The self-hosted control planefor AI agents.
One endpoint in front of every model, tool and agent your organization runs. Build agents wherever you like; they reach everything through Wäg. Identity, budgets, tool policy, approvals and audit are enforced before a token is spent — and all of it runs in your own infrastructure.
Meet Orbit. Powered by Wäg.
We build the infrastructure for the next generation of AI agents. Orbit is what happens when we build one ourselves: Ori, a persistent AI co-worker with its own isolated computer. Self-hosted, with or without Wäg.
Applications ask for intelligence. Your platform decides the rest.
Every month brings a new model; every quarter a new provider. Your applications shouldn't carry that complexity — they send one request, and Wäg makes every infrastructure decision once, for all of them.
Those are infrastructure decisions, and they are currently duplicated across every service, notebook and agent in your organization — inconsistently, and usually undocumented. Made once at the control plane, every application is governed. Including the ones nobody told you about.
Four things your organization gets, whatever it builds next
Budgets that stop spend, not dashboards that report it. Limits stack from organization to team, user, application, model and key. A breach rejects the request before the provider is called, and every request is priced and attributed as it happens.
Every decision is made before a token is spent
One pipeline for every request. A request that fails a check stops there — before the provider is contacted, and before anyone is charged.
The full request path, stage by stageAn agent tried to refund €1,200. Wäg paused the call until a manager approved it.
- 01Authenticate✗ 401
- 02Model access✗ 403
- 03Budget✗ 429 — no provider spend
- 04Policy (pre-call)✗ BLOCK · ◑ MASK · ◐ REDACT
- 05Cache✓ HIT — return, no provider call
- 06Route
- 07Invoke
- 08Policy (post-call)✗ 403 · removed
- 09Account
Every request, every rule, in one console
The same console your platform team runs: traffic, spend, provider health and every routing decision, on your own infrastructure.
- CTOOne decision point for every AI workload, without putting a vendor in front of production.The control plane
- Head of PlatformOperate it like the rest of your infrastructure: a Kubernetes operator with GitOps resources, stateless replicas, OTEL and Prometheus.The architecture
- Head of AIUse any model and build agents anywhere. Budgets, policy and approvals are already in the path.Agent governance
European by design — not by data-center region
Most AI gateways put a vendor's control plane above your data. Wäg has no control plane of its own: both planes run in your infrastructure, so there is no data path anyone could compel — in any jurisdiction, including ours.
Speaks the API you already use
Point any OpenAI-compatible client at Wäg and every request runs through the pipeline. Already running LiteLLM? Import its configuration with one command.
# Point any OpenAI-compatible client at Wäg
export OPENAI_BASE_URL=https://waeg.internal/v1
export OPENAI_API_KEY=sk-waeg-your-virtual-key$ waeg import litellm --from ./config.yaml -o waeg.yamlWäg OSS is the product
The gateway's production path is Apache-2.0. Enterprise adds what large organizations need around it: corporate identity, audit and evidence, agent payments, device enforcement and support.
Open Source
Apache-2.0 · free foreverEverything you need to run it in production.
- Multi-provider routing, failover, retries, circuit breakers
- Multi-node HA with shared budgets & rate limits
- Six strategies: weighted, latency, cost, round-robin, intelligent, model-driven
- Four-tier semantic cache with safety gates
- Virtual keys, token/$ budgets, RPM limits
- Guardrail chain + pluggable engines
- MCP gateway, tool ACLs, jobs & realtime data plane
- Secrets connectors, OpenFGA multi-tenancy, Admin UI
- OTEL / Prometheus observability · air-gap · no phone-home
- Agent identity, run limits, tool policies, approvals, A2A and egress
- Data residency and the hash-chained evidence ledger
- Wäg Edge device sign-in and reporting for local models
Enterprise
Commercial add-onFor corporate identity, audit, agent commerce and device enforcement.
- Console SSO (OIDC), SCIM 2.0 and corporate IdP tokens on /v1
- MCP user OAuth (authorization code + PKCE) and token exchange
- Audit and evidence packs, auditor role, exit export, long retention
- Platform budgets and guardrails on pass-through traffic
- Agent payments, Slack and Teams approvals, agent registry import
- Egress TLS inspection and AI content marking
- Wäg Edge enforcement on devices and the fleet view
- CMEK / FIPS posture and custom branding
- 24/7 SLA & marketplace packaging
Enterprise modules are licence-gated and the gate is always on — evaluation keys are free, issued the same day, with no order form.
The next generation of software won't be built on AI providers. It'll be built on a control plane.
- Runs in your infrastructure
- No phone-home · air-gap ready
- Apache-2.0 core
Bitkaio Ltd is a member of NVIDIA Inception, NVIDIA’s program for AI startups.
© 2026 NVIDIA, the NVIDIA logo, and NVIDIA Inception are trademarks and/or registered trademarks of NVIDIA Corporation in the U.S. and other countries.