TL;DR — An agent router is middleware: every prompt, code snippet, and response passes through it, so the question "is an agent router safe?" is really "do I trust this specific operator?" The category is legitimate — the same architecture pattern as any API gateway — but individual services vary enormously. Judge any router on five things: where its keys come from, whether it supports BYOK, what it logs, whether its pricing is economically possible, and how easily you can leave. A service dramatically cheaper than official provider pricing is the single biggest red flag: LLM inference has real compute costs, and "cheaper than the provider itself" usually means unauthorized keys or an unsustainable operation.
What an agent router can actually see
Before judging safety, be clear about the exposure. When you point Cursor, Claude Code, Aider, or a custom agent at a router endpoint, the router can observe:
- Your prompts and code context — every request body, including proprietary source code your agent sends as context
- Model responses — the generated code coming back
- Your API keys — if you hand them over (BYOK mode), the router holds credentials to your provider accounts
- Usage metadata — request volume, timing, model choices, token counts
This is the same trust position as any proxy, CDN, or API gateway you already use. It is not inherently unsafe — but it means the operator's practices matter more than the category label.
The six real risks
1. Key custody
If the router pools its own provider keys and resells access, you depend on those keys being legitimately sourced. If you bring your own key, you depend on the router storing it securely and using it only for your traffic.
2. Unauthorized upstream keys
This is the dark corner of the category. Some resellers run on gray-market keys — leaked, stolen, or bulk-abused trial credentials. The symptom is pricing that undercuts the provider itself. The consequence lands on you: sudden outages when key pools get banned, and in the worst case your account data flowing through infrastructure you'd never knowingly choose.
3. Logging and retention
A router can store every prompt and completion. A legitimate one documents exactly what it logs (typically request metadata for billing) and what it doesn't (your content). If there is no data policy at all, assume the worst.
4. Billing opacity
Token-level billing has room for creative accounting. Legit services show per-request breakdowns — what model actually served the request, at what rate. If you cannot reconcile what you were charged against what you used, that's a structural problem, not a paperwork gap.
5. Availability and lock-in
If the router goes down or disappears, does your workflow break? A safe setup means your client config can point back to the official endpoint in one line. Routers that require proprietary SDKs or rewrite your codebase raise the exit cost.
6. Provider terms-of-service
Routing your own BYOK traffic through middleware is generally fine. Buying access resold from someone else's account can violate the upstream provider's terms — and enforcement hits the account, meaning service interruption for everyone downstream.
The legitimacy checklist
Run any routing service — including ours — through these questions:
| Question | Green flag | Red flag |
|---|---|---|
| Is the pricing economically possible? | At or near official provider rates, savings come from routing, not discounts | "50-80% off Opus" with no explanation |
| Where do the keys come from? | Clearly stated: official partnership, your BYOK, or transparent system keys | Silence, or vague "enterprise accounts" |
| Can you bring your own key? | BYOK supported — you keep custody | Pool-only, keys never explained |
| What is logged? | Written data policy: metadata yes, content no (or clearly stated retention) | No privacy/data page at all |
| Who operates it? | Identifiable company, support channel, changelog | Anonymous site, Telegram-only contact |
| How do you pay? | Standard processors, invoices | Crypto-only, top-up cards, no receipts |
| What's the exit cost? | One config line back to the official endpoint | Proprietary SDK, custom protocol |
The pricing question deserves emphasis because it's the most reliable single signal. LLM inference is real compute: Anthropic sells Opus at its published per-token rate because that's what the compute economics support. A middleman cannot sustainably sell the same tokens for a fraction of that price. Honest routers save you money by sending each request to the cheapest capable model — planning to a frontier model, boilerplate to an economical one — not by selling below cost.
So — is an agent router safe?
The architecture: yes. Routing is standard middleware, and self-hosted options (LiteLLM, RouteLLM) prove the pattern is sound — our agent router alternatives guide compares the landscape, including fully self-hosted routes if you want zero third-party exposure.
Any specific hosted service: verify. Apply the checklist above. A legit operator will have ready answers to every row; a risky one will fail two or three immediately.
Is an agent router legit as a way to cut costs?
The savings mechanism is legitimate and measurable — when it comes from routing intelligence rather than discounted resale. The math is simple: most coding-agent requests (implementation, tests, docs) don't need a frontier model, but default configs send everything to one. Judging each request and routing it to the cheapest capable model is where the savings come from. In TokenWatt's 176-task coding benchmark (TokenWatt is a measurement project from the same team as CodeRouter), routing solved 96–100% of tasks for 56–70% less than sending every request to Opus, across runs. We published our own numbers on this, including the unflattering parts: we audited our own traffic and found 80% was bypassing the router before fixes — real per-request cost dropped 36% once routing actually engaged.
How CodeRouter answers the checklist
To hold ourselves to the same standard:
- Savings source: routing — a small judgment model reads each request, cost rules start it on the cheapest tier that can handle it, and it moves up only when tests or errors show a failure. Frontier models only where the task demands it. No below-cost token resale: usage is billed at provider list price (plus 5% past a plan's included usage). How phase-aware routing started.
- Keys: CodeRouter serves requests with its own provider keys. Your own keys (BYOK) can be added only as an opt-in fallback for when a paid plan's usage runs out; CodeRouter API keys are stored only as a hash, and the full key is shown once.
- Logging: to improve routing, CodeRouter stores an excerpt of each request (the latest message and tool output, trimmed) and a short response summary for up to 180 days, with the routing decision. Team admins can turn content storage off (then metadata only). TypeSafe, which runs the routing judgment model, receives the excerpt and states it does not train on customer data. Data is never sold.
- Exit cost: CodeRouter is an OpenAI-compatible endpoint — leaving is one base-URL change in your client config, the same line that got you in. See the comparison with OpenRouter for how the models differ.
- Billing: per-request model attribution, so you can see which model served each call and reconcile every charge.
Bottom line
"Agent router" describes a legitimate, increasingly standard piece of AI-coding infrastructure — the same trust decision you make about any gateway. Judge operators, not the category: verify where keys come from, insist on a written data policy, keep BYOK as your custody option, and treat impossible pricing as the disqualifier it is. If a service passes the checklist, the cost savings from intelligent routing are real; if it can't answer where its tokens come from, no discount is worth being downstream of it.