Comparison

Provingx vs. everyone else, by name.

14 named vendors, their real current pricing, and 34 capabilities compared one row at a time. Every price links to that vendor's own page, and the rows where Provingx is the wrong tool are left in — you can find them by looking for our crosses.

Last verified September 2026. Vendors change pricing and features often — this is a snapshot, not a live feed.

The one distinction that matters more than any single feature row

The rows below split into four kinds of product. Gateways (Portkey, Kong, Cloudflare, LiteLLM, TrueFoundry, Helicone) are proxies like Provingx, but built for routing, caching and cost observability first. Content guardrails — Pangea, Lakera, Aporia — read prompts and responses for threats and sensitive data, which Provingx deliberately does not do. Authorization systems (Permit.io, Auth0, Arcade) govern identities, resources and tool execution. Governance platforms (Arthur, Credal) report on AI programmes. Provingx is the model-boundary control plane: identity and passport authorization, spend and fleet controls, and an Ed25519-signed decision receipt for every governed call. It sits alongside content scanning rather than pretending to replace it.

This market consolidated in 2025–26: Portkey is now part of Palo Alto Networks, Pangea of CrowdStrike, Lakera of Check Point, Aporia of Coralogix. Where that happened, the row says so — it usually changes who you buy from and what the roadmap answers to.

Won't the model and cloud providers just build this in?

Some of it, yes — usage logs, guardrail toggles and audit dashboards are already native to every major provider's own console, and that will keep expanding. What a provider cannot credibly ship is a decision that a third party can verify without trusting the provider that made it— a log is only evidence if whoever is being checked did not also build the checker. Provingx's receipts are signed independently of any model or cloud provider, and the transparency log they land in is built to be re-verified in the reader's own browser, against a head they pinned themselves, not against a claim rendered by our dashboard or theirs. That is a structural property, not a feature a platform update catches up on: a referee cannot also be a player, and every provider whose traffic passes through here is, first, a player.

7 rows where every name on this page draws a blank

Most rows below are Provingx against a real tick or a real dash — a competitor doing the job differently, or partway. These 7 are not that. Across every gateway, guardrail, authorization tool and governance platform named here, not one offers even an adjacent version — no partial credit to give anyone.

A changed MCP tool definition is refused, not silently trusted

A tool's name, description and schema are fingerprinted the first time it's approved. If the server later swaps what that tool actually does — a supply-chain 'rug pull' — the call is held until a human re-approves the new definition, instead of new behavior running under an old name's trust.

See it →

A tool call must trace back to a real model decision

A hand-crafted tool call that never came from the LLM's own output — replayed, injected, or forged upstream of the gateway — has no matching decision to point to, and is refused on that basis alone, independent of whether the tool itself is on the allow-list.

See it →

Signed proof carried on the response itself

A compact signed token on the response, so the code holding the answer can check the decision in its own process against a published key. Without it, a run id is a pointer: you make a second call to the vendor and then take their word for the reply. Opt-in per call, and it costs about 0.1ms.

See it →

Hash-linked multi-agent chain of custody

Each hop's input hash must equal the previous hop's output hash, so a missing or edited step in an agent-to-agent chain is provable — not merely a trace drawn next to it. Tool results are inside the chain, not beside it: an MCP tool's output is hashed into its own signed receipt, and the LLM call that consumes it names that hash, so 'the model was fed something other than what the tool returned' is a claim the evidence can refuse.

See it →

Public verification page and trust badge

An outsider with no login can check a receipt and an embeddable badge signed by the same key.

See it →

Public red-team sandbox running production code

Anyone can try to break the live enforcement and signature paths without signing up.

See it →

Secret enforcement without holding the secret

Your credentials are enforced as salted fingerprints. We can block a leak of a secret we were never given and could not reconstruct.

