Leanroute vs Cloudflare AI Gateway
Managed gateway with MCP, guardrails, and cost controls.
Cloudflare AI Gateway is a free edge-network proxy — it caches, logs, and forwards your LLM traffic through Cloudflare's 300+ PoPs. Genuine strength in network reach and DDoS shielding. It does not, however, ship MCP passthrough, BYOK encryption per tenant, a guardrails library, or spend caps — the things you pay $15/mo to get out of the box with Leanroute.
Snapshot date: August 2026. Feature claims re-validated quarterly — check developers.cloudflare.com/ai-gateway before depending on a specific number.
TL;DR
Pick Cloudflare if you want free routing + edge caching + DDoS protection and don't need MCP, guardrails, per-tenant isolation, or spend caps. Cloudflare is genuinely the cheapest option for pure proxy-through-a-CDN. Pick Leanroute if you need any of: (a) native MCP passthrough with allowlist, (b) a curated guardrails library, (c) BYOK encryption per org, (d) hard spend caps or per-key rate limits, or (e) APAC + India provider depth with Singapore residency.
Where we differ
| Dimension | Leanroute | Cloudflare AI Gateway |
|---|---|---|
| Base price | $15/mo BYOK subscription (or 5% top-up fee credits) | Free (with Workers plan usage) |
| Token markup | Zero — provider list price | Zero — you bring your own provider keys |
| Native MCP passthrough | Yes — `mcp_servers` on any /v1/chat/completions request | Not supported |
| Per-org MCP allowlist | Yes — 403 on unlisted URLs | N/A (no MCP support) |
| Guardrails library | 7 curated rules (PII, secrets, prompt-injection, moderation, etc.) | Basic keyword filters via Workers |
| BYOK encryption | Keys encrypted at rest with master held in runtime memory | Store in Workers Secrets (env-level, no per-org isolation) |
| Per-org cache isolation | Yes — Redis keys namespaced by org id | Global cache; no org concept |
| Spend caps + rate limits | Per-org daily/monthly caps, per-key RPM/TPM, hard 402/429 | None (Workers rate-limits at IP/route level only) |
| Billing / dashboard | Prepaid credits + BYOK sub, per-request cost log, admin console | Not applicable — no billing layer |
| APAC + India providers first-class | Qwen, GLM, Doubao, Kimi, Sarvam, Krutrim | Some via Workers AI (WhisperV3, LLaMA); no APAC direct |
| Data residency | Singapore | Global edge — pick a Data Region on paid plans |
| Network / edge presence | Fly.io sin region | 300+ PoPs worldwide, DDoS protection included |
Rust-tinted cell: Leanroute leads. Muted cell: Cloudflare leads. No tint: tie.
Where Cloudflare still wins
- Free. If your workload is small, exclusively routing, and doesn't need the feature layer, Cloudflare's free tier is unbeatable.
- Network reach + DDoS. 300+ PoPs plus Cloudflare's standard DDoS shielding come free with your gateway traffic. We run a single Fly region.
- Bundled with Workers. If your app is already deployed on Cloudflare Workers, the AI Gateway is one binding away.
- Workers AI catalog. Small models hosted directly by Cloudflare (LLaMA, Whisper, embeddings) with no upstream provider needed.
See also: vs Vercel AI · vs OpenRouter · vs Portkey · MCP passthrough docs