Guide

Calculators, Gateways and Routers: What an MSP Actually Needs, and When

Most clients do not need dynamic routing and are sold it anyway. This is the four-stage model, the break-even arithmetic, and where a decision layer sits relative to the gateway and router products your client may already run.

Gateway and router are routinely conflated, and they are different products. A gateway handles access, budgets, logging and failover. A router decides which model gets a request. A client can need the first forever and never need the second.
A fixed model policy captures most of the practical value. Assigning a model per workload is explainable, auditable and needs no per-request evaluation.
The decision comes before the routing. Deciding which models are permitted, which fit the workload and what they cost is a different job from moving the traffic, and it is the one nobody sells.

"A vendor is pitching me an AI gateway with intelligent routing. Which of my clients actually needs that, and what do I tell the rest?"

Dan Whitfield, vCIO at a 40-client MSP

How to think about it

Stage 1, Direct. One provider, one model, called from the application. Fine for a pilot. No budget control, no failover, no spend attribution, and nothing to show an auditor.
Stage 2, Gateway. Unified keys, budgets, logging, rate limits and failover, with NO intelligent routing. This is a governance decision, not an economic one. Any client holding an attestation needs it regardless of spend, because without an enforced allowlist the reachable endpoint set is whatever the SDK can call.
Stage 3, Policy routing. Models assigned by workload, department or risk class. Fixed, not evaluated per request. Most mid-market clients belong here, and most of the saving lives here.
Stage 4, Dynamic routing. Every request evaluated and routed on complexity, cost, latency or predicted quality. It needs three things at once: the volume to justify it, genuinely mixed prompt difficulty, and real production evaluation data. Missing any one and it does not pay.
Most businesses belong at Stage 2 or 3. Selling Stage 4 to a Stage 2 client is the fastest way to lose an account when the promised savings do not appear.

What each layer is

Where each layer sits, and who sells it

Decision layer. Which models are permitted for this client and workload, which fit, and what they cost. Vendor-neutral. This is the gap: gateways give you an allowlist you type by hand, and none of them tells you what belongs in it.
Gateway. Access, authentication, virtual keys, budgets, logging, rate limits, failover. LiteLLM, Portkey, Vercel, Cloudflare, Helicone.
Router. Decides which model receives a request. Can sit ON TOP of a gateway rather than replacing it, so its cost is additive. Not Diamond is the clearest example.
Guardrail layer. Runtime PII redaction, content filtering, semantic caching. Cloudflare includes DLP scanning free on all plans with two predefined profiles even without a Zero Trust subscription, and LiteLLM includes guardrails per key and per team: secret redaction, content moderation and banned keywords. Check what is actually included before buying a separate layer.

The chain, in order

1. Calculate. Size the workload in business units and get a token estimate. msp-workload-sizer.
2. Qualify. Which routes are lawful for this client's data class and attestation, and why the rest are not. Eligibility engine, jurisdiction-risk-scorer.
3. Choose. Permitted models priced at this client's actual load, permitted first, cheapest within. Model matrix.
4. Decide the layer. Direct, gateway, policy routing or dynamic routing, with the break-even. gateway-stage-advisor.
5. Deploy. Export the policy as configuration into whichever gateway the client already runs.
6. Verify. Did the policy deliver, has a price moved, has an endpoint become reachable that is not on the allowlist.

What each product actually buys

OpenRouter. Percentage on credits, no markup on inference. Unified access to a very large catalogue, fallbacks, auto-routing. The percentage IS the cost model, so it scales with spend.
LiteLLM. Free to self-host. Virtual keys, model-specific budgets per key, projects with isolated spend, guardrails per key and team, and per-team logging opt-out for GDPR. SSO is free to five users, then an enterprise licence. Your engineering time is the real cost.
Vercel AI Gateway. Zero markup on tokens, explicitly including bring-your-own-key. Free tier gives $5 a month of credit against a subset of models; the paid tier opens the full catalogue at provider list rates.
Cloudflare AI Gateway. Core features free on all plans: analytics, caching, rate limiting. DLP scanning free on all plans. A 5 percent fee applies to credits purchased through Unified Billing, with inference passed through at no markup.
Helicone. Flat subscription tiers. Gateway plus observability, request logs, cost attribution.
Portkey. Custom priced. Enterprise gateway with governance, guardrails, deployment options.
Not Diamond. Router only, per routed token. Integrates with an existing gateway rather than replacing it.

