Opsta AI Gateway puts every large-language-model request and every AI-agent (MCP) tool call behind one governed gateway that runs in your own Kubernetes cluster. Teams keep using the OpenAI-compatible API they already know; the organization gains a single point to control spend, enforce access and safety policy, see usage, and keep an audit trail — without sending data to a third-party cloud.
Hierarchical USD budgets — organization → project → group → user. The tightest applicable cap wins; spend is priced per token per model.
API-key authentication, role-based access (platform / org admin / member), and SSO with per-organization IdP brokering (OIDC / SAML).
Prompt-injection detection (pattern and embedding-based), optional PII masking, and per-project tuning — with a visible block trail.
Stable logical model names mapped to any OpenAI-compatible provider or self-hosted model, configured per project — no app changes to switch providers.
Reuse answers for semantically similar prompts to cut latency and upstream spend, with cache-aware cost accounting.
Give AI agents governed access to tools: register remote MCP servers per project, fronted with the same identity, isolation, and audit as LLM traffic.
Self-hosted usage, cost, and health dashboards with per-organization isolation — no telemetry leaves your environment.
Every administrative action — including denied attempts — is recorded with actor, target, outcome, and status.
A control plane you own (backed by PostgreSQL, the single source of truth) continuously reconciles a data plane — the gateway that handles live traffic. Administrators change configuration in the web console or API; the gateway holds no configuration of its own, so there is no YAML to hand-edit and no configuration drift. The whole platform is one Helm chart, reproducible from code, and deploys standalone for pilots or highly available for production with a single toggle.
Request content, telemetry, identity, configuration, and audit all live in your cluster. The only egress is to the providers you explicitly configure.
Mirror every image into your registry; issue TLS from an internal CA; broker identity in-cluster. No internet egress required.
Authorization is enforced on a verified token, not a trust-me header; org admins are scoped to their own organization.
Pinned, vulnerability-scanned images; build-once / promote-by-retag, so the exact tested artifact is the one that ships.
| Platform | Kubernetes ≥ 1.28 (Gateway API); on-prem, private cloud, or air-gapped |
|---|---|
| Client interface | OpenAI-compatible /v1 REST API; Model Context Protocol (MCP) for agent tools |
| Providers | OpenAI-compatible, DeepSeek, Anthropic, and self-hosted models (vLLM / Ollama / internal) |
| Identity | OIDC / SAML via an in-cluster identity broker; per-organization SSO with just-in-time provisioning |
| Tenancy | Organization → Project → Group → User; isolation across keys, budgets, routing, telemetry, and tools |
| Observability | Self-hosted metrics, logs, and traces; per-organization dashboards |
| Deployment | Single Helm chart; standalone or high-availability; air-gap image mirroring; backup & DR |
| Console | Web console for admins and developers |
You run Opsta AI Gateway in your own environment under an Enterprise Product License.
Opsta operates the gateway in your environment with professional, trusted support.
