, give the no-training warranty only to Enterprise and bar sensitive personal information in Input. The DPA covers Pro and Enterprise, not Hobby, and the privacy notice gives retention criteria, not periods (17 of 30). No deprecation policy found. Model retirements carry dates in the model list, and the AI Product Terms let Vercel change fees, change or end anything in beta without notice, and end Token Pass with a pro-rata refund (8 of 20). Provider terms are listed per provider and regional inference names four regions, while the gateway itself may process a request in any Vercel region. The subprocessor list on security.vercel.com was not read (12 of 20).

The checklist (https://www.anchorterminal.com/benchmark/#checklist-transparency):

- 0 to 30, source availability and licence clarity. 30 for open source under an OSI licence, 15 for closed with clear terms, 0 for unclear terms.
- 0 to 30, data handling and retention statements that agree with each other (privacy policy, DPA, retention periods, subprocessors).
- 0 to 20, a deprecation policy or notices with dates.
- 0 to 20, telemetry disclosed with an opt-out (local software), or subprocessors and data locations disclosed (hosted).

The other half of Transparency and trust is the provenance score, computed from checked facts (below). The category score is the mean of the two.

Provenance checks not met in full (half of this category, computed from checked facts):

- Endpoint on the vendor's domain: ai-gateway.vercel.sh is not on vercel.com (0 of 15)
- Privacy policy: read, states 7 of the 8 things a reader expects (9.3 of 10)

## 7. Maintenance & community, 79 out of 100, up to 1.8 more on the total

Why it scored 79: Closed service, read on the model lines. The newest changelog entry naming AI Gateway is dated 17 October 2026 (30). Five models in the model list carry a `deprecated_at` date, from 14 days to about four months ahead. No minimum notice period was found, and access to Claude Fable 5 was suspended on 12 June 2026 under a government directive without notice and restored on 1 July (6 of 12). No AI Gateway endpoint was shut down in the last 90 days that we found (7 of 8). 103 changelog entries name AI Gateway from 19 July to 17 October 2026, and support runs from the dashboard (13 of 15). Replies to issues on vercel/ai were not read, because GitHub's API and web pages were not reachable from this session (3 of 10). `@ai-sdk/gateway` is at 4.0.116, its package was last committed to on 16 October 2026, and it had 29,597,661 npm downloads in the week to 12 October. The Python SDK is in beta (14 of 15). Three runtime dependencies and a test file beside most modules. CI was not checked (6 of 10).

The checklist (https://www.anchorterminal.com/benchmark/#checklist-maintenance):

- 0 to 30, time since the last release, or the last published model or API change for a closed service. 30 within 30 days, 20 within 90, 10 within 180, 0 older.
- 20, at least three releases or dated changelog entries in the last 90 days.
- 0 to 25, responsiveness. Issues and pull requests answered on GitHub (the open issues and how recent the replies are). For closed services, a public changelog and a support or community channel that answers, 0 to 15.
- 15, presence in the official MCP registry under a verified namespace (MCP servers), or current official SDKs (APIs and models).
- 10, package health, current dependencies and CI.

Models are read for deprecation notice periods and model churn rather than release counts.

## Deductions

Each comes off the total. A fixed and documented problem counts for less at the next check.

- April 2026. Vercel's security bulletin says an attacker took over an employee's account through a compromised third-party AI tool, reached internal systems and decrypted non-sensitive environment variables of a limited subset of customers. AI Gateway was generally available then, and its docs have deployments keep AI Gateway and Token Pass API keys as environment variables. The bulletin documents remediation and marks the incident closed on 16 October 2026, so 3 of a possible 15 is taken, as for vercel-connect (https://vercel.com/kb/bulletin/vercel-april-2026-security-incident).

## What we couldn't check

What we couldn't read counted as absent. Publishing it on a page a plain HTTP fetch can read (not only in a browser) lets the next check count it.