Where the money is

Where the money actually is, in order

Prompt caching, up to 90 percent off the repeated prefix. Costs prompt discipline. Changes nothing the client can perceive. On a support bot the system prompt is identical on every call, so this is usually the largest single lever.
Batch or flex tier, about 50 percent off everything. Costs latency. Only usable where nobody is waiting. Overnight summarisation on a standard tier is paying double for latency nobody uses.
Context discipline, avoids a 2x cliff. Long-context pricing is a step change, not a gradient. Trimming retrieved context to stay under the threshold can beat changing model.
Model downgrade, 60 to 70 percent. COSTS QUALITY. It is the only lever the client can perceive, which is why it goes last.
Routing, the marginal saving above a fixed policy. Real at volume, and frequently smaller than the four above combined.

Reading the result

The stage is the headline. It tells the client what to buy and, more usefully, what not to.
Net monthly is gross saving minus router fee minus YOUR operating cost. The third term is the one MSPs forget, and it is what makes small clients come out negative.
Break-even spend is derived from this client's numbers, not asserted from a blog post. Below it, the layer costs more than it saves.
Blocked-by names the missing prerequisite when Stage 4 does not clear, so the conversation is about fixing that rather than about the product.

Benchmarks

Break-even on default assumptions: around $3,000 a month of model spend, using 40 percent of traffic eligible for a cheaper model, a 60 percent saving on that share, and 4 hours a month of engineering at $145.
Percentage fee routers scale linearly: at 5.5 percent, $2,000 a month costs about $110, and $100,000 costs about $5,500.
Flat subscriptions get relatively cheaper as spend rises, so the crossover against a percentage model is worth computing rather than guessing.
Self-hosted gateways have no licence fee and a real operating cost. Free is not free.

Checklist

Does this client hold an attestation? If yes, they need a gateway regardless of spend.
How many DISTINCT workloads? Three or more and a fixed policy per workload is worth writing down.
Is prompt difficulty genuinely varied, or is every request similar? Uniform traffic gives a router little to decide.
Is there production evaluation data? Without it nobody can prove a cheaper model preserved quality.
What is the monthly model spend, and where does the break-even fall for THIS client?
Have we counted OUR operating cost, not just the router fee?
Have we tried caching and batch tiers before proposing a routing layer?
Does the client already run a gateway? If so, a router sits on top and its cost is additive.
Do they need guardrails, PII redaction or content filtering? Not every gateway has them.
Can we export the resulting policy as configuration, or are we handing over a document?
Who maintains the allowlist when a new model appears in the catalogue next month?

Limitations

Router pricing is captured from published pages and moves faster than model pricing. Verify before quoting.
The eligible-traffic and expected-saving figures are assumptions, not measurements of this client. They drive the whole answer and are shown so they can be argued with.
Custom-priced products cannot be modelled without a quote, and the calculator says so rather than inventing a number.
Stage 4 economics assume routing decisions are accurate. A router that picks wrong costs more than it saves, and that cost is not modelled.

Method

Stage 2 is assigned on governance, not economics: an attestation forces it regardless of spend.
Stage 3 is assigned on workload COUNT, because a fixed policy pays off with variety rather than volume.
Stage 4 requires all three of volume, mixed difficulty and evaluation data. Any one missing blocks it and is named.
Break-even is the spend at which gross saving covers the router fee plus operating cost, computed from the supplied assumptions rather than quoted from a source.

Take this further

Chinese vs Western costModel the actual saving before the jurisdiction conversation starts.Jurisdiction risk scorerGreen, amber or red per model against the client's data class.Gateway stage advisorWhich stage this client belongs at, and the break-even from their numbers.Client AI exposure auditWhat the current routers can already reach that nobody approved.Router comparisonWhich product meets the hard requirements, priced at this client's spend, and what each one gives up.Multi-model routerModel the routing itself, once the stage advisor says it is worth having.

Router pricing captured 2026-07-26. Cloudflare, LiteLLM and Vercel are verbatim from vendor documentation; the rest are from vendor pricing pages. Router pricing changes faster than model pricing, so re-check before quoting. Default assumptions are 40 percent of traffic eligible for a cheaper model and a 60 percent saving on that share. Both are plausible starting points and neither is a measurement of any client.