AI Defense Stack

LLM firewalls & guardrails

Portkey AI Gateway: AI gateway with built-in guardrails

Portkey is an AI gateway with built-in guardrails from Palo Alto Networks. It is open source under the MIT license and is offered as: SaaS, Self-hosted, API. The vendor's page now calls it Prisma AIRS AI Gateway.

  • Last reviewed
Visit Portkey (opens in a new tab) Documentation (opens in a new tab) Source code (opens in a new tab)
Open sourceMIT Freemium Now Prisma AIRS AI Gateway Layer 6: Runtime guardrails

Best for

Teams that want a single gateway for several LLM providers with guardrail checks, available as open source or as a hosted service

Ownership

Palo Alto Networks announced on May 29, 2026 that it had closed its acquisition of Portkey. Source, checked October 21, 2026: paloaltonetworks.com (opens in a new tab)

Consider instead if

  • You already use Cloudflare and want a managed gateway on its network. See Cloudflare AI Gateway.
  • You want guardrail libraries inside your own Python code rather than a gateway. See NeMo Guardrails.

What Portkey does

Portkey AI Gateway, which the vendor site now calls Prisma AIRS AI Gateway, routes requests to many LLM providers through one API and can run guardrails on the way in and out. The documentation lists deterministic checks such as regex and JSON schema validation, LLM-based checks such as prompt injection scanning, partner guardrails, and custom webhooks. A failed check can deny the request, fall back to another model or retry. A PII redaction guardrail swaps detected personal data for placeholders before the request reaches the model. The gateway code is MIT licensed on GitHub, and Portkey also offers a hosted service with Developer, Production and Enterprise plans. Palo Alto Networks announced in May 2026 that it had closed its acquisition of Portkey. Confirm current product naming and plans with the vendor.

This summary is our own wording of the sourced facts on this page.

Key facts

Each value links to the page that states it, with the date we checked it.

Vendor
Palo Alto Networks (Portkey) Source, checked October 21, 2026: paloaltonetworks.com (opens in a new tab)
Status
Renamed Source, checked October 21, 2026: portkey.ai (opens in a new tab)
Current name
Prisma AIRS AI Gateway Source, checked October 21, 2026: portkey.ai (opens in a new tab)
Ownership
Palo Alto Networks announced on May 29, 2026 that it had closed its acquisition of Portkey. Source, checked October 21, 2026: paloaltonetworks.com (opens in a new tab)
Open source
Yes: MIT Source, checked October 21, 2026: api.github.com (opens in a new tab)
Repository
github.com Source, checked October 21, 2026: api.github.com (opens in a new tab)
GitHub stars
13,245 as of October 21, 2026 Source, checked October 21, 2026: api.github.com (opens in a new tab)
Latest push
May 25, 2026 Source, checked October 21, 2026: api.github.com (opens in a new tab)
Latest release
January 12, 2026 Source, checked October 21, 2026: api.github.com (opens in a new tab)
Deployment
SaaS, Self-hosted, API Source, checked October 21, 2026: github.com (opens in a new tab)
Pricing model
Freemium: Developer: Free Forever, 10k logs per month. Production: $49/month, 100k logs, +$9 per additional 100k requests. Enterprise: Custom Pricing. An Open Source plan is listed for hosting it yourself. (as listed on October 21, 2026; check the vendor for current pricing) Source, checked October 21, 2026: portkey.ai (opens in a new tab)
Website
portkey.ai Source, checked October 21, 2026: portkey.ai (opens in a new tab)
Documentation
portkey.ai Source, checked October 21, 2026: portkey.ai (opens in a new tab)
API reference
Not documented in the sources we checked
Quickstart
Not documented in the sources we checked
Security page
Not documented in the sources we checked
Attestations or disclosure
Not documented in the sources we checked

Capabilities

As documented by the vendor or project. The tag is our label from a controlled vocabulary.

Integrations

Where Portkey fits in our AI security layers

Our analysis

Our editorial model, not a standard. The primary layer follows the category, except for tools whose main documented job is detection and response; other layers rest on a capability the sources document. How the model works.

