Model selection is the question to test
Weave Router puts a model-selection service between an agent and its providers. The useful adoption question is whether its choices preserve the quality your tasks require at an acceptable cost and latency. Our recorded source run cannot answer that question.
The README describes routing per action, meaning each upstream API request rather than an entire agent turn. It documents Anthropic Messages, OpenAI Chat Completions, and Gemini native interfaces. The default self-hosted stack uses an in-process ONNX embedder and cluster scorer; an HMM policy is optional. These are documented capabilities, not results from a live provider workload in our run.
What our September 18 run establishes
Our recorded run used commit 76a9bbb54dadf7ce6a1decdfe954bab00a62bc39 on September 18, 2026. Dependency setup exited zero after 70 seconds, with 335 dependencies recorded. Its retained output shows go: downloading go1.25.9 (linux/amd64). That establishes a toolchain download during setup, not installation of the npm package or verification of an installed CLI.
The build step exited zero after 124 seconds. Its retained tail is vet-exit:0; the supplied record does not preserve enough command detail to identify the exact compiled target. The Go test step exited zero after 107 seconds. The parser records 134 successful package results, zero failed package results, and 19 packages without tests. Some retained output explicitly says [no tests to run]. A successful package result therefore cannot be counted as one individual passing test.
These are recorded parser summaries. No complete-log reconciliation established exhaustive unique test coverage, and no new execution accompanies this review. The record contains no installed-binary check or measured live routing workload. It does not establish model quality, routing latency, savings, or security. The audit field is null.
The configured sandbox had 3 CPUs, 8 GB of memory, and image golang:1.24-bookworm. The toolchain download shows why the image label alone is insufficient to identify the Go version used. The checkout measured 30.2 MB, 2,097 files, and about 292,642 source lines. The scan found 10 CI workflows, a Dockerfile, and a Compose file. Its absence-of-tests-directory signal does not imply an absence of Go tests beside source files.
Hosted setup and self-hosting have different requirements
The current README says the bare npm invocation opens a hosted setup page. An explicit client target selects terminal installation. The npm guide covers Claude Code, Codex, OpenCode, and pi; it requires Node 18 or newer. OpenCode major version 2 is required when its CLI is installed and available on PATH.
The detailed installer guide also qualifies the older blanket jq requirement. Basic Windows configuration can use a native Node installer without Git Bash, WSL, or jq. Shell-based status displays, hooks, and account-management commands still need Git Bash or WSL. On supported Bash platforms, missing jq can be supplied by a checksum-verified jq 1.8.1 download; other architectures need manual installation.
Self-hosting starts Postgres and the router on port 8080 through the documented setup target. A separate rk_ key authenticates clients. ROUTER_ADMIN_PASSWORD enables dashboard administration; leaving it unset disables administration while inference remains available. The optional HMM sidecar uses port 8093 and a Google API key. Multiple replicas need Pub/Sub for cache invalidation.
The supplied configuration extract does not include the BYOK encryption section itself. The README claims encryption at rest, but this review cannot establish the precise missing-key behavior from that extract. Before storing real provider credentials, verify encryption requirements in the documentation for the exact deployed release.
The current license permits hosted services
The current README and LICENSE identify Apache License 2.0. The README places the release boundary at router-v0.2.24, including version 0.2.24 of both @weave-os/router and @workweave/router. Earlier tags and published packages retain the licenses shipped with them.
For that Apache-2.0 release line, commercial use, hosted services, and proprietary derivatives are permitted subject to the license terms. General trademark rights are excluded, and dependencies, model weights, and datasets retain their own licenses. Check the license bundled with the artifact you deploy. The current license statement cannot retroactively establish the license of the September measured commit.
Separate a reported problem from a confirmed deployment defect
Issue 1360 is closed, and its author explicitly withdrew the claim that Compose failed to load provider variables. In the October 4, 2026 follow-up, the author confirmed that the variables were loading. The attempted printenv execution could not work inside the distroless image; empty piped output was a failed inspection command, not evidence of missing variables. The author attributed the actual routing failure to a gateway key without model aliases and reported successful routing after adding aliases.
Two other supplied issues remain reports to investigate against a chosen release. Issue 867 describes a mock-upstream reproduction in which 1-hour Anthropic cache writes used the 5-minute multiplier, producing the reported 37.5% shortfall for that cache-write component. The discussion also mentions a proposed debit-time fix; it does not establish the deployed status of that fix. Issue 789 describes preferred-model changes sharing a semantic-cache bucket and returning a cached body that differs from the live decision's model header. Its stated conditions include fresh scoring and a sufficiently similar prompt; it is not presented as a cross-organization isolation failure. Neither report was reproduced in our recorded run.
A pilot should therefore compare provider invoices with router accounting and check cache behavior when model preferences change. Treat issue status and reporter reproductions as inputs to those checks, rather than proof that every current deployment has the same behavior.
Alternatives depend on the job
LiteLLM's README documents both a Python SDK and a centralized proxy, including virtual keys, spend tracking, load balancing, and an admin dashboard. It is relevant when those integration and administration features define the requirement. The SDK is a library integration option; the proxy is the deployment alternative.
Portkey AI Gateway's README documents retries, fallbacks, load balancing, conditional routing, and guardrails. It is relevant when explicit policy and failure handling drive the decision. Its feature table distinguishes capabilities available in hosted or enterprise versions. These descriptions come from the projects' documentation; we did not benchmark either alternative against Weave Router.
How to read the scores
These are editorial assessments of the supplied evidence, not measured product performance. The rubric is: 1 means substantial documented barriers; 2 means limited evidence or substantial unresolved validation; 3 means a documented path with meaningful operational work; 4 means detailed evidence for the dimension with bounded gaps; 5 requires broad corroboration beyond the supplied material. Unknown adoption, compatibility, and support quality do not earn a high score.
Setup receives 3/5 because client setup is documented but self-hosting adds Postgres and operational configuration, and our run did not verify installation end to end. Documentation receives 4/5 because the supplied material distinguishes client integrations, platform requirements, deployment modes, and release licensing, although some README details differ from the more specific npm guide. Community receives 2/5 because the issue threads show participation but do not establish adoption or dependable support. Maturity receives 2/5 because the historical command results provide limited validation, with current deployment behavior and reported accounting and cache concerns still requiring release-specific checks.
Start with representative tasks and a fixed-model control. Compare answer quality, provider failures, latency, and reconciled costs, then exercise the request formats your clients actually send. That evaluation supplies the adoption evidence missing from a successful source test command.