Helicone
Mintlify bought it on 03/03/2026 and put it in maintenance mode, and the repository shows exactly that: the last GitHub release was August 2025 and the most recent commit removes an incident banner. Do not start here in 2026, however good the two-line integration is.
PRICING
| Self-hosted | $0 | Apache-2.0, genuinely OSI open source. Docker all-in-one image or Helm for enterprise workloads. Five services under the hood: Next.js web, Cloudflare Worker proxy, Jawn API server, Postgres, ClickHouse and MinIO. Only OpenAI and Anthropic are supported — Vertex, Bedrock and Azure are not. The all-in-one container wipes data on restart unless you mount volumes, and account setup requires manual SQL to verify the user and create the organisation |
| Hobby | $0 | 10,000 requests/month, 1 GB storage, 1 seat, 1 organisation, 7-day retention, 10 logs/min ingestion, no API access. Sessions, user analytics, custom properties, playground, caching, rate limits and fallbacks included |
| Pro | $79/mo | Unlimited seats, 1-month retention, 1,000 logs/min, 10 API calls/min, alerts, reports, HQL query language, data export, chat and email support. Prompts is a Pro add-on. Usage-based billing above 10k requests and 1 GB. 7-day free trial |
| Team | $799/mo | 5 organisations, 3-month retention, 15,000 logs/min, 60 API calls/min, SOC 2 Type II and HIPAA, configurable retention, private Slack channel |
| Enterprise | Quote only | Unlimited organisations, indefinite retention, 30,000 logs/min, 1,000 API calls/min, SAML SSO, on-prem deployment, custom MSA, InfoSec reviews, dedicated support engineer, SLAs, bulk cloud discounts |
Price the maintenance-mode risk before you price the plan. On the free tier the binding constraint is not the 10,000 requests, it is 7-day retention and 10 logs per minute — a single busy agent run breaches the rate limit, and week-over-week comparison is the ceiling on analysis. The jump from €0 to $79 is steep for a side project, and Prompts sits behind it as an add-on. Self-hosting is the one place Helicone's licence beats both open-source rivals — Apache-2.0, genuinely OSI-approved — but the self-hosted build only speaks OpenAI and Anthropic, the all-in-one container loses all data on restart without mounted volumes, and creating your first account means running psql inside the container by hand. Euro figures converted from published USD at roughly 0.92.
checked 2026-08-15 · vendor pricing page
Element scores
Strengths
The integration model is the best in this category and nothing else comes close. You change baseURL and add one header. No SDK to wrap, no decorators on your functions, no framework to adopt — every existing call including streaming and function calling passes through unchanged, and because configuration travels as HTTP headers it works with any HTTP client rather than only official provider SDKs. That single design choice is why 16,000 organisations pushed 14.2 trillion tokens through it. Sitting in the request path also buys capabilities the SDK-based competitors structurally cannot offer: edge caching with up to 20 variants per bucket and TTL to 365 days, rate limits enforced before the provider call, automatic failover across providers, and real runtime security — Meta's Prompt Guard for injection detection and Llama Guard across fourteen harm categories, returning a 400 before a completion is requested rather than flagging it afterwards. The AI Gateway reaches 100+ models on one OpenAI-compatible endpoint with 0% markup against OpenRouter's 5.5%. The licence is Apache-2.0, which is cleaner than the Elastic License 2.0 its nearest self-hosted rival uses. And the May 2026 incident write-up is a credit to the team: four days of degradation named as four days, no data lost, credentials rotated anyway, the AWS wait owned rather than spun.