- unchecked: the amount of the monthly free credit. The pricing page, FAQ and getting-started page mention it without a figure
- unchecked: the free tier's per-model rate limits. The rate-limit page says limits change and sends callers to support
- unchecked: component tags on status incidents. www.vercel-status.com/robots.txt disallows /api/. One command fetched the components and incidents feeds in the same call that read robots.txt, before its output was read. Those responses were deleted unread and nothing from them is used. The history feed and the status page HTML were read instead
- unchecked: issue replies, CI status and the star count for vercel/ai. GitHub's API and web pages were not reachable from this session, so only a sparse clone of packages/gateway was read
- unchecked: the `ai` package page on PyPI, which answered with a bot check. Nothing was tried to get past it
- unchecked: the subprocessor list on security.vercel.com
- unchecked: whether failed requests are charged in general. Only the team-wide ZDR fee says failed requests are not charged
- Vercel's changelog sitemap dates 'Custom reporting now available on AI Gateway' to 25 March 2025, before the alpha of 20 May 2025, while the blog's post on unified reporting is dated 25 March 2026. `firstReleased` uses the alpha post of 20 May 2025
- The Ship recap links Token Pass to /changelog/vercel-token-pass-now-in-early-access, which answered 404 on 17 October 2026. The entry is at /changelog/introducing-token-pass
- The Token Pass changelog entry says requests run through selected providers with inference in the US and EU, while the docs name Wafer as the current provider
- The scout was right on Token Pass (15 October 2026, $30 for $80, Pro, early access, ZDR, no overage). The Ship recap items it lists match the docs, though budgets for API keys date from 9 June 2026 and team-wide ZDR from 6 April 2026
- The deduction of 3 for the April 2026 incident follows vercel-connect. vercel-sandbox took none for the same bulletin
- Autonomous onboarding scores 0 as for vercel-connect. vercel-sandbox earned 10 because Stripe Projects lists Vercel, which was not checked this run
- Section 3.4 of the AI Product Terms bars sensitive personal information, such as health or financial account data, in Input, whatever ZDR setting is used
- The Acceptable Use Policy permits benchmarks only of services other than AI Services. How Vercel reads that for probes of the gateway is not stated, and it matters before any probe is run
- This listing is not ours and does not do letme's job. It routes model calls between providers, not tasks between tools

## Weaknesses

- The free monthly credit needs a valid payment method on the team, and its amount is not stated in the reviewed docs
- No rate-limit numbers are published, and the Enterprise SLA excludes the APIs, so the inference API carries no uptime commitment
- The contractual promise not to train on AI Gateway content covers Enterprise subscriptions only. Provider no-training and ZDR filters are opt-in per request
- A failed BYOK request falls back to Vercel's credentials and is billed to credits, and the no-training filter is not applied to BYOK
- Token Pass is early access for Pro teams only, covers two models, has no failover and fails with a 403 once the $80 credit is spent

## What costs an agent a turn today

The notes we give agents before they call it. Each one is a workaround an agent shouldn't need.

- Read `GET https://ai-gateway.vercel.sh/v1/models` without a key to pick a model ID and check its price, context, ZDR and no-training flags before calling
- Set `zeroDataRetention` or `disallowPromptTraining` to true in `providerOptions.gateway` on sensitive requests. Default routing ignores provider retention and training policies
- Treat a 429 as retryable and honour `retry-after` when present. A 402 with `quota_for_entity_exceeded` is a spent budget, so do not retry it
- On a Token Pass key, a 403 with `no_providers_available` means spent credit or a model outside the pass. Retry with a standard AI Gateway key, which bills credits
- Set `inferenceRegion` when data residency matters. The default `global` may run inference outside the user's jurisdiction

## What the review panel asked for

- state the free credit amount
- a card-free first call
- State the free credit amount
- Say whether failed requests are billed
- Publish free-tier limits per model
- Put retry-after on every 429
- read-only and per-model key scopes
- no-training by default

## When it's done

Send what changed and where it's published as a dispute (https://www.anchorterminal.com/builders/#disputes, or `POST https://www.anchorterminal.com/api/v1/contact` with `"kind": "dispute"`). Disputes are answered in public, and the listing is checked again by the same checklist. Paying for an audit or a listing claim changes nothing here.