A high-performance self-hosted LLM gateway with a stable
OpenAI-compatible HTTP contract. The
litellm-rs crate is the gateway's reusable Rust kernel, with narrower
support policies for runtime-backed APIs and legacy compatibility adapters.
- 60+ runtime-wired providers - OpenAI, Anthropic, AWS Bedrock, Mistral, Cloudflare, plus 50+ OpenAI-compatible providers via the Tier 1 catalog. See Provider Support for the full matrix.
- Stable OpenAI-Compatible API - Versioned inference contract served at
GET /openapi.json - Admin control-plane OpenAPI - Auth, keys, teams, budgets, routing, ledger, and provider APIs at
GET /admin/openapi.json - Measured Performance - Reproducible gateway-overhead benchmark methodology
- Intelligent Routing - Load balancing, failover, cost optimization
- Gateway Controls - Default-on prompt-injection guardrails, configured IP access, auth, rate limiting, deterministic caching, metrics, and health endpoints
Run the primary supported product from source:
git clone https://github.com/majiayu000/litellm-rs.git
cd litellm-rs
cp config/gateway.dev.yaml.example config/gateway.yaml
cargo run --bin gateway --features sqliteOr install the gateway binary:
cargo install litellm-rs --version 0.8.2 --locked --bin gateway --no-default-features \
--features postgres,sqlite,redis,s3,metrics,tracing,websockets,providers-extra,providers-extended,mcp-validation,a2a
mkdir -p config
curl -L https://raw.githubusercontent.com/majiayu000/litellm-rs/v0.8.2/config/gateway.dev.yaml.example -o config/gateway.yaml
gatewayThe development config starts without provider credentials or auth secrets and
uses the local vllm catalog provider. Use
config/gateway.yaml.example for production-style deployments with real
provider keys and auth enabled. The explicit sqlite feature enables the storage needed by the gateway binary.
The registry install selects the same feature profile as release archives and
containers, including MCP, A2A and Realtime. Binary and example config versions
must match. See the 0.8 artifact verification
for source and published-artifact verification.
The gateway serves its stable inference contract at GET /openapi.json; the
versioned source is
docs/openapi/inference.json. The admin
control-plane contract is served at GET /admin/openapi.json (admin-authenticated)
from docs/openapi/admin.json.
API-key budgets currently use process-local definitions and counters. Persisting
a key's budget_id does not restore its budget after restart or share its balance
with another gateway; an unavailable binding fails closed. The key management API
rejects max_budget. Redis-backed provider/model budgets are a separate scope;
see the budget capability boundary.
For a first HTTP request or setup failure, use the gateway setup and compatibility questions.
| Surface | Support policy |
|---|---|
| Self-hosted HTTP gateway | Primary product. Stable inference routes follow the published OpenAPI contract; configured deployments expose their canonical ProviderCapability. |
| Runtime-backed Rust APIs | Reusable gateway kernel. LLMClient::from_runtime, DefaultRouter::from_runtime, and runtime-configured completion() derive support from the selected deployment and fail unsupported capabilities with typed errors. |
| Legacy SDK and selector adapters | Compatibility surfaces with narrower coverage. The legacy adapter matrix is authoritative for these paths and is not a canonical runtime capability matrix. |
Version 0.8.2 is published as the versioned crate,
GitHub Release archives
and ghcr.io/majiayu000/litellm-rs:0.8.2 (Linux amd64/arm64). They share the
shipped gateway feature profile documented below. Prefer a versioned image tag
or immutable digest; latest is mutable. Docker Hub publication is optional.
Source checks and actual publication identifiers are recorded separately in
the 0.8 verification record.
[dependencies]
litellm-rs = { version = "0.8", default-features = false, features = ["lite"] }No make step is required for crate consumers.
Add Tokio with macros and rt-multi-thread features. The application must
install its configured RuntimeBinding with install_default_runtime before
calling completion; the verified consumer example
shows runtime setup and successful calls against a local mock.
use litellm_rs::{completion, user_message, system_message};
#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
let response = completion(
"gpt-4",
vec![
system_message("You are a helpful assistant."),
user_message("Hello!"),
],
None,
).await?;
println!("{}", response.choices[0].message.content.as_ref().unwrap());
Ok(())
}The gateway router config maps these fields into the runtime router:
router.strategyselects the deployment routing strategy.router.circuit_breaker.failure_thresholdcontrols consecutive failures before cooldown.router.circuit_breaker.recovery_timeoutcontrols cooldown duration in seconds.router.circuit_breaker.min_requestssets the sample size required before cooldown.router.circuit_breaker.success_thresholdsets the successes required to recover from cooldown.router.load_balancer.health_check_enabledenables pre-call deployment health checks.
