One endpoint. Every model. Every euro accounted for.
A gateway that sits in the request path, so spend is governed before it happens rather than reported after it did.
One endpoint, every backend
Self-hosted models, cloud APIs and paid provider subscriptions behind a single OpenAI-compatible URL. Point an existing SDK at a new base URL and nothing else in your code changes. Streaming and non-streaming both pass through, and an MCP server exposes the same routing, budgets and privacy rules to agent frameworks.
OpenAI-compatible describes the shape of the API, not a relationship with OpenAI. Your traffic goes wherever your rules send it.
Routing you can read
- Rule-based classification
- Requests are sorted into categories you define, by weighted signals: keywords, patterns, metadata, token count, tool use. A request can also name its own category in a header.
- Deterministic routing
- Ordered rules map a category to candidate models, with failover, circuit breaking and context-window fit. Nothing is learned in the path, so a security review gets a decision tree rather than a model.
- Health-aware selection
- Least-loaded and round-robin strategies across healthy candidates, with automatic failover when a provider degrades.
- Learned routingNot yet available
- A model that predicts a request's category more cheaply than rules. Present but dormant and shadow-only.
- Quality-gated routing changesNot yet available
- Regression detection on a routing change, with an automatic rollback trigger.
- Batch endpoint routingNot yet available
- Latency-tolerant categories sent to providers' batch endpoints.
Spend governed before it happens
- In-path budgets
- Caps on a team, category, provider, user or node, enforced while the request runs. When a cap is hit the router rejects the call, downgrades it to a cheaper model, or lets it through with a warning. A budget checked in a monthly report cannot stop spend; this one can.
- Paid-confirm gate
- A route that lands on a priced model spends nothing until the caller explicitly confirms the paid call.
- True cost per request
- Cost modelled across four bases and recorded per call: metered API price, amortized self-hosted hardware including energy and carbon, imputed subscription share, and unpriced.
- Make-vs-buy
- Per-category comparison of running a model on your own hardware against paying a provider, from your own cost data rather than a vendor's.
- Chargeback and invoicing
- Rate cards, invoices with margin, and an industry-format FOCUS-aligned CSV export. Not certified.
- Forecasting and insights
- Spend forecasts with explanations, provider-shift analysis and optional narrated insights.
- Cost per successful taskNot yet available
- Spend divided by tasks that met a defined outcome, reported next to cost per request.
Governance and security
- Privacy routing
- Mark a request private and it is pinned to models on your own hardware. It never reaches an outside provider.
- Role-based access control
- A six-rank role model over the admin surface, with capability-scoped API keys. A dashboard session cannot call inference.
- Encrypted provider credentials
- Provider and subscription secrets encrypted at rest under a master key.
- Audit trail
- Every request recorded with its routing decision and the enforcement action taken. Full request logging is available and off by default.
- Egress protection
- Outbound webhooks pass an SSRF guard.
- Single sign-on
- Optional OIDC single sign-on for the dashboard.
- Multi-tenant isolationNot yet available
- Strong per-organization isolation. The router runs single-organization today.
Operations
- Versioned configuration
- Publish, simulate and roll back configuration with a live reload. No code deploy to change a routing rule.
- Alerting
- Anomaly alerts to email, Slack, PagerDuty or a webhook.
- Dashboard
- An admin interface across cost, budgets, categories, routing, nodes, providers, subscriptions, users, logs, audit, alerts, chargeback and insights.
- Backup and recovery
- Encrypted scheduled backups with a tested restore path.
- High availability
- The data plane runs as a multi-worker pool behind a health-checked load balancer with automatic datastore failover, exercised in a live drill. Across hosts, the full host-loss exercise is still pending and the restore path remains the backstop.
What it does not do yet
The ledger's cost figures have not been checked against a real provider invoice for a full billing period. That check is planned, and until it is done we publish no savings figure at all. Your number comes from your own traffic during the audit, measured against a baseline frozen before anything changed.
One endpoint. Every model. Every euro accounted for.
Start with a one-department auditOne department, one month, no fee.