LiteLLM vs OpenRouter (2026)

LiteLLM's MCP Gateway gives agents one fixed endpoint for every registered MCP server, with access controlled per key and team and server authentication for OAuth, OAuth passthrough, on-behalf-of, AWS SigV4 and JWT signer schemes. On the Responses and Chat Completions endpoints the proxy fetches the MCP server's tools and, when configured to, executes the returned tool calls itself. So agents take authenticated action in outside systems through the gateway and do not just hand a suggestion back.

Sourcedocs.litellm.ai/docs/mcpread 2026-09-22

Custom tools work across the catalog: tool calling uses one request format for any tool capable model, Auto Exacto routes tool calling requests to the providers that handle them best, and the Agent SDK's tool() helper defines a customer's tools and executes them in the agent loop, including tools from MCP servers. An agent built on OpenRouter takes authenticated action in outside systems through the customer's own tools.

Sourceopenrouter.ai/docs/guides/features/tool-callingread 2026-09-22

With an MCP tool's require_approval set to never, the proxy executes the model's tool calls and feeds the results back into the model before returning the answer, so the gateway runs a multi-step agent loop itself, and the A2A Agent Gateway routes calls to registered agents. There is no stated workflow definition, deterministic node or versioned flow, so sequencing, branching and retries that mix deterministic steps with agent steps are not covered.

Sourcedocs.litellm.ai/docs/mcpread 2026-09-22

The Agent SDK runs multi turn agent loops, calling tools and deciding the next step until a stop condition is met (step count, a specific tool call, maximum cost), and the subagent server tool lets a model hand self contained tasks to a worker model, optionally with its own tools, mid generation. There is no workflow definition, deterministic node or versioned flow, so a workflow cannot mix deterministic nodes with agent steps.

Sourceopenrouter.ai/docs/agent-sdk/overviewread 2026-09-22

Work reaches agents through LiteLLM when a caller sends a request, and model, MCP and A2A calls are all invoked by the client. There is no stated schedule, event, webhook or inbound queue that starts an agent run, and budget alerts notify people and do not wake an agent. A gateway that only answers callers has no way to wake an agent on its own.

Sourcedocs.litellm.ai/docs/a2aread 2026-09-22

The Ori runtime provides a built-in cron scheduler. Features declare schedules, several per feature, that start headless runs with a durable event log, an overlap policy and optional jitter. Schedules can catch up on runs missed during a restart and can be disabled without deletion, and ori schedules reports whether each timer is armed. Those schedules start agent runs with no person initiating them.

Sourceopenrouter.ai/docs/guides/ori/changelogread 2026-09-22

The /rag/ingest endpoint is an all in one ingestion pipeline (upload, chunk, embed, write to a vector store) into OpenAI vector stores, Bedrock Knowledge Bases, Vertex AI RAG Engine, Gemini or AWS S3 Vectors, and /rag/query searches the ingested content and generates a response from it. Vector store access is permissioned per team in the gateway. New customer knowledge enters a persistent index without retraining, so the retrieval structure over the customer's knowledge is maintained, persists, scales past the context window and stays queryable.

Sourcedocs.litellm.ai/docs/rag_ingestread 2026-09-22

OpenRouter routes embedding requests to embedding models, and its RAG cookbook shows the customer building and storing their own index with those embeddings. The web search and web fetch server tools reach the public web, which is not the customer's corpus. OpenRouter maintains no retrieval structure over the customer's own documents, and routing embedding calls does not create one.

Sourceopenrouter.ai/docs/api_reference/embeddingsread 2026-09-22

The proxy's Memory Management API (/v1/memory, LiteLLM v1.83.10 or later with PostgreSQL connected) keeps entries across sessions, scoped per user and team with role-based read and write rules, and supports create, read, update, list by key prefix and delete. Memory lives in the gateway's own Postgres, and one user's entries can be deleted without touching the rest. The application reads entries and places them in the prompt. The scope is stated, but no lifetime is.

Sourcedocs.litellm.ai/docs/proxy/memoryread 2026-09-22

The Agent SDK's StateAccessor persists conversation state (message history, tool results and approval decisions) between callModel invocations, and a hosted intern continues the same run when a later prompt carries its session_id. That is conversation state carried across turns of one conversation, and there is no memory layer with its own scope and lifetime.

