Spanway

Spanway is a self-hosted, commercially licensed AI gateway for platform teams. One OpenAI-compatible API in front of more than a hundred model providers, with virtual keys, teams and organisations, budgets and rate limits, routing with fallbacks, guardrails, caching, prompt management, an MCP gateway, tracing, and an Admin UI. The enterprise layer adds the license system, custom roles, a developer portal with approvals, compliance and data governance, billing and invoicing, evals and red teaming, and the hosted Cloud edition

This repository is private. Spanway is not open source. See LICENSE and enterprise/LICENSE.md

Layout

Run it locally

uv sync --extra proxy --extra extra_proxy --extra evals
export SPANWAY_MASTER_KEY=sk-...            # generate your own
export SPANWAY_LICENSE=...                   # issue one with scripts/fork/issue_license.py
export DATABASE_URL=postgresql://spanway@localhost:5432/spanway
python spanway/proxy/proxy_cli.py --config spanway/proxy/dev_config.yaml --use_v2_migration_resolver

The Admin UI dev server is npm run dev in ui/spanway-dashboard on port 3000. The docs site is npm run start in docs, the website is npm run dev in website

Build and release

Pushing a tag vX.Y.Z runs .github/workflows/release.yml: native wheels for Linux x86_64, Linux arm64 and macOS arm64 plus the pure packages, PyPI through trusted publishing, the container images under ghcr.io/sgourneni/, and the Helm charts under oci://ghcr.io/sgourneni/charts. Local builds: uv build, docker build -f Dockerfile .

Verifying release images and charts

Every image and Helm chart the release workflow pushes is signed with cosign keyless signing and carries an SPDX SBOM attestation. There is no long-lived public key to download. The signing certificate is issued by Sigstore to the release workflow's GitHub OIDC identity, so verification checks that identity instead

IMAGE=ghcr.io/sgourneni/spanway-ai:v1.0.0
IDENTITY='^https://github\.com/sgourneni/spanway-ai/\.github/workflows/release\.yml@refs/tags/v'
ISSUER=https://token.actions.githubusercontent.com

cosign verify --certificate-identity-regexp "$IDENTITY" --certificate-oidc-issuer "$ISSUER" "$IMAGE"
cosign verify-attestation --type spdxjson \
  --certificate-identity-regexp "$IDENTITY" --certificate-oidc-issuer "$ISSUER" "$IMAGE"

Charts verify the same way with their OCI reference, for example ghcr.io/sgourneni/charts/spanway:<chart version>. A signature made by any other workflow, branch or fork fails the identity check

Keeping up with upstream

The gateway, Lens, the admin agent and the MCP connector are forks. upstream.json records the upstream commit each one is synced to and scripts/fork/sync_upstream.py --name <upstream> --dry-run shows what a sync would apply. Vendored Python packages refresh with scripts/fork/sync_vendored.py. See scripts/fork/UPSTREAM_SYNC.md

Checks

make check runs the full lint and type gates. Unit tests live under tests/unit mirroring the source tree, end-to-end tests under tests/e2e. See AGENTS.md for the engineering conventions every change follows