AI Defense Matrix Catalog

Agent Router

Visit official site

Overview

Product details compiled from public sources, each with a citation.

Vendor
Agentic AI Foundation1agent
Description
Open-source AI gateway built on Envoy that routes traffic to many LLM providers behind one OpenAI-compatible API, with token quotas, provider failover, and an MCP gateway.4agent
Deployment
Self-hosted2agent
Status
Active4agent
Formerly
Envoy AI Gateway, renamed 2026-09-10.5agent

Matrix Coverage

Where this product defends, by asset class and NIST CSF function. The Coverage column shows whether each asset is Primary, Secondary, or Adjacent to what the product does. The table omits empty rows and columns.

Asset class IdentifyProtect Coverage
AI Coding and Orchestration Tools Secondary 6
AI Traffic Primary 3

Framework Relevance

These frameworks include controls relevant to the asset classes Agent Router defends. This is an editorial inference from the AI Defense Matrix asset-level crossmap, not a statement that Agentic AI Foundation implements these controls or is certified against them.

Expand Collapse
Framework Asset class Relevant controls
NIST IR 8596 AI Coding and Orchestration Tools Agents as deployed artifacts (orchestration view; see AI Agent Identities row for the principal view); system prompts and templates
AI Traffic AI data flows; APIs; inference endpoints (traffic side); model registries and dataset sources
CSA AI Controls Matrix AI Coding and Orchestration Tools Application and Interface Security; Supply Chain Management
AI Traffic Infrastructure Security; Interoperability and Portability
ISO 42001 AI Coding and Orchestration Tools A.6 AI system life cycle; A.5 Assessing impacts of AI systems
AI Traffic A.8 Information for interested parties; A.9 Use of AI systems; A.10 Third-party and customer relationships
Google SAIF AI Coding and Orchestration Tools Secure the AI supply chain; application and pipeline security; agent orchestration controls
AI Traffic Harden and monitor infrastructure; network-level access and egress controls
SANS Critical AI Security Guidelines AI Coding and Orchestration Tools Secure Agentic Systems and AI Autonomy Controls (defined function scope; execution isolation; API and function-call gating); Limit Model Behavior (focused functionality; access controls outside the model)
AI Traffic Conventional Security Controls (authenticate and control access to inference APIs; API key management); Model I/O Handling (rate limiting; egress output filtering); Monitoring (interaction and API-usage logging)
MITRE ATLAS AI Coding and Orchestration Tools AML.T0051 LLM Prompt Injection; AML.T0054 LLM Jailbreak; AML.T0016 Obtain Capabilities (malicious plugins)
AI Traffic AML.T0057 LLM Data Leakage; AML.T0024 Exfiltration via AI Inference API (network-side observation)
OWASP AI Exchange AI Coding and Orchestration Tools Development-time threats: agent framework supply chain; runtime threats: plugin abuse, prompt injection via tools
AI Traffic Runtime threats: data leakage via AI egress; network-level access control gaps
OWASP LLM Top 10 AI Coding and Orchestration Tools LLM01 Prompt Injection; LLM05 Improper Output Handling; LLM07 System Prompt Leakage; LLM10 Unbounded Consumption
AI Traffic LLM10 Unbounded Consumption (cost and rate control); shadow AI egress and output handling
OWASP Agentic Security Top 10 AI Coding and Orchestration Tools ASI01 Agent Goal Hijack; ASI02 Tool Misuse and Exploitation; ASI05 Unexpected Code Execution (RCE); ASI07 Insecure Inter-Agent Communication; ASI08 Cascading Failures; ASI10 Rogue Agents
AI Traffic ASI07 Insecure Inter-Agent Communication; ASI02 Tool Misuse and Exploitation (egress and tool-invocation scope); ASI04 Agentic Supply Chain Vulnerabilities (MCP and tool-registry trust)

Provenance

Last sourced 2026-07-05.

Expand Collapse

Sources

  1. Agent Router Joins AAIF
    Vendor source accessed 2026-09-22
    • “Envoy AI Gateway is now Agent Router and is joining the Agentic AI Foundation.”
  2. Envoy AI Gateway capabilities
    Vendor source accessed 2026-07-05
    • “Configure multiple controller replicas and horizontal pod autoscaling for production deployments”
  3. theagentrouter/agent-router
    Vendor source accessed 2026-09-22
    • “Manages Unified Access to Generative AI Services built on Envoy Gateway”
  4. Envoy AI Gateway reaches 1.0
    Vendor source accessed 2026-07-05
    • “the first stable, production-ready release of the open source AI gateway built on CNCF's Envoy Gateway”
    • “Today, Envoy AI Gateway 1.0 is generally available”
  5. Envoy AI Gateway is becoming Agent Router, an Agentic AI Foundation project
    Vendor source accessed 2026-09-22
    • “On 10 September, Agent Router, previously Envoy AI Gateway, officially joins the Agentic AI Foundation.”
  6. Agent Router capabilities
    Vendor source accessed 2026-09-22
    • “Server multiplexing, tool routing, OAuth authentication, and observability for MCP workloads”

Changelog

  1. Renamed from Envoy AI Gateway to Agent Router, which joined the Agentic AI Foundation on 2026-09-10; updated the vendor and sources.

  2. Added to the catalog from the Envoy AI Gateway documentation and release notes.

Found an error? Corrections are welcome. Suggest an edit.