> ## Documentation Index
> Fetch the complete documentation index at: https://neuraltrust-92b43583-develop.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.
# Overview
> Route, govern, and observe LLM and agent traffic with TrustGate, NeuralTrust's open-source AI gateway.
**TrustGate** ([open source](https://github.com/NeuralTrust/TrustGate),
Apache-2.0) is an **AI gateway** and reverse proxy for LLM and agent traffic.
Point an OpenAI, Anthropic, or Responses API client at it by changing the
client's base URL and consumer credentials. TrustGate normalizes, routes,
load-balances, applies policies to, and records each call.
Use the **NeuralTrust console** to configure TrustGate: connect providers,
define consumers and routing, attach policies, and copy connection snippets.
These operations are also available through the control-plane API.
## AI gateway capabilities
TrustGate provides the following capabilities:
* **Multi-provider access:** adapters for OpenAI, Anthropic, Azure OpenAI,
AWS Bedrock, Google Gemini, Vertex AI, Groq, Mistral, and DeepSeek (plus any
OpenAI-compatible endpoint), behind one OpenAI-compatible surface. Chat, Responses,
Messages, [embeddings](/trustgate/endpoints/embeddings), [images](/trustgate/endpoints/images),
[files](/trustgate/endpoints/files), and [rerank](/trustgate/endpoints/rerank) share the same
consumer. [Model discovery](/trustgate/endpoints/models) is `GET /{consumer}/v1/models`.
* **Smart routing and load balancing:** simple routing, fallback chains, round-robin,
weighted, least-connections, random, and **smart routing** by complexity label
(**Simple** / **Medium** / **Hard**).
* **Cost and abuse control:** request rate limiting, token and dollar **LLM Budget**, and
request-size guards.
* **Tool and prompt governance:** allow-list, validate, and reshape the tools an agent can
call; inject and version system prompts; restrict which models a consumer may reach.
* **Guardrails:** [TrustGuard](/trustguard/overview), OpenAI Moderation, Azure
Content Safety, and AWS Bedrock guardrail policies to inspect prompts and responses inline.
* **Multi-tenancy and authentication:** per-gateway consumers authenticated by API key, OAuth2, or
OIDC, with policies scoped globally or per consumer.
* **Observability:** per-request telemetry (model, tokens, cost, latency breakdown,
routing attempts, policy chain) exported with **OpenTelemetry** and used by
[detection alerts](/platform/alerts).
* **Agent tooling:** an [MCP Gateway](/trustgate/mcp/overview) exposes MCP servers
and tools to agents ([Claude Code](/integrations/claude-code), [Claude Enterprise](/integrations/claude-enterprise), [Cursor](/integrations/cursor),
[Codex](/integrations/codex), [GitHub Copilot](/integrations/github-copilot),
[Copilot Studio](/integrations/copilot-studio)) with OAuth2 support.
See the [integrations catalog](/integrations/overview) for supported tools and setup instructions.
## Core resources
Configure everything in the console under **TrustGate**. Six objects make up
a TrustGate gateway:
| Object | What it is |
| ---------------------------------------------- | ---------------------------------------------------------------------------------------------- |
| **[Gateway](/trustgate/concepts/gateways)** | The top-level tenant. Owns everything below. |
| **[Registry](/trustgate/concepts/registries)** | An upstream backend, such as an LLM provider endpoint or an MCP server. |
| **[Consumer](/trustgate/concepts/consumers)** | The calling application's identity. Owns routing and credentials. |
| **[Auth](/trustgate/concepts/auth)** | A credential (API key, OAuth2, OIDC) that authenticates as a consumer. |
| **[Policy](/trustgate/policies/overview)** | A governance rule for rate limiting, budgets, tool governance, guardrails, and other controls. |
| **[Role](/trustgate/concepts/roles)** | Routing config selected from OIDC token claims, for identity-based routing. |
## Request flow
```text theme={null}
client ──▶ /{consumer_slug}/v1/chat/completions
or /{consumer_slug}/v1/embeddings
or /{consumer_slug}/v1/images/generations
or /{consumer_slug}/v1/files
or /{consumer_slug}/v1/models
│ X-AG-API-Key
│ X-AG-Gateway-Slug (Private only)
├─ resolve gateway + consumer + policies
├─ apply policies (rate limit, budgets, guardrails, …)
├─ route across the consumer's registries (+ fallback)
├─ forward to the provider adapter (stream when supported)
└─ export telemetry → OpenTelemetry collector
```
A client does not specify a provider URL or key. It names a **model** or uses
`auto` when load balancing or smart routing is enabled. The AI gateway resolves
the registry, applies policies, and forwards the request. See
[Architecture](/trustgate/architecture) for the full lifecycle.
## Frequently asked questions
### Can I move an existing OpenAI or Anthropic client to TrustGate?
For most clients, moving to the AI gateway means updating the base URL and
replacing the provider credential with a TrustGate consumer credential.
TrustGate accepts OpenAI Chat Completions, Responses, Anthropic Messages, and
Google Gemini request formats, then adapts the request for the selected upstream
provider. Start with the connection snippet on the consumer's **Connect** tab.
### Should my application use an API key, OAuth2, or OIDC?
Use an API key for a static application identity. OAuth2 can validate service
tokens or broker an interactive login for MCP clients. OIDC validates JWTs and
can use token claims for identity-based LLM routing. See
[Authentication](/trustgate/concepts/auth) for the supported combinations.
### Can TrustGate run in my environment?
Yes. With Hybrid, you run the data plane in your environment while NeuralTrust
runs the control plane. With External, you run the full platform in your own
environment. NeuralTrust can also host both planes through SaaS. Compare the
options in [Deployment models](/neuraltrust/deployment/overview).
### Where do prompts and responses travel in a Hybrid deployment?
The client calls the TrustGate data plane in your environment, and TrustGate
forwards the request to the configured model provider. Raw prompts and
responses stay in your PostgreSQL; metadata is exported to NeuralTrust over
OTLP. See the [Hybrid architecture](/neuraltrust/deployment/hybrid#architecture)
for the complete data path.
### Does my application need the model provider's credentials?
No. Provider credentials remain in TrustGate. Applications authenticate as a
consumer, and TrustGate uses the registry credential when it calls the selected
provider. Keep consumer API keys secret and rotate them separately from
provider credentials.
## Where to go next
Create a gateway, connect a provider, and send your first request from the console.
Chat, embeddings, images, files, audio, rerank, and models routes.
Gateways, registries, consumers, auth, policies, roles.
Control-plane REST API for automation and self-hosted setups.