Sourceopenrouter.ai/docs/agent-sdk/call-model/tool-approval-stateread 2026-09-22

Guardrails run before, during or after a call and can be scoped per key and team (PII masking, prompt injection and secret detection, content moderation and third-party guardrail providers), and the MCP Gateway adds per-key and per-team tool permissions and guardrails on tool results. These are constraints the customer controls on what an agent may do.

When an MCP tool's require_approval is set to anything other than never, the proxy returns the tool calls to the client so they can be reviewed and executed manually, and that review happens in the customer's own client. LiteLLM itself has no stated surface where a person reviews and approves an agent action before it commits.

Sourcedocs.litellm.ai/docs/mcpread 2026-09-22

The Agent SDK (@openrouter/agent) includes an approval gate. A tool marked requireApproval pauses execution when the model calls it, so a person can approve or reject each call before it runs, and a StateAccessor carries approval decisions across separate request cycles, for example in a web application. Workspace guardrails also cap spend and restrict models and providers per member or key.

Sourceopenrouter.ai/docs/agent-sdk/call-model/tool-approval-stateread 2026-09-22

Access control covers SSO for the Admin UI through Okta, Azure AD, Google Workspace or any OIDC or SAML provider (free for up to five users, an Enterprise license beyond that), SCIM, JWT authentication against the customer's own identity provider, role-based access control across organizations, teams and user roles, IP allowlists, public and private route controls, key rotation and external secret managers.

LiteLLM reports SOC 2 Type II, with the current report available through the LiteLLM Trust Center. Audit logs with retention policies add to that access model, identity integration and attestation. Most controls sit in the Enterprise tier.

Sourcedocs.litellm.ai/docs/enterpriseread 2026-09-22

Enterprise plans get self serve SSO through Okta, Microsoft Entra ID, Google Workspace or any SAML provider, and SCIM group mappings grant workspace access from identity provider groups, with an audit log of mapping and membership changes. Workspaces isolate API keys, routing defaults and guardrails per team, and guardrails per member and per key restrict models, providers and spend. OpenRouter describes itself as SOC 2 compliant and GDPR compatible without naming a report, auditor or date.

Sourceopenrouter.ai/docs/guides/features/ssoread 2026-09-22

The gateway records what each caller's agent did through it, covering request and response content for model and agent calls with user, key and team attribution, latency and cost (shown in the A2A Agent Gateway's Logs tab for invoked agents), and Prometheus metrics in the open source core.

Enterprise adds per-key or per-team log routing to Langfuse, LangSmith, Arize and other callbacks, audit logs of admin actions with retention policies kept apart from request logs, and log export to GCS or Azure Blob. Traffic that passes through the gateway can be inspected step by step, with audit logs kept apart from runtime traces.

Sourcedocs.litellm.ai/docs/a2aread 2026-09-22

Every plan carries activity logs and export. Broadcast sends trace data for every API request, without instrumentation in the customer's code, to Arize AX, Braintrust, Datadog, Langfuse, LangSmith, Grafana, an OpenTelemetry collector, S3, a webhook and other destinations, configured per workspace by an organization admin.

Custom classifiers tag each generation with dimensions the customer defines, and the tags appear in the logs and roll up in the activity view, while SCIM mapping changes keep a separate audit log. Together these give step by step inspection of what the agent sent and received, audit records separate from runtime traces, and export to the customer's own tools.

Sourceopenrouter.ai/docs/guides/features/broadcastread 2026-09-22

Deployment is self hosted. Official Docker images, a Helm chart and a Terraform module run on the customer's own Postgres and Redis, with one-click deploy into AWS, GCP or Azure and fully air-gapped installation. Enterprise includes air-gapped deployment and multi-region deployment under one license with an admin and worker split, and the customer's data and keys never leave its own infrastructure. The customer can run it in its own cloud, on premises or fully air gapped.

Sourcelitellm.airead 2026-09-22

In-Region Routing lets a customer send requests through a region specific base URL (eu.openrouter.ai or us.openrouter.ai). The request is decrypted inside that region and routed only to provider endpoints there, and prompts and completions never leave it. It is available on the Business and Enterprise plans. Zero Data Retention routing also sends requests only to providers that do not retain data.