Active provider probes are opt-in: a provider's health_check must differ from the defaults.
Native probes are limited to provider types whose configured deployment is unambiguously a chat
model (currently Anthropic and GitHub Copilot); they send a one-token request and may incur provider
charges. OpenAI, Bedrock, OpenAI-compatible, Vertex AI, FalAI, and other multi-capability providers
require a custom health_check.endpoint. Without an active probe policy, readiness remains
fail-closed (Unknown).
router.load_balancer.sticky_sessions and router.load_balancer.session_timeout are reserved for future session affinity. Non-default values fail config validation until runtime affinity is implemented.
Gateway YAML can publish stable model names and deterministic primary/fallback tiers:
providers:
- name: openai-primary
provider_type: openai
api_key: "${OPENAI_API_KEY}"
models: [gpt-4o]
priority: 0
- name: openai-fallback
provider_type: openai
api_key: "${OPENAI_API_KEY}"
models: [gpt-4o]
priority: 10
model_aliases:
production-chat: gpt-4o
stable-chat: production-chat
router:
strategy: priority_basedAlias chains are validated and flattened at startup; empty values, cycles,
canonical-name collisions, and targets without an enabled deployment fail
startup. Alias names appear in /v1/models alongside canonical models. Lower
numeric priority wins under priority_based; omitted provider priorities
default to 0. When rolling back to a binary that predates these fields,
remove model_aliases and priority from YAML before rolling back the binary,
because unknown fields are rejected.
Runtime wiring decisions are tracked in src/core/subsystem_registry.rs, and tests assert that every module exported from src/core/mod.rs is either referenced by the gateway runtime or explicitly classified. The current issue-838 subsystem decisions are:
| Subsystem | Decision | Runtime status |
|---|---|---|
core/guardrails |
wire | Default-on prompt-injection checks run before provider execution and on non-streaming output; guardrails.enabled: false is the explicit opt-out. |
core/ip_access |
wire | Configured allow/block rules run as an outer Actix middleware and short-circuit before downstream side effects; empty/default rules allow all. |
core/mcp |
feature-gated | gateway,mcp mounts authenticated Streamable HTTP at /{server_name}/mcp (/mcp for one enabled server). See MCP gateway for configuration and stateless transport limits. Responses API MCP descriptors pass through independently. |
core/a2a |
experimental-gate | Opt-in gateway,a2a exposes authenticated A2A 1.0 agent cards, messages, task queries/cancellation and SSE. Task ownership is process-local; see A2A gateway. |
server/routes/ai/realtime |
feature-gated | gateway,websockets mounts the manual OpenAI Realtime gateway. The unused legacy core/realtime client has been removed. |
core/observability and core/integrations |
wire | Configured Langfuse, OpenTelemetry, and Datadog backends are initialized at startup and receive real chat, completion, response, and embedding lifecycle events. |
core/audit |
wire | enterprise.audit_logging: true registers request audit middleware; events use structured JSON on stderr unless a file or custom output is configured. Default is off. |
core/batch |
library-only | /v1/batches remains a wired provider proxy. Domain records and async batch helpers remain; the unreachable BatchProcessor has been removed. |
Former core/webhooks |
removed | The unused library and webhooks feature have been removed in 0.8.0. Budget-alert delivery and provider-native webhook fields remain separate. |
Former core/semantic_cache and core/analytics |
removed | Removed in 0.8.0 after the expired 0.7 deadline. Deterministic caching, request metrics and callbacks remain; see the migration guide for removed fields/features. |
core/virtual_keys |
wire | Runtime virtual keys use the canonical core::keys::KeyManager; the duplicate legacy manager has been removed. Storage record types remain in use. |
core/user_management |
internal | Domain records back current auth/storage paths. The unused UserManager and its user-management feature have been removed. |
Since 0.8.0, default features select the reusable library with metrics and
tracing. Gateway and database dependencies are opt-in. The previous 0.7.0
release used gateway defaults; gateway consumers must explicitly select a
storage feature such as sqlite or postgres.