See it →

The field

Vendor	Category	Entry price	Deployment	Rows met in full
Provingx	Pre-execution authorization	Free → from $19/mo (Starter)	Proxy — zero code change	31 of 34
Portkey now Palo Alto Networks	AI gateway	Free (10K logs) → $49/mo	Proxy	9 of 34
Kong AI Gateway	API/AI gateway	Free (OSS core) → Konnect contract	Proxy (self-hosted or Konnect)	8 of 34
Cloudflare AI Gateway	AI gateway	Free (bundled with Workers)	Proxy (edge, managed only)	7 of 34
LiteLLM	AI gateway (OSS)	Free (OSS) → Enterprise from ~$250/mo	Proxy (self-hosted)	8 of 34
TrueFoundry	AI gateway	Free (50K req) → $499/mo (Pro)	Proxy (K8s, VPC or SaaS)	9 of 34
Helicone	Observability + gateway	Free (10K req/mo) → $79/mo (Pro)	Proxy or SDK	5 of 34
Pangea AI Guard now CrowdStrike	AI content security	Free account; service pricing not public	API / SDK / gateway plugin	4 of 34
Lakera Guard now Check Point	Guardrails	Free (10K req/mo) → Enterprise custom	API call you integrate	2 of 34
Aporia now Coralogix	Guardrails	Free tier → Coralogix units ($1.50/unit)	API call you integrate	3 of 34
Permit.io	Fine-grained authorization	Free → from $5/mo (Startup)	PDP / MCP gateway	3 of 34
Auth0 for AI Agents now Okta	Identity & agent access	Free (25K MAU) → $35/mo + 50% AI add-on	OAuth / API / SDK	3 of 34
Arcade.dev	Agent tool runtime	Free → $25/mo + usage (Growth)	MCP runtime / hosted tools	3 of 34
Arthur AI	Enterprise AI governance	Free → $60/mo (Premium)	SDK / OTEL discovery / API	4 of 34
Credal	Enterprise AI governance	Custom only (no public pricing)	Platform integration	1 of 34

“Rows met in full” counts only the 34 rows below, which are the ones Provingx was built around — a guardrails vendor scoring low here is doing a different job well, not doing this job badly. 3 of those rows are ones we do not meet.

