Kaeso
The open-source AI gateway you run yourself
About Kaeso
Kaeso is an open-source AI gateway that a team installs on its own servers. It sits between a company's apps and its model providers, so every request to OpenAI, Anthropic, Cerebras, Groq, Mistral, DeepSeek, OpenRouter and the other built-in providers passes through one place the team controls. Apps keep the official OpenAI, Anthropic, Google Gen AI and ElevenLabs SDKs, as well as Claude Code and Codex; they only change the base URL and use a Kaeso key in place of a provider key. Kaeso does not resell model access. Provider keys belong to your organization, are encrypted with AES-256-GCM under a master key ring you hold and never reach application code, and you pay each provider directly on your own account.
The problem it targets is the sprawl that follows when many teams and apps call many models: keys copied into config files, no single view of spend, and no way to stop a runaway script. Kaeso adds single sign-on through OpenID Connect, roles, budgets, rate limits and request logs, managed in a web console with an audit log of every change rather than in a config file. The gateway is one compiled Rust binary with no interpreter on the request path and keeps no state of its own, so it scales by adding instances behind a load balancer. The site compares it directly with LiteLLM, which it describes as a Python proxy that reaches far more providers than Kaeso's 14 built-in ones, and says Kaeso is for teams that want the whole company signing in to one gateway. The gateway, the console, the KPP translation format and the UI library ship together in one MIT-licensed repository on GitHub. The repository was created in October 2026, is written mainly in Rust and receives commits most days; the site lists version 0.5.6 of 2 November 2026 as the latest release, and 0.6.0 release candidates have followed on GitHub.
First you install it. One command installs Caddy, the gateway, the console, PostgreSQL, Valkey and ClickHouse with Docker Compose, with TLS on your own domain and the updater switched on. The stated requirements are 2 vCPUs, 4 GB of RAM and 20 GB of disk, with images for linux/amd64 and linux/arm64, and templates run the same release on Render, Railway, DigitalOcean, Fly.io, AWS, Azure and Google Cloud, or on Coolify, Dokploy and CapRover. The quick start also asks for an SMTP server, because the gateway sends sign-in links, invitations and alerts by email.
Second you set up the organization in the console: add provider keys, create projects, invite members with roles, issue API keys, and optionally connect your OpenID Connect identity provider and require single sign-on or two-factor authentication.
Third you point your apps at it. An app keeps its SDK, swaps the base URL for your Kaeso address and uses its Kaeso key. On each request the gateway answers the key check from memory, checks every rate and budget at once in Valkey, translates the request if the app's format differs from the provider's, calls the provider over pooled connections, streams the reply back event by event, and writes usage and logs only after the reply has gone.
Finally you monitor and adjust. The console shows analytics and request logs, and the gateway exposes metrics on port 9100, including its own overhead, request duration and time to first byte, so you can measure it on your own install.
- •Cross-Format Translation - Requests are translated through KPP, Kaeso's canonical format, so an OpenAI SDK can call Claude and an Anthropic or Gemini SDK can call GPT models. OpenAI's Images, Audio and Videos APIs reach every provider that makes images, speech or video. A field the target model cannot honor is refused with an error that names it instead of quietly disappearing.
- •Single Sign-On Included - OpenID Connect per organization, verified email domains, and settings to require single sign-on or two-factor authentication. The site stresses that this is in the MIT-licensed code, with no enterprise edition to buy.
- •Limits and Budgets - Spend and token budgets per day, per month or in total, and request and token rates per minute, can be set on a project, a member or a key. Hard budgets reserve a worst case for every request in flight, so a burst of expensive calls cannot overrun them.
- •Request Logs and Costs - Every request is logged with status, tokens, cost and timing, and with its content when the organization allows it. Images, audio and files are left out unless Keep media is on, and requests and tool calls export as CSV or JSON Lines. Logs live in ClickHouse; you can use your own or turn logs off.
- •MCP Portal per Project - Each project gets one MCP address that offers your MCP servers' tools to clients such as claude.ai, ChatGPT and Cursor, which sign in with OAuth. Kaeso signs in to each server, by default holds changed tool definitions until someone approves them, and checks, rate-limits and logs every tool call.
- •Providers You Hold the Keys For - Built-in providers include OpenAI, Anthropic, Cerebras, Cohere, DeepSeek, Groq, Mistral, Moonshot, Ollama Cloud, OpenRouter, QwenCloud, Together AI and Vercel, and local servers such as vLLM, Ollama and LM Studio can be added as custom providers.
Kaeso is built for platform and infrastructure teams who need one controlled entry point for every internal app that calls a language model. Companies that already run an OpenID Connect identity provider can put model access behind the same sign-in as the rest of their tools, and finance or engineering leads get per-project and per-key budgets that actually stop spending at the limit.
Developer teams using Claude Code, Codex or the official SDKs can keep their code unchanged and swap only the base URL, while calling models from other providers through the format translation. Teams building agents with MCP servers can expose those tools to claude.ai, ChatGPT or Cursor through one approved, logged portal per project.
It also suits teams that have outgrown a config-file proxy and want a console, roles and an audit log, provided they are comfortable running Docker services themselves. It is not a hosted API: there is no paid or managed plan on kaeso.app, so you need a server, a domain, an SMTP server and your own provider accounts, and you pay the providers directly for the tokens you use.
Pricing
No pricing page found
- Open Source (MIT)$0/mo
Checked 2026-11-10