# Library with metrics and tracing
[dependencies]
litellm-rs = { version = "0.8", default-features = false, features = ["lite"] }
# Library without optional observability
[dependencies]
litellm-rs = { version = "0.8", default-features = false }
# Gateway with SQLite (also enables Redis support)
[dependencies]
litellm-rs = { version = "0.8", features = ["sqlite"] }Use the crate root or litellm_rs::prelude for completion and embedding APIs.
Advanced types have explicit module paths: core::providers for provider
construction, core::router for deployment management, and
core::models::openai for HTTP wire models. Hidden root re-exports of these
advanced types have been removed in 0.8.0.
Perplexity's old Sonar Chat Completions endpoint retired on 2026-09-27. The
perplexity / perplexity-ai / pplx selectors are not currently dispatchable;
the replacement Agent API requires a native protocol adapter. Historical prices
remain available and do not establish callable models. See the
retirement audit.
GitHub Models (github / github-models) retired on 2026-07-30 and is no longer
a callable selector. GitHub Copilot remains a separate native provider.
See the retirement audit.
Lambda shared inference retired on 2025-09-25. The lambda_ai selector is removed.
The unverified meta_llama, v0 and amazon_nova default transports are also disabled;
use the existing Bedrock provider for supported Nova models or configure an
OpenAI-compatible deployment with its real endpoint. See the
remaining catalog review.
Providers are organised into two tiers (see CLAUDE.md → Provider Tiers for the engineering definition).
- Tier 1 — catalog-only: OpenAI-compatible endpoints declared as data in
src/core/providers/registry/catalog.rs. Routed throughOpenAILikeProvider. Always available (no cargo feature required). The runtime supports chat and streaming plus explicitly verified embeddings, images and audio capabilities for selected providers; see compatible non-chat support. Capability declarations do not imply that every model supports every endpoint. - Tier 2 — code-based: providers with custom request/response handling, auth signing, or streaming. Wired into the
Providerenum and the factory. Some Tier 2 builders are feature-gated.
External Rust providers implement ExternalProvider and register through
Provider::External(Arc::new(provider)), Deployment::new, and
UnifiedRouter::add_deployment, without editing the internal enum. See the
external provider integration tests
for capability, health, error and streaming behavior. This is an in-process API;
OpenAI-compatible servers can use the existing configuration path.
The provider and legacy adapter matrices below are validated against the provider registry and Tier 1 catalog. The source of truth for Tier 1 entries is
catalog.rs; Tier 2 identity and dispatch metadata lives insrc/core/providers/registry/types.rs, with construction branches insrc/core/providers/factory/registry.rs. Legacy adapter availability lives insrc/core/providers/registry/support_matrix.rs.passthroughmeans a retained adapter forwards the call to the upstream OpenAI-compatible endpoint without per-provider transformation.
This matrix records selector-based compatibility adapters. It is not the
capability source for LLMClient::from_runtime, DefaultRouter::from_runtime,
or the free completion() functions. Canonical runtime support is derived from
the selected deployment's ProviderCapability; unsupported capabilities fail
closed with a typed provider error.