Capability by capability— 34 rows, every vendor scored on each

Capability	Provingx	Portkey Palo Alto Networks	Kong AI Gateway	Cloudflare AI Gateway	LiteLLM	TrueFoundry	Helicone	Pangea AI Guard CrowdStrike	Lakera Guard Check Point	Aporia Coralogix	Permit.io	Auth0 for AI Agents Okta	Arcade.dev	Arthur AI	Credal
How it sits in your stackBefore any feature row: where the thing runs, and whether you can buy it without a sales call.
Drop-in proxy, no application code change Change the base URL and existing SDK calls are governed. No wrapper library, no per-call instrumentation. See it →
Public price, self-serve signup A published number you can read and a card you can enter, without a demo call first. See it →
Built-in sandbox, on the same account A test key that writes to a separate partition — its own agents, receipts and monthly quota — so a load test cannot spend, halt or pollute production. Partial means you can approximate it by standing up a second workspace or project and keeping the two apart yourself. See it →
Model routing, caching and failover Load-balancing across providers, semantic caching, automatic fallback to a cheaper or healthier model.
Deciding before the model runsEverything here happens in the request path, before a token is spent — not in a dashboard afterwards.
Signed, versioned policy per agent One passport per agent naming its allowed models, providers, budget and regions, versioned so you can prove what the rule was on the day of an incident. See it →
Tool-call authorization before execution The specific tool an agent asked to call is checked against policy and can be refused before it runs — an LLM's own declared tool calls, and (via a small local gateway process) MCP server tool calls too. A request offering several tools need not be all-or-nothing: the disallowed ones can be stripped before the provider sees them, so the call proceeds without the capability rather than failing outright. See it →
A changed MCP tool definition is refused, not silently trusted Only Provingx A tool's name, description and schema are fingerprinted the first time it's approved. If the server later swaps what that tool actually does — a supply-chain 'rug pull' — the call is held until a human re-approves the new definition, instead of new behavior running under an old name's trust. See it →
A tool call must trace back to a real model decision Only Provingx A hand-crafted tool call that never came from the LLM's own output — replayed, injected, or forged upstream of the gateway — has no matching decision to point to, and is refused on that basis alone, independent of whether the tool itself is on the allow-list. See it →
MCP tools are ceilinged by consequence, not just by name A read-only lookup, an additive write, an egress action and a destructive one can all be individually 'allowed' and still sit under different ceilings, so widening a budget or allow-list for one doesn't quietly widen it for the irreversible one too. See it →
Spend cap enforced before the provider call A budget that blocks the request itself, rather than an alert that arrives with the invoice. See it →
Region/residency enforced per agent This agent may only reach EU endpoints — enforced per call, not just chosen once at deployment time. See it →
Halt an org, a team, or one accountable user Three granularities of stop. Freezing one person's agents without hunting down every key they touched. See it →
Human approval gate for elevated access A sensitive or widened permission waits on a named human, and expires on its own afterwards. See it →
Agent-to-agent delegation, scoped and budgeted Agent A hands agent B a narrower grant with its own ceiling and expiry, and the grant is itself governed. See it →
Prompt-injection and content classification Reading the prompt or the response to judge whether it is an attack, a jailbreak, or unsafe content.
Evidence someone else can checkThe difference between a log you are asked to believe and a receipt an auditor can verify without us.
Ed25519-signed decision receipt per call Every governed call — allowed or refused — produces a signed record of the decision, the rule, and the accountable identity. See it →
Append-only log with inclusion proofs A Merkle-structured log where a single altered or removed entry breaks the proof. See it →
Consistency proof between two log heads Inclusion proves an entry is in TODAY'S tree; it cannot see a log rebuilt overnight and re-published, which passes every inclusion check. A consistency proof shows the tree you recorded earlier is still a prefix of the current one. Provingx pins a head in your own browser and serves the proof against it, ships the check in both verifier packages, and publishes a monitor cron that exits non-zero only on a genuine contradiction. See it →
Signed proof carried on the response itself Only Provingx A compact signed token on the response, so the code holding the answer can check the decision in its own process against a published key. Without it, a run id is a pointer: you make a second call to the vendor and then take their word for the reply. Opt-in per call, and it costs about 0.1ms. See it →
Anchored to an external public chain Periodic roots published outside the vendor's own infrastructure, so backdating requires rewriting something we do not control. See it →
Verifiable offline, without the vendor An export that carries the public keys and a verifier that runs with us switched off — including after a key rotation. Published as installable packages rather than a snippet to copy: provingx-verify on PyPI and @provingx/verify on npm, both of which check receipts, credentials and the log's own proofs without importing anything of ours. See it →
Hash-linked multi-agent chain of custody Only Provingx Each hop's input hash must equal the previous hop's output hash, so a missing or edited step in an agent-to-agent chain is provable — not merely a trace drawn next to it. Tool results are inside the chain, not beside it: an MCP tool's output is hashed into its own signed receipt, and the LLM call that consumes it names that hash, so 'the model was fed something other than what the tool returned' is a claim the evidence can refuse. See it →
Public verification page and trust badge Only Provingx An outsider with no login can check a receipt and an embeddable badge signed by the same key. See it →
Auditor access without an account A scoped, expiring, revocable link an external auditor or regulator opens directly — no shared login, no screenshots. See it →
Compliance attestation generated from the log EU AI Act, SOC 2 and HIPAA statements built from the signed record and signed themselves, not a PDF written once by hand. See it →
AI Bill of Materials A signed inventory of every model and provider actually called, with real counts and first/last-seen — derived from traffic, not self-reported. See it →
Public red-team sandbox running production code Only Provingx Anyone can try to break the live enforcement and signature paths without signing up. See it →
Living with it day to dayThe parts you touch after the first week: telemetry, secrets, spend, and drift.
OpenTelemetry export to your own stack Spans in your Datadog, Grafana or Honeycomb — with the governance decision attached, not just latency and tokens. See it →
PII and secret redaction in the request path Sensitive strings removed or masked before the prompt reaches the provider. Provingx redacts the secrets you REGISTER, matched exactly by fingerprint — it deliberately does not pattern-guess at PII, which is why this row is a partial and not a tick. See it →
Secret enforcement without holding the secret Only Provingx Your credentials are enforced as salted fingerprints. We can block a leak of a secret we were never given and could not reconstruct. See it →
Wasted spend accounted for, not just total spend Money burned on refused, retried and discarded calls, priced and attributed per agent and team. See it →
Per-agent behavioural drift detection An agent measured against its own established baseline, with the verdict carried on the signed receipt. See it →
Provider keys held encrypted, never in the client Upstream credentials stay server-side and are injected at call time, so an agent never carries a provider key. See it →
Own overhead reported on every response A header separating the provider's latency from what governance cost, so the tax is measurable rather than asserted. See it →

