AI Defense Stack

LLM firewalls & guardrails

Cloudflare AI Gateway: edge gateway for LLM traffic

Cloudflare AI Gateway is an edge gateway for LLM traffic from Cloudflare. It is a commercial product offered as: Cloud-native, Managed service, API. Pricing model: freemium.

  • Last reviewed
Visit Cloudflare AI Gateway (opens in a new tab) Documentation (opens in a new tab)
Commercial Freemium Layer 6: Runtime guardrails

Best for

Teams that already use Cloudflare and want one gateway for several model providers with logging, rate limits and basic content and data checks

Consider instead if

  • You want an open-source gateway you can self-host. See Portkey.
  • You want WAF rules that score prompts for injection before they reach your own LLM endpoint. See Firewall for AI.

What Cloudflare AI Gateway does

Cloudflare AI Gateway sits between an application and its model providers and adds visibility and control over the traffic. The documentation lists analytics, logging, caching, rate limiting, spend limits, request retry and fallback, and dynamic routing. For safety it lists Guardrails, which evaluate prompts and responses for harmful content and can flag or block, and data loss prevention, which scans prompts and responses for PII and other sensitive data using Cloudflare DLP profiles. It is a closed-source cloud service available on all Cloudflare plans, with core features free and log limits that depend on the Workers plan. It filters and governs traffic; it does not test models.

This summary is our own wording of the sourced facts on this page.

Key facts

Each value links to the page that states it, with the date we checked it.

Vendor
Cloudflare Source, checked October 21, 2026: developers.cloudflare.com (opens in a new tab)
Status
Active Source, checked October 21, 2026: developers.cloudflare.com (opens in a new tab)
Open source
No: closed source (proprietary) Source, checked October 21, 2026: developers.cloudflare.com (opens in a new tab)
Latest release
Not documented in the sources we checked
Deployment
Cloud-native, Managed service, API Source, checked October 21, 2026: developers.cloudflare.com (opens in a new tab)
Pricing model
Freemium: Core features such as analytics, caching and rate limiting are free. Logs: 100,000 total on Workers Free, 10,000,000 per gateway on Workers Paid. A 5% fee applies to credits bought through Unified Billing. (as listed on October 21, 2026; check the vendor for current pricing) Source, checked October 21, 2026: developers.cloudflare.com (opens in a new tab)
Website
developers.cloudflare.com Source, checked October 21, 2026: developers.cloudflare.com (opens in a new tab)
Documentation
developers.cloudflare.com Source, checked October 21, 2026: developers.cloudflare.com (opens in a new tab)
API reference
Not documented in the sources we checked
Quickstart
developers.cloudflare.com Source, checked October 21, 2026: developers.cloudflare.com (opens in a new tab)
Security page
Not documented in the sources we checked
Attestations or disclosure
Not documented in the sources we checked

Capabilities

As documented by the vendor or project. The tag is our label from a controlled vocabulary.

Integrations

Where Cloudflare AI Gateway fits in our AI security layers

Our analysis

Our editorial model, not a standard. The primary layer follows the category, except for tools whose main documented job is detection and response; other layers rest on a capability the sources document. How the model works.

AI security layers that Cloudflare AI Gateway covers, with the role, how each applies and what it rests on
LayerRoleHow it appliesBased on
L6 Runtime Runtime guardrails Primary Screen what goes into and comes out of a model in live traffic, and limit abuse of the model endpoint. Follows its category, LLM firewalls & guardrails
L5 Data Data protection Also covers Documents scans of prompts and responses for personal and other sensitive data. Scans prompts and responses for PII and other sensitive data and flags or blocks matches
L8 Monitoring Monitoring and response Also covers Documents request and response logs with Logpush export. Records request and response logs and usage analytics with Logpush export

OWASP LLM Top 10 mapping

Our analysis

The risk list is OWASP's (Top 10 for LLM Applications, 2025). The mapping is our analysis, and each row rests on a capability the sources document.

OWASP LLM risks mapped to Cloudflare AI Gateway, with the capabilities each mapping rests on
RiskHow it appliesBased on
LLM02 Sensitive Information Disclosure DLP scans prompts and responses for PII and other sensitive data. Scans prompts and responses for PII and other sensitive data and flags or blocks matches
LLM10 Unbounded Consumption Rate limits and spend limits cap request volume and cost. Limits request rates and sets cumulative spend budgets that block requests once exceeded

Not mapped in our analysis: LLM01, LLM05, LLM07, LLM09. These are risks we expect tools in this category to cover; the sources we checked do not document a matching capability.

Alternatives and related tools

More in LLM firewalls & guardrails, ranked within the category by Coverage Score.

NVIDIA NeMo Guardrails

NVIDIA

Open sourceApache-2.0
  • Library
  • Self-hosted
  • API

Adds programmable input, dialog, retrieval, execution and output rails to LLM applications.

Best for: Teams that want to script rules for one LLM application in Python and run them in their own infrastructure

Coverage Score 76 out of 100
  • LLM01 Prompt Injection
  • LLM02 Sensitive Information Disclosure
  • LLM05 Improper Output Handling
  • LLM06 Excessive Agency

Reviewed

Portkey AI Gateway

Palo Alto Networks (Portkey)

Open sourceMIT Freemium Now Prisma AIRS AI Gateway
  • SaaS
  • Self-hosted
  • API

Routes LLM traffic through one gateway API and runs input and output guardrail checks on each request.

Best for: Teams that want a single gateway for several LLM providers with guardrail checks, available as open source or as a hosted service

Coverage Score 69 out of 100
  • LLM01 Prompt Injection
  • LLM02 Sensitive Information Disclosure
  • LLM05 Improper Output Handling
  • LLM09 Misinformation

Reviewed

Kong AI Gateway

Kong

Open sourceApache-2.0
  • Self-hosted
  • SaaS
  • API

Routes LLM traffic through Kong with prompt guards, PII sanitization, spend limits and observability.

Best for: Teams that already run Kong as an API gateway and want LLM routing and prompt controls on the same data plane

Coverage Score 65 out of 100
  • LLM01 Prompt Injection
  • LLM02 Sensitive Information Disclosure
  • LLM10 Unbounded Consumption

Reviewed

Cloudflare AI Gateway FAQ

Is Cloudflare AI Gateway open source?

No. It is a managed Cloudflare service, and the documentation links no source repository for it.

Does AI Gateway have guardrails?

Yes. The documentation lists Guardrails that evaluate prompts and responses for harmful content, and a separate DLP feature for sensitive data, each able to flag or block.

What does it cost?

The pricing page says core features are free and lists log limits by Workers plan, plus a 5% fee on credits bought through Unified Billing.

Key facts you can cite

We have no commercial relationship with Cloudflare.

Sources & last reviewed

Last reviewed . We compile from the vendors' own public pages and repositories and we do not run the products. Source links open in a new tab. Found a mistake? Report a correction.