bitoai/bito-gateway repository overview

⁠Bito Gateway

A context-driven model router. It sits between your applications or coding harnesses and the model providers, and does two things a proxy doesn't: it puts the context your models are missing into the request, and it routes each call to the right model and credential for that workspace across providers. Multi-tenant, provider-agnostic, and metered per workspace.

Deploying to Kubernetes? Use the Helm chart at bitoai/bito-gateway-helm⁠ — it brings up the gateway, its database and its counter store in one command.

⁠What it does

• AI Architect. Give any model deep knowledge of your codebase: architecture, dependencies, API contracts, conventions and business rules across every repository without changing a line of client code. Turn it on per workspace, and scope it to specific model aliases so one team gets it and another doesn't.
• Automatic cost optimization. The gateway sits in the request path, so it can cut spend on every call without the caller doing anything or the answer changing. Optional, per workspace, and always visible in the usage records — you see exactly what was saved and what was spent. More optimizations are added over time and existing clients pick them up by configuration alone.
• One endpoint, many providers. Anthropic, OpenAI, Azure OpenAI, Gemini and Vertex AI, etc. behind a single URL, selected per request by model alias.
• Dialect translation. Call Anthropic Messages, OpenAI Chat Completions or OpenAI Responses and reach any provider — the gateway converts in both directions and answers in the dialect you called with.
• Per-workspace control. Rate, token and concurrency limits, monthly budgets, and usage and cost recorded per request.
• Load balancing and failover. An alias can fan out to a weighted target group, with per-target cooldown so a failing upstream is taken out of rotation.
• Credentials stay encrypted. Provider keys are held envelope-encrypted; the gateway never stores them in plaintext.
• Stateless. No session or transcript store — scale it horizontally behind a shared counter store.

⁠Run it

The gateway needs a MySQL database and one encryption key.

docker run -d --name bito-gateway -p 87
  -e DB_HOST=mysql.example.internal \
  -e DB_PORT=3306 \
  -e DB_NAME=bito_gateway \
  -e DB_USER=bitogw \
  -e DB_PASSWORD='<your-db-password>' \
  -e CRYPTO_ENV_KEK_KEY="$(openssl rand
  bitoai/bito-gateway

Then point a client at it with a gatewa

curl http://localhost:8788/v1/messages \
  -H "Authorization: Bearer gw_sk_..."
  -H "content-type: application/json" \
  -d '{"model":"claude-haiku-4-5","max_
       "messages":[{"role":"user","content":"Hello"}]}'

⁠Endpoints

⁠The gwctl CLI

The image also ships gwctl for setup and administration — creating workspaces and gateway keys, adding provider accounts chema, and inspecting usage:

docker run --rm -e DB_HOST=... -e DB_PAeway \
  gwctl connect claude

gwctl connect <harness> prints the ex — Claude Code, Cursor, Cline, Continue, Aider, Codex, Copilot, Windsurf, Zed, or a generic OpenAI/Anthropic client.

⁠Image details

• Base: Alpine. Static binary, no C
• Runs as non-root (UID 1000), declared numerically so it satisfies runAsNonRoot: true under Pod Securiwith no extra config.
• Port: 8788. Healthcheck: built in, against /healthz.
• Platform: linux/amd64.
• Configuration is environment variables, or a mounted JSON config file via GW_CONFIG. The image sets `GW_MANAGcontainer fails closed rather than starting with a freshly generated encryption key.

⁠Tags

X.Y.Z are releases; latest tracks the newest. Tags ending -SNAPSHOT are branch builds and are not intended for product