ships it as described adjacent capability, not equivalent not part of the product

A dash is a real capability doing a nearby job: Pangea's Secure Audit Log genuinely publishes verification artifacts, but that is not a pre-execution authorization receipt; revoking a virtual key genuinely stops traffic, but it is not a per-user halt across a fleet. Click any vendor name to check the current product yourself.

By category

AI gateways

Portkey (Palo Alto Networks) · Kong AI Gateway · Cloudflare AI Gateway · LiteLLM · TrueFoundry · Helicone

Built to route, cache and log traffic across providers, and genuinely good at it — several now enforce hard budgets and gate MCP tools too, which is why those rows are ticks. What none of them produce is a signed, independently verifiable decision for each call, or a per-agent policy you can prove was in force on a given date.

Guardrails & runtime security

Lakera Guard (Check Point) · Aporia (Coralogix)

Classify whether a prompt or response looks unsafe — prompt injection, PII, content policy. Provingx scores a cross on that row on purpose: it decides whether an identified call is allowed to happen, and leaves reading the content to tools built for it.

Content security & tamper-evident logging

Pangea AI Guard (CrowdStrike)

The closest thing to our evidence story, and the only vendor here that shares the consistency-proof row with us: its Secure Audit Log is a real Merkle log with membership and consistency proofs and a published root. The difference is what gets logged — an inspection verdict on content, rather than an authorization decision about an identified agent's call, its passport, budget and fleet state.

Agent identity & tool authorization

Permit.io · Auth0 for AI Agents (Okta) · Arcade.dev

Strong adjacent products for resource permissions, OAuth identity, MCP access, token vaults and human consent — they earn ticks on tool authorization and approval gates. They govern what an agent may touch; Provingx governs the model call itself, with spend, region and fleet controls and a receipt on each decision.

Enterprise AI governance

Arthur AI · Credal

Discovery, dashboards, evals and permission mirroring for enterprise AI programmes — real value for compliance reporting. They integrate via SDK, OTEL and platform hooks rather than sitting in front of every model call, and neither publishes a signed receipt an outsider can verify.

When not to buy Provingx

If what you need is failover between providers, semantic caching and a cheaper routing bill, buy a gateway — we do not do those and are not planning to. If what you need is prompt-injection defence and content classification, buy a guardrails product; several of them run as a plugin in front of, or behind, a proxy like ours. Provingx is worth paying for when someone will eventually ask who authorized this call, under which rule, and can you prove it — and a screenshot of a dashboard is not going to be an acceptable answer.

See the difference on your own traffic.

No sales call required — start free, point your existing client at Provingx, and watch the first decision get signed.

Start free See Provingx pricing