| Legacy selector class | HTTP chat / stream adapter | HTTP embeddings / image adapter | SDK chat / stream / embeddings adapter | completion() chat / stream adapter |
Notes |
|---|---|---|---|---|---|
openai |
✅ / ✅ | ✅ / ✅ | ✅ / ✅ / ✅ | ✅ / ✅ | Reference provider across all current surfaces. |
anthropic |
✅ / ✅ | – / – | ✅ / ✅ / – | ✅ / ✅ | Native chat and streaming only. |
azure |
passthrough / passthrough | providers-extra / providers-extra |
– / – / ✅ | passthrough / passthrough | SDK exposes Azure embeddings; SDK chat is not implemented. |
azure_ai |
passthrough / passthrough | providers-extra / providers-extra |
– / – / – | providers-extra / providers-extra |
completion() supports azure_ai/ and azure-ai/ routes when the native feature is enabled. |
bedrock |
✅ / ✅ | ✅ / – | – / – / – | – / – | No legacy SDK or completion() adapter. Configured canonical runtimes use the deployment's chat, stream, and embedding capabilities. |
databricks, snowflake |
passthrough / passthrough | – / – | – / – / – | – / – | Governed OpenAI-compatible chat/SSE runtimes with platform-specific identity and auth. |
oci |
mode-dependent | mode-dependent / – | – / – / – | – / – | Compatible mode provides chat/SSE; IAM native mode provides embeddings and rerank. |
watsonx |
✅ / – | ✅ / – | – / – / – | – / – | Native chat, embeddings, and rerank. |
sagemaker |
✅ / – | – / – | – / – / – | – / – | InvokeEndpoint requires an explicit supported payload transformer. |
mistral, cloudflare, cohere, voyage, vertex_ai, gemini, fal_ai, replicate, stability, black_forest_labs, ollama |
provider-specific | provider-specific | – / – / – | – / – | See support_matrix.rs for feature-gated HTTP support. Ollama retains its existing SDK stream-only path. |
google / SDK Google |
– / – | – / – | – / – / – | – / – | Google/Gemini SDK chat is intentionally unsupported until a real adapter exists. |
Default catalog dynamic routes: openrouter, deepseek, moonshot, minimax, zhipu, zai, together_ai, fireworks_ai, aiml, groq, xiaomi_mimo, xai |
passthrough / passthrough | – / – | – / – / – | ✅ / ✅ | OpenAI-compatible routes wired into default completion() routing. |
| Other Tier 1 catalog providers | passthrough / passthrough | – / – | – / – / – | – / – | HTTP gateway chat/stream only unless routed through explicit OpenAI-compatible config. |
SDK Custom |
– / – | – / – | – / – / ✅ | – / – | SDK custom providers support embeddings when base_url is configured. |
SDK Ollama |
– / – | – / – | – / ✅ / – | – / – | SDK streaming uses the OpenAI-compatible stream parser; SDK chat is not implemented. |
The runway-media feature exposes a library-only Runway task contract for
text/image-to-video submit, query, cancel, and result polling. It does not mount
a gateway video route.
| Provider | Cargo feature | Chat | Stream | Embed | Image | Audio | Notes |
|---|---|---|---|---|---|---|---|
OpenAI (openai) |
always | ✅ | ✅ | ✅ | ✅ | ✅ | Reference implementation. |
Anthropic (anthropic) |
always | ✅ | ✅ | – | – | – | Native Anthropic messages API. |
Mistral (mistral) |
always | ✅ | ✅ | passthrough | – | – | Native client. |
Cloudflare Workers AI (cloudflare) |
always | ✅ | ✅ | – | – | – | Official compatible chat endpoint with account-id auth; model-gated tools/vision and native SSE usage/errors. Embeddings remain unsupported. |
Deepgram (deepgram) |
always | – | – | – | – | ✅ | Native speech-to-text and text-to-speech REST transport. |
ElevenLabs (elevenlabs) |
always | – | – | – | – | ✅ | Native speech-to-text and text-to-speech REST transport. |
Cohere (cohere) |
native factory (providers-extended) |
✅ | ✅ | ✅ | – | – | Uses native Cohere /v2/chat and /v2/embed; the concrete provider also exposes a /v1/rerank helper. Explicitly unsupported without providers-extended. |
Voyage (voyage) |
always | – | – | ✅ | – | – | Uses native Voyage /v1/embeddings and the shared HTTP /v1/rerank route with exact model capability and pricing identity. |
Azure OpenAI (azure) |
native factory (providers-extra); OpenAILike fallback |
✅ | ✅ | ✅ | ✅ | – | Native Azure supports chat, streaming, embeddings, and image generation with providers-extra; otherwise the factory path uses OpenAILike chat/stream only. |
Azure AI Inference (azure_ai) |
native factory (providers-extra); OpenAILike fallback |
