AI gateway capabilities
TrustGate provides the following capabilities:- Multi-provider access: adapters for OpenAI, Anthropic, Azure OpenAI,
AWS Bedrock, Google Gemini, Vertex AI, Groq, Mistral, and DeepSeek (plus any
OpenAI-compatible endpoint), behind one OpenAI-compatible surface. Chat, Responses,
Messages, embeddings, images,
files, and rerank share the same
consumer. Model discovery is
GET /{consumer}/v1/models. - Smart routing and load balancing: simple routing, fallback chains, round-robin, weighted, least-connections, random, and smart routing by complexity label (Simple / Medium / Hard).
- Cost and abuse control: request rate limiting, token and dollar LLM Budget, and request-size guards.
- Tool and prompt governance: allow-list, validate, and reshape the tools an agent can call; inject and version system prompts; restrict which models a consumer may reach.
- Guardrails: TrustGuard, OpenAI Moderation, Azure Content Safety, and AWS Bedrock guardrail policies to inspect prompts and responses inline.
- Multi-tenancy and authentication: per-gateway consumers authenticated by API key, OAuth2, or OIDC, with policies scoped globally or per consumer.
- Observability: per-request telemetry (model, tokens, cost, latency breakdown, routing attempts, policy chain) exported with OpenTelemetry and used by detection alerts.
- Agent tooling: an MCP Gateway exposes MCP servers and tools to agents (Claude Code, Claude Enterprise, Cursor, Codex, GitHub Copilot, Copilot Studio) with OAuth2 support.
Core resources
Configure everything in the console under TrustGate. Six objects make up a TrustGate gateway:Request flow
auto when load balancing or smart routing is enabled. The AI gateway resolves
the registry, applies policies, and forwards the request. See
Architecture for the full lifecycle.
Frequently asked questions
Can I move an existing OpenAI or Anthropic client to TrustGate?
For most clients, moving to the AI gateway means updating the base URL and replacing the provider credential with a TrustGate consumer credential. TrustGate accepts OpenAI Chat Completions, Responses, Anthropic Messages, and Google Gemini request formats, then adapts the request for the selected upstream provider. Start with the connection snippet on the consumer’s Connect tab.Should my application use an API key, OAuth2, or OIDC?
Use an API key for a static application identity. OAuth2 can validate service tokens or broker an interactive login for MCP clients. OIDC validates JWTs and can use token claims for identity-based LLM routing. See Authentication for the supported combinations.Can TrustGate run in my environment?
Yes. With Hybrid, you run the data plane in your environment while NeuralTrust runs the control plane. With External, you run the full platform in your own environment. NeuralTrust can also host both planes through SaaS. Compare the options in Deployment models.Where do prompts and responses travel in a Hybrid deployment?
The client calls the TrustGate data plane in your environment, and TrustGate forwards the request to the configured model provider. Raw prompts and responses stay in your PostgreSQL; metadata is exported to NeuralTrust over OTLP. See the Hybrid architecture for the complete data path.Does my application need the model provider’s credentials?
No. Provider credentials remain in TrustGate. Applications authenticate as a consumer, and TrustGate uses the registry credential when it calls the selected provider. Keep consumer API keys secret and rotate them separately from provider credentials.Where to go next
Quickstart
Create a gateway, connect a provider, and send your first request from the console.
Endpoints
Chat, embeddings, images, files, audio, rerank, and models routes.
Resources
Gateways, registries, consumers, auth, policies, roles.
API
Control-plane REST API for automation and self-hosted setups.