AI security layers that Portkey covers, with the role, how each applies and what it rests on
LayerRoleHow it appliesBased on
L6 Runtime Runtime guardrails Primary Screen what goes into and comes out of a model in live traffic, and limit abuse of the model endpoint. Follows its category, LLM firewalls & guardrails
L5 Data Data protection Also covers Documents PII redaction that replaces detected personal data with identifiers before a request reaches the model. Checks model output for PII leaks; Redacts detected PII from requests before they reach the model, replacing each item with a standardized identifier

OWASP LLM Top 10 mapping

Our analysis

The risk list is OWASP's (Top 10 for LLM Applications, 2025). The mapping is our analysis, and each row rests on a capability the sources document.

OWASP LLM risks mapped to Portkey, with the capabilities each mapping rests on
RiskHow it appliesBased on
LLM01 Prompt Injection LLM-based input guardrails include prompt injection scanning. Runs LLM-based input checks such as prompt injection scanning before a request reaches the model
LLM02 Sensitive Information Disclosure A redaction guardrail masks PII in requests before the model sees it, and an output guardrail checks responses for PII leaks. Checks model output for PII leaks; Redacts detected PII from requests before they reach the model, replacing each item with a standardized identifier
LLM05 Improper Output Handling Deterministic output checks such as JSON schema and regex run on model responses. Validates input and output with deterministic checks such as regex match and JSON schema
LLM09 Misinformation An output guardrail checks responses for hallucinations. Checks model output for hallucinations

Not mapped in our analysis: LLM07, LLM10. These are risks we expect tools in this category to cover; the sources we checked do not document a matching capability.

Alternatives and related tools

More in LLM firewalls & guardrails, ranked within the category by Coverage Score.

NVIDIA NeMo Guardrails

NVIDIA

Open sourceApache-2.0
  • Library
  • Self-hosted
  • API

Adds programmable input, dialog, retrieval, execution and output rails to LLM applications.

Best for: Teams that want to script rules for one LLM application in Python and run them in their own infrastructure

Coverage Score 76 out of 100
  • LLM01 Prompt Injection
  • LLM02 Sensitive Information Disclosure
  • LLM05 Improper Output Handling
  • LLM06 Excessive Agency

Reviewed

Kong AI Gateway

Kong

Open sourceApache-2.0
  • Self-hosted
  • SaaS
  • API

Routes LLM traffic through Kong with prompt guards, PII sanitization, spend limits and observability.

Best for: Teams that already run Kong as an API gateway and want LLM routing and prompt controls on the same data plane

Coverage Score 65 out of 100
  • LLM01 Prompt Injection
  • LLM02 Sensitive Information Disclosure
  • LLM10 Unbounded Consumption

Reviewed

Amazon Bedrock Guardrails

Amazon Web Services

Commercial
  • API
  • Cloud-native
  • Managed service

AWS service that filters harmful content, prompt attacks, denied topics and PII in model inputs and outputs.

Best for: Teams that already build on AWS and want managed filters they can apply to Bedrock models or to other models through an API call

Coverage Score 60 out of 100
  • LLM01 Prompt Injection
  • LLM02 Sensitive Information Disclosure
  • LLM05 Improper Output Handling
  • LLM09 Misinformation

Reviewed

Portkey FAQ

Is Portkey open source?

The gateway is. It is released under the MIT license on GitHub at Portkey-AI/gateway. Portkey also offers a hosted service with paid plans.

Who owns Portkey?

Palo Alto Networks announced on May 29, 2026 that it had closed its acquisition of Portkey, and the vendor site says Portkey is now Prisma AIRS AI Gateway.

What happens when a guardrail check fails?

The docs say a failed check can deny the request with status 446, or let it continue with status 246, and configs can fall back to another model or retry.

Does Portkey check for personal data?

Yes. The PII redaction docs say detected PII in a request is replaced with standardized identifiers, such as a numbered email address placeholder, before the request is forwarded to the model, and the check can also scan responses. Detection runs through the configured guardrail provider. Because it masks data rather than only flagging it, this directory places Portkey in the data protection layer as well as runtime guardrails.

Key facts you can cite

We have no commercial relationship with Palo Alto Networks (Portkey).

Sources & last reviewed

Last reviewed . We compile from the vendors' own public pages and repositories and we do not run the products. Source links open in a new tab. Found a mistake? Report a correction.