✅ | ✅ | ✅ | ✅ | – | Native Azure AI supports chat, streaming, embeddings, and image generation with providers-extra; otherwise the factory path uses OpenAILike chat/stream only. |
AWS Bedrock (bedrock) |
always | ✅ | ✅ | ✅ | helper API | – | Native AWS Bedrock runtime path with SigV4 signing. Use openai_compatible for Bedrock Access Gateway or other OpenAI-compatible proxies. |
Databricks Model Serving (databricks) |
always | ✅ | ✅ | – | – | – | OpenAI-compatible chat/SSE with typed workspace and token configuration. |
Snowflake Cortex (snowflake) |
always | ✅ | ✅ | – | – | – | OpenAI-compatible chat/SSE with typed account and token-type configuration. |
OCI Generative AI (oci) |
always | ✅ | ✅ | ✅ | – | – | Compatible mode provides chat/SSE; IAM native mode provides embeddings and rerank. |
IBM watsonx.ai (watsonx) |
always | ✅ | – | ✅ | – | – | Native chat, embeddings, and rerank with explicit project or space identity. |
Amazon SageMaker (sagemaker) |
always | ✅ | – | – | – | – | SigV4 InvokeEndpoint; payload transformer is required and unknown schemas fail closed. |
Google Vertex AI (vertex_ai) |
native factory (providers-extra) |
✅ | ✅ | ✅ | ✅ | – | Uses native Vertex auth and Google-specific URLs when providers-extra is enabled; otherwise explicitly unsupported. |
Google Gemini (gemini) |
native factory (providers-extended) |
✅ | ✅ | – | – | – | Uses native Google AI Studio Gemini auth; use vertex_ai for Vertex AI project/location credentials. |
fal.ai (fal_ai) |
native factory (providers-extended) |
– | – | – | ✅ | – | Uses native Fal AI image-generation endpoints; chat and streaming are explicitly unsupported. |
Stability AI (stability) |
native factory (providers-extended) |
– | – | – | ✅ | – | Uses native v2beta multipart image generation and editing endpoints. |
Black Forest Labs (black_forest_labs) |
native factory (providers-extended) |
– | – | – | ✅ | – | Uses native asynchronous submit/poll image generation and Kontext editing. |
Replicate (replicate) |
native factory (providers-extended) |
✅ | ✅ | – | ✅ | – | Uses native Replicate prediction lifecycle handling for chat, streaming, and image generation; explicitly unsupported without providers-extended. |
Ollama (ollama) |
native factory (providers-extended) |
✅ | ✅ | ✅ | – | – | Uses native /api/chat NDJSON streaming, /api/embed, and model tags/show endpoints. Localhost defaults to private-network endpoint policy; explicit endpoints keep their configured policy. |
GitHub Copilot (github_copilot) |
native factory (providers-extended) |
✅ | ✅ | – | – | – | Uses native GitHub Copilot auth and model access when providers-extended is enabled; otherwise explicitly unsupported. |
Generic OpenAI-compatible (openai_compatible) |
always | ✅ | ✅ | passthrough | passthrough | passthrough | For self-hosted / unlisted OpenAI-compatible chat, embeddings, image, and audio endpoints. |
GitHub Copilot captures its effective token directory, credential filenames, and file contents when the provider is constructed. Reload the gateway after changing those paths or switching credential files to another account. Existing requests and provider clones keep their captured credentials; API-key refresh uses that resource's access token and returns a matching token and endpoint. Authentication remains lazy when no credentials are available. If only an API-key cache was captured, configure an access token and reload before that key needs refreshing.
All entries below route through OpenAILikeProvider. Chat and streaming use the compatible /chat/completions protocol. Selected providers also expose verified non-chat capabilities listed in compatible non-chat support; other capabilities fail explicitly.
Cloud (Bearer auth via env var):
groq, ai21, huggingface, baseten, together, together_ai, fireworks, fireworks_ai, cerebras, openrouter, deepinfra, deepseek, novita, nvidia_nim, nebius, nscale, hyperbolic, featherless, galadriel, sambanova, heroku, friendliai, xai, moonshot, dashscope, qwen, baichuan, minimax, volcengine, xiaomi_mimo, zhipu, zai, lemonade, linkup, poe, wandb, nanogpt, aiml_api, aiml, aleph_alpha, anyscale, bytez, comet_api, compactifai, maritalk, siliconflow, yi, ovhcloud
Local (no API key):
vllm, hosted_vllm, lm_studio, llamafile, docker_model_runner, xinference, infinity, oobabooga
For self-hosted or unlisted OpenAI-compatible endpoints, prefer the generic openai_compatible provider type instead.