Sourceopenrouter.ai/docs/guides/features/in-region-routingread 2026-09-22

LiteLLM offers no agents of its own for a customer to adopt. The AI Hub on the Enterprise tier lists the models, agents, MCP servers and skills the customer has registered, which is a directory of the customer's own assets, and the Google AI Studio managed agents LiteLLM supports live entirely on Google's side, with LiteLLM as the auth and routing layer. Nothing there is a ready made workflow, template or role specific agent, and a model or tool catalog is integration, not a prebuilt pack.

Sourcedocs.litellm.ai/docs/enterpriseread 2026-09-22

Ori Harness starts agent CLIs the customer already uses, such as Claude Code, Codex and OpenCode, with OpenRouter credentials and models, and those agents are other vendors' products. Presets are saved request configurations, and Ori's built in skills set up and run Ori itself. OpenRouter has no ready made workflows, templates or role specific agents of its own.

Sourceopenrouter.ai/docs/guides/ori/harnessread 2026-09-22

The customer chooses the model. One OpenAI-compatible API reaches 140+ providers and 1,800+ models, with models set in the customer's own configuration and swapped without changing application code, the customer's internal, fine-tuned and self-hosted models behind the same key, load balancing across providers, regions and keys, lowest-cost routing, and an Auto Router that sends prompts to model tiers the customer configures.

Sourcelitellm.airead 2026-09-22

Model and provider choice sit with the customer. OpenRouter offers 500+ models from 80+ providers behind one API, and a provider object in each request sets order, allowed and ignored providers, price, latency and throughput sorting and data policies, on top of default load balancing, model fallbacks, variants such as :nitro and :floor, and an auto router.

Sourceopenrouter.ai/docs/guides/routing/provider-selectionread 2026-09-22

A Python SDK and a proxy with an OpenAI compatible REST API ship with LiteLLM, and the gateway's own features are callable from outside. The A2A Agent Gateway serves a proxied agent card for each registered agent, pinned to A2A 0.3 or 1.0, and agents are invoked through the A2A SDK or the OpenAI SDK. Memory Management and ingestion have their own REST endpoints (/v1/memory, /v1/rag/ingest) with curl and Python examples.

Sourcedocs.litellm.ai/docs/a2aread 2026-09-22

OpenRouter offers a REST API with a full API reference, client SDKs for TypeScript, Python and Go, the @openrouter/agent Agent SDK, OAuth PKCE for apps that sign users in, Management API keys for programmatic key and spend control, and an Analytics API.

Sourceopenrouter.ai/docs/client-sdks/overviewread 2026-09-22

Shadow evaluations sample a key's, team's or user's live traffic, send each sampled request through a candidate router configuration without returning that answer to the client, and have an LLM judge compare it blind against the answer the current model served. A job runs up to 30 days and can compare several configurations on the same traffic before anything changes, and after a switch each request carries its routing decision and savings. A change is evaluated against the customer's own traffic, with a judge verdict.

Sourcedocs.litellm.ai/docs/auto_router/evaluateread 2026-09-22

Ori Eval tests the customer's agent on real prompts from the customer's project. It writes an eval file, runs the models being compared with one harness and one model held fixed for each run so repeated runs use the same configuration, and returns scores and a recommendation, and features can ship evaluations beside their code through the ori eval command. Retries and model fallbacks also sit in the routing layer.

Sourceopenrouter.ai/docs/guides/ori/evalread 2026-09-22

The product is a gateway for models, MCP servers and agents, and there is no stated browser, desktop or remote computer session that LiteLLM runs for an agent. The sandboxes in the Managed Agents Platform announcement, and the swap of OpenAI's Code Interpreter for E2B or OpenSandbox, are code execution, not control of a real interface that an agent drives itself.

Sourcelitellm.airead 2026-09-22

The web fetch server tool lets any model fetch a URL during a request. OpenRouter fetches and extracts the page, using the provider's native fetch where available and otherwise Exa, and returns the text to the model. That is a headless fetch with a third party engine wired in, and there is no hosted browser, desktop session or remote computer control that an agent drives.

Sourceopenrouter.ai/docs/guides/features/server-tools/web-fetchread 2026-09-22