Snowflake Cortex AI Gateway governs agent actions across MCP servers, not LLM API traffic. Compare it to LiteLLM, Portkey, and Kong to decide which architecture fits your stack.
Snowflake announced Cortex AI Gateway on July 28, 2026, at Black Hat. The name sounds like it belongs in the same category as LiteLLM, Portkey, or Kong. It does not. Those tools route LLM API requests. Cortex AI Gateway governs what agents can do across enterprise systems, data, and MCP tool surfaces. Same word, different problem.
Understanding which problem you actually have determines which tool you need.
Cortex AI Gateway is an agent-interoperability and MCP governance layer, not an LLM proxy. It enables enterprises to securely control, orchestrate, and govern both first-party AI agents built within Snowflake and third-party AI agents developed on external platforms such as Claude Code and Cursor.
The product builds on Snowflake's acquisition of Natoma in May 2026. Natoma is a centralized MCP gateway that enforces identity, policy and audit at the tool-call level. The acquisition extends Snowflake's governance perimeter from data assets to AI actions and interactions across the enterprise.
This is a meaningful distinction. A traditional AI gateway sits between your application code and LLM providers. Cortex AI Gateway sits between your agents and everything they can touch: models, data, MCP servers, enterprise tools.
Two data points frame the urgency. AI security concerns surged from 17% in 2024 to 48% in 2026 according to The Linux Foundation's 2026 State of Tech Talent Report. Meanwhile, 96% of organizations still face significant challenges scaling AI across the enterprise.
The root cause is structural. Teams across an organization adopt MCP servers independently: sales connects a CRM tool, engineering wires up a code execution server, finance hooks an ERP connector. That decentralized adoption creates unmanaged sprawl, fractured user experiences and severe security liabilities, leaving organizations vulnerable to unvetted servers, tool hijacking, and data exfiltration.
Rate limiting an LLM API call does not help when the risk is an agent executing unauthorized actions against a production database through an unvetted MCP server.
With support for more than 100 MCP servers, Cortex AI Gateway centralizes agent access policies, authentication, and permissions. It governs agent traffic from Amazon Bedrock, Azure AI Foundry, ChatGPT, Claude Code, Cursor, and custom LangChain or LlamaIndex apps. Agents run inside Snowflake's security perimeter, automatically enforcing role-based access, masking and audit controls.
The platform provides an end-to-end audit trail of agent actions. The AI Governance Gateway allows customers to implement governance policies, including robust access control, granular usage tracking and budget enforcement.
Intelligent model routing automatically routes agent requests based on cost, latency, capability and data residency requirements. Teams can manage and apply budget guardrails and route to cheaper models for simpler tasks, with attribution by team, agent, or workload.
A vendor-neutral AI gateway provides five primary functions: routing requests across providers, caching responses, rate limiting and cost budgets, observability of every LLM call, and security controls. These tools solve a different problem than Cortex AI Gateway. They manage LLM API traffic. They do not govern agent-level actions across MCP tool surfaces.
LiteLLM is the dominant open-source AI gateway in 2026, supporting 100+ providers with a self-hosted deployment. Teams that need data residency and infrastructure control default here.
Portkey is the most feature-complete commercial AI gateway in 2026, routing across 200+ LLM providers in a managed cloud offering. The managed cloud vs self-hosted decision is the primary differentiator between Portkey and LiteLLM: teams that prefer managed services pick Portkey, teams that prefer self-hosting pick LiteLLM.
Kong AI Gatewayextends Kong's established API gateway platform into AI traffic and is best suited for enterprises already running Kong for API management. Kong has the most mature security plugin set including prompt injection scanning, output filtering, and PII detection.
Vendor-neutral gateways like SHIM also operate in this space, giving teams multi-provider LLM routing without coupling to a specific data platform.
| Capability | Cortex AI Gateway | LiteLLM | Portkey | Kong |
|---|---|---|---|---|
| Primary function | Agent + MCP governance | LLM API routing | LLM API routing | API + LLM routing |
| MCP server governance | 100+ servers, centralized policy | No | No | No |
| LLM provider support | GPT, Gemini, Claude, Grok, Mistral, GLM | 100+ providers | 200+ providers | Multiple via plugins |
| Deployment | Inside Snowflake perimeter | Self-hosted (open source) | Managed cloud | Self-hosted |
| Agent action audit trail | Yes (tool-call level) | No | No | No |
| Data residency routing | By region within Snowflake | Via self-hosting | Via cloud regions | Via deployment |
| Identity governance integrations | Okta, SailPoint, Saviynt, 1Password, Aembit, Linx | No | No | Via plugins |
The structural difference shows up clearly in that table. Vendor-neutral gateways manage which model gets called and how much it costs. Cortex AI Gateway manages what agents are permitted to do once they have access.
As Snowflake's Chief Security and Trust Officer Mayank Upadhyay stated: "The future of the agentic enterprise will not be built in closed agent ecosystems."
Cortex AI Gateway launched with secure third-party agent access integrations with Aembit, 1Password, Linx Security, Okta, SailPoint, and Saviynt. These are not generic API connectors. They govern how third-party agents authenticate and what they can access within the Snowflake perimeter.
The credibility behind these integrations comes partly from Natoma's track record. Natoma's platform was already deployed at some of the world's largest enterprises before the acquisition, delivering scale, visibility, and policy enforcement for agentic systems in production.
Every major Cortex AI Gateway capability announced at Black Hat is currently in private preview:
This matters for procurement. Teams evaluating the Snowflake AI gateway today are evaluating roadmap, not generally available capability. The vendor-neutral alternatives in this comparison (LiteLLM, Portkey, Kong) are shipping production features now.
The choice between Cortex AI Gateway and a vendor-neutral alternative is an architecture decision, not a feature comparison.
Choose Cortex AI Gateway if: your data already lives in Snowflake, your agents need governed access to MCP servers and enterprise tools, and you need identity-level audit trails for agent actions. The Snowflake security perimeter becomes your agent governance boundary.
Choose a vendor-neutral gateway if: you need multi-provider LLM routing across any infrastructure stack, you run workloads outside Snowflake, or you need production-ready capabilities today rather than private preview access. Tools like LiteLLM (self-hosted), Portkey (managed), and SHIM (provider-agnostic) give you LLM governance without coupling to a specific data platform.
For a deeper breakdown of how gateways, firewalls, and control platforms differ architecturally, see our comparison of AI firewalls vs AI gateways vs control platforms. If you are evaluating Databricks as an alternative data platform with its own gateway, we covered the Databricks AI Gateway in detail.