Honest dings
The product is in maintenance mode and the repository proves it rather than merely stating it. Mintlify acquired Helicone on 03/03/2026; both companies published that security updates, bug fixes and new model support continue while active feature development ends, and that Mintlify will help customers migrate elsewhere. Measured on 15/08/2026, the last GitHub release was tagged in August 2025, the last commit landed on 21/07/2026 and it removed an incident banner, and the four commits before it were build fixes and banner copy. That is not a slow quarter, it is a stopped roadmap, and an observability tool that stops moving while the thing it observes does not is a depreciating asset. The documentation has already drifted: the Experiments page still teaches a spreadsheet workflow for a feature deprecated and removed on 01/09/2025, and LLM Security and Moderations still promise non-OpenAI provider support 'coming soon'. Self-hosting is the weakest part despite the best licence — five services behind the all-in-one image, only OpenAI and Anthropic supported with Vertex, Bedrock and Azure explicitly excluded, data wiped on container restart unless you mount volumes, and first-account setup requiring hand-run psql statements to verify your email and insert an organisation row. Reliability has a real scar: from 14 to 18 May 2026 log ingestion and the dashboard were down for four days after AWS locked the entire account over a Bedrock key it wrongly believed compromised, and Helicone could not restore service until AWS responded. The proxy stayed up and no data was lost, which is the right architecture showing its worth, but the incident post was deliberately kept out of the blog index — visible only by direct link from an in-app banner, as their own pull request states. Finally, evaluation and agent tooling are thin next to the alternatives, and neither will be filled in now.
Sources (20) — every claim traceable
Every audit lists the research it rests on — transparency and traceability are the product. Tools evolve: each audit is a snapshot of its audit date, and re-audits supersede older versions (kept below for reference).
- helicone.ai/blog/joining-mintlify — Primary source for the headline finding, published by co-founder Cole Gottdank on 03/03/2026: Helicone acquired by Mintlify, services remain live in maintenance mode with security updates, new models and bug fixes only. Also the source of every usage figure quoted — 14.2 trillion tokens, 16,000 organisations, 33 million end users tracked, YC W23, three years (accessed 2026-08-15)
- mintlify.com/blog/mintlify-acquires-helicone — The acquirer's announcement, same date, from co-founder Han Wang. Independently corroborates maintenance mode in Mintlify's own words and adds the commitment to work with every customer on migration to another platform. Founders Justin Torre and Cole Gottdank joining in San Francisco (accessed 2026-08-15)
- github.com/Helicone/helicone — Official repository measured live 15/08/2026 via the GitHub API and the primary evidence that maintenance mode is real rather than stated: 6,073 stars, 653 forks, 168 open issues, Apache-2.0, not archived, last push 21/07/2026 (a commit removing an incident banner), latest release tagged v2025.08.21 in August 2025. Also the source for the five-service self-hosted architecture and the OpenPipe/Autonomi fine-tuning partners (accessed 2026-08-15)
- helicone.ai/pricing — Official pricing verified live 15/08/2026: Hobby $0 at 10k requests, 1 GB, 1 seat, 7-day retention and 10 logs/min with no API access; Pro $79; Team $799 with SOC 2 and HIPAA; Enterprise custom with SAML SSO and on-prem. Full matrix of retention, ingestion rate and API rate per tier, plus the startup, non-profit, open-source and student discounts (accessed 2026-08-15)
- docs.helicone.ai/getting-started/self-deploy-docker — Official self-hosting guide and the evidence behind the self-host score: helicone-all-in-one image, ports 3000/8585/9080 plus internal Postgres and ClickHouse, the explicit statement that Vertex AI, AWS Bedrock and Azure OpenAI are not supported in the self-hosted version, that container restarts wipe all data without mounted volumes, and manual psql commands required to verify a user and create an organisation (accessed 2026-08-15)
- docs.helicone.ai/gateway/overview — Official AI Gateway docs: single OpenAI-compatible endpoint to 100+ providers, translation layer, automatic fallbacks, credits at 0% markup, BYOK option, and the vendor's own comparison table against OpenRouter's 5.5% markup (accessed 2026-08-15)