# Provider API Keys
OPENAI_API_KEY=sk-...
ANTHROPIC_API_KEY=sk-ant-...
GOOGLE_API_KEY=...
AZURE_OPENAI_API_KEY=...
AWS_ACCESS_KEY_ID=...
AWS_SECRET_ACCESS_KEY=...
AWS_REGION=us-east-1
GROQ_API_KEY=...
AI21_API_KEY=...
HF_TOKEN=...
BASETEN_API_KEY=...
DEEPSEEK_API_KEY=...
MOONSHOT_API_KEY=...
ZHIPU_API_KEY=...
MINIMAX_API_KEY=...
# Optional
LITELLM_VERBOSE=true # Enable verbose logginguse litellm_rs::{completion, user_message};
// Automatically routes to the right provider based on model name
let openai = completion("gpt-5.5", vec![user_message("Hi")], None).await?;
let anthropic = completion("anthropic/claude-opus-4-8", vec![user_message("Hi")], None).await?;
let groq = completion("groq/llama-3.1-8b-instant", vec![user_message("Hi")], None).await?;
let bedrock = completion(
"bedrock/us.anthropic.claude-3-5-sonnet-20241022-v2:0",
vec![user_message("Hi")],
None,
)
.await?;bedrock/ uses the native AWS Bedrock provider. It signs requests with AWS
SigV4 and preserves AWS execution model IDs such as us.*, global.*,
region-prefixed IDs, and Bedrock ARNs. Use openai_compatible for Bedrock
Access Gateway or other OpenAI-compatible proxies instead.
use litellm_rs::{embedding, embed_text};
// Single text
let embedding = embed_text("text-embedding-3-small", "Hello world").await?;
// Batch
let embeddings = embedding(
"text-embedding-3-small",
vec!["Hello", "World"],
None,
).await?;use litellm_rs::{completion_stream, user_message};
use futures::StreamExt;
let mut stream = completion_stream(
"gpt-4",
vec![user_message("Tell me a story")],
None,
).await?;
while let Some(chunk) = stream.next().await {
if let Ok(chunk) = chunk {
print!("{}", chunk.choices[0].delta.content.unwrap_or_default());
}
}Gateway throughput and latency claims require a dated raw artifact tied to an exact Git revision. See the reproducible gateway-overhead benchmark methodology for the fixed workload, commands, environment metadata, percentile reporting, and artifact format.
The Criterion benchmarks under benches/ measure in-process components; they
must not be presented as end-to-end HTTP gateway throughput.
- Use API-only defaults first:
cargo test --lib --tests --no-default-features --features "lite" - Limit local parallelism when needed:
CARGO_BUILD_JOBS=4 cargo test --lib --tests --no-default-features --features "lite" -- --test-threads=4 - Avoid
--all-featuresunless you are doing release/nightly validation
- Prefer
default-features = falsewithfeatures = ["lite"] - Use gateway runtime commands only when you need HTTP server/auth/storage middleware
See CONTRIBUTING.md for development setup and guidelines.
See SECURITY.md for security policy and vulnerability reporting.
This project is one layer of an open-source stack for running coding agents (Claude Code, Codex) as serious infrastructure. Every piece works standalone; together they close the loop:
litellm-rs is the Route layer — a self-hosted OpenAI-compatible gateway. See Provider Support for runtime and adapter coverage.
| Layer | Project | What it does |
|---|---|---|
| Extend | claude-skill-registry | Discover and search community Claude Code skills |
| Extend | spellbook | Cross-runtime skills for Claude Code, Codex, and multi-agent workflows |
| Trust | argus | Static install-time scanner for supply-chain attacks (npm / PyPI / crates.io) |
| Trust | vibeguard | Rules, hooks, and guards against hallucinated or unverified agent changes |
| Remember | remem | Local-first persistent memory for Claude Code and Codex sessions |
| Orchestrate | harness | Rust agent orchestration platform — rules, skills, GC, observability |
| Route | litellm-rs ◀ you are here | Self-hosted Rust LLM gateway with OpenAI-compatible APIs, routing, and failover |
| Keep | keepline | Session command center — monitor, recover, never lose agent work |
MIT License - see LICENSE for details.
Inspired by LiteLLM (Python).