Monitor & Directory AI Sites

The 6 entries here are the middle layer of the free-key economy. Five are directories, hubs or marketplaces that aggregate free AI API keys and router endpoints from many upstreams — RouterPark, Hvoy (two entries), all-api-hub and Modeloc — and one (TinyFish Fetch) is a fetch service that proxies requests. None of them is what the paid-api or official-free-tier categories track: a first-party endpoint with a published rate table. They earn a place in the directory because developers' "free key" paths routinely run through this layer, and because the questions about middlemen — who operates it, what happens to your key, which upstream is really being hit — are the same questions the rest of the site answers, applied one layer down.

That layer is also where the data thins out. First-party entries in this dataset carry published pricing pages, documented free tiers and verified rates; the middlemen here often carry none of that. The directory still tracks them, with the honest labels: the free-credit column is mostly unquantified, the per-1M price columns read empty, and the columns that do carry signal are operator identity, risk tier, community rating and the live probe.

At last check the six rows split 3 low / 2 high / 1 medium. The two high ratings (RouterPark, Modeloc) and the medium (TinyFish — whose probe also returned unknown rather than up) are the rows to read twice before routing anything through them. What the risk tier reflects is operator transparency: a verifiable operator, documented terms and an identifiable upstream score lower; an anonymous aggregator scores higher. One concrete transparency signal in the data: all-api-hub's tracked domain is qixing1217.top — a hub operating from a domain that looks nothing like its brand. That mismatch is exactly the kind of fact the risk column exists to surface, and it is why the entry page, not a list, is where the judgment should be formed.

Also worth naming plainly: two of the six entries are the same operator. Hvoy appears as both hvoy-ai and hvoyai-com, both low risk, both up at last check — a duplicate the site's keyword-cluster audit recorded as a data-deduplication decision for the owner rather than a content decision. Until that decision lands, count them as one operator, not two, whenever you are estimating how many independent free-key directories exist.

The working rule is separation of trust. Discovery is safe: browsing the list, checking which upstreams an aggregator exposes, comparing the free allowances it advertises — none of that hands over credentials. The trust-crossing moment is entering a key or signing in through a third-party hub, and the rule there is simple: never paste a key that matters into a site you have not independently vetted, and generate a throwaway key for anything that must go through a middleman. A key leaked to an opaque aggregator is a spend problem (the holder can burn your allowance) and an attribution problem (your usage entangles with theirs in rate-limit accounting). The provider's official console is the only place a real key should first live.

Where a hub is legitimately useful — identifiable operator, documented terms, first-party upstreams — the entry page carries what could be verified: the tracked domain, the risk tier and its basis, the probe history and the community rating. The probe on this category is the same best-effort reachability check as everywhere else on the site: it says the site answers, not that its keys work or that its upstream claims are true. All five listed directories probed up at last check; the fetch service returned unknown, which on a service whose entire product is fetching is worth a second look before you depend on it.

Six is a small category, and the smallness is informative rather than a data gap: the free-key middle layer is real but shallow — a handful of operators serving a large audience, with churn. New hubs appear, old ones go quiet, and the probe column is where that churn shows up first. The directory keeps the category because the buyer question it answers is specific: before I use one of these sites, what do we actually know about the operator? The per-row answer is the risk tier, the operator signals and the probe history — with the standing caveat that for middlemen, "up right now" and "trustworthy" are different facts, and only the second one is hard to verify.

Four checks, all visible on the entry. One, operator identity: a named, reachable operator beats an anonymous domain — the entry's tracked domain and name make the mismatch (or match) visible. Two, the risk tier and its basis: low with a stated basis is a different fact from unrated. Three, the upstreams: a hub that exposes identifiable first-party endpoints is verifiable against the official pages in this same directory — cross-check a hub's claim against the provider entry before you act on it. Four, the probe history: a site that is intermittently down is a site whose unreliability you will inherit. A hub that fails two of these is not worth the key exposure, whatever allowance it advertises.

What the data does not settle: whether a hub's keys are currently valid (providers revoke and rotate), what its terms actually say (fetch and read them at the entry's link before first use), and whether its operator has changed hands — all three are time-sensitive facts that outrank the row on the page.