- docs.helicone.ai/features/advanced-usage/llm-securi… — Official LLM Security docs and the basis for the Guardrails score: Meta Prompt Guard 86M for direct and indirect prompt injection and jailbreaks across eight languages, optional Llama Guard 3.8B across fourteen harm categories, enabled by request header. Also the explicit limitation that it works with OpenAI models only, with other providers 'coming soon' (accessed 2026-08-15)
- docs.helicone.ai/features/advanced-usage/moderations — Official Moderations docs: OpenAI moderation endpoint called before the completion, flagged prompts returning a 400 with PROMPT_FLAGGED_FOR_MODERATION. Confirms the OpenAI-only constraint a second time and lists customisable criteria as 'coming soon' (accessed 2026-08-15)
- docs.helicone.ai/features/experiments — Direct evidence of documentation drift: the Experiments page opens by stating the feature is being deprecated and removed from the platform on 01/09/2025, then proceeds to teach the full workflow across three creation methods, and still promises Python and TypeScript evaluator support 'coming soon' (accessed 2026-08-15)
- docs.helicone.ai/features/sessions — Official Sessions docs: three headers building a hierarchical request tree, grouping LLM calls, vector-DB queries and tool calls, with guidance to name paths by conceptual function rather than chronology. Basis for the Context and Multi-agent scores (accessed 2026-08-15)
- docs.helicone.ai/features/prompts — Official Prompts docs, and the source of the finding that prompt management is a paid add-on on the Pro plan rather than a core feature. Also the full feature navigation used to bound the audit: Evaluation, Sessions, Prompts, Experiments, Webhooks, Custom Properties, Caching, Omit Logs, User Metrics, Datasets & Fine-Tuning, Gateway Fallbacks, Retries, Custom Rate Limits, Key Vault, Moderations, LLM Security, Customer Portal (accessed 2026-08-15)
- docs.helicone.ai/integrations/tools/mcp — Official MCP documentation and the basis for the Protocols score: @helicone/mcp run over stdio via npx, API-key auth against the US or EU endpoint, three tools (query_requests, query_sessions, use_ai_gateway) with the full filter grammar. npm registry confirms the package sits at version 0.1.6 (accessed 2026-08-15)
- docs.helicone.ai/references/open-source — Official licensing statement: Apache License 2.0, free use, modification and distribution, with the vendor's stated reasons including preventing vendor lock-in. Confirmed against the repository licence metadata (accessed 2026-08-15)
- docs.helicone.ai/references/data-autonomy — Official security and privacy page: SOC 2 compliant cloud, choice of EU or US region for data residency, OWASP protocols, encrypted provider keys (accessed 2026-08-15)
- helicone.ai/blog/aws-account-incident — The vendor's own incident write-up, 18/05/2026: degraded from Thursday 14 May to midday Monday 18 May after AWS locked the entire account over a Bedrock key it believed compromised, blocking the ECS tasks that run log ingestion and the dashboard. The proxy stayed up throughout, no data was lost, requests were queued and the four-day backlog drained afterwards. The key turned out not to be compromised; all credentials were rotated regardless (accessed 2026-08-15)
- github.com/Helicone/helicone/pull/5681 — Evidence for the transparency ding, in the team's own words: the incident post was intentionally not added to BLOG_CONTENT, so it resolves at /blog/aws-account-incident by direct link but never appears in the blog list or filters. Reachable only from the in-app alert banner, which a later commit then removed (accessed 2026-08-15)
- chatforest.com/reviews/helicone-llm-observability-g… — Independent review (06/05/2026) scoring 3.5/5 with maintenance mode in the title. Corroborates the two-line integration advantage, the sub-1ms self-hosted overhead claim, the caching and rate-limiting differentiation, and names multimodal evaluation and OTel-native alternatives as reasons to look elsewhere given no acquisition or EOL concern (accessed 2026-08-15)
- llmeter.org/migrate/helicone — Independent post-acquisition analysis framed explicitly as migration guidance, corroborating the March 2026 date, the end of active feature development and the continuation of security patches, bug fixes and new model support only (accessed 2026-08-15)
- blog.spanlens.io/helicone-mintlify-migration-checkl… — Second independent source treating Helicone as a migration case after the acquisition, corroborating the maintenance-mode scope and the 16,000-organisation figure (accessed 2026-08-15)
- docs.helicone.ai/getting-started/quick-start — Official quickstart: the AI Gateway path with baseURL swapped to ai-gateway.helicone.ai in TypeScript, Python and cURL, credits with 0% markup and vendor-managed provider keys, or bring your own (accessed 2026-08-15)