Preloop
Preloop · Coding
Preloop is an open-source AI agent control plane that sits between your agents and the outside world. It pairs an MCP firewall for tool access with a model gateway for cost and attribution, then adds policy-as-code rules, human-in-the-loop approvals, session observability, and audit trails. The platform is self-hostable under Apache-2.0, and its CLI can rewrite Claude Code, Codex CLI, Cursor, and other MCP runtimes to route through it without touching your agent code.
About Preloop
What Is Preloop
Preloop is AI agent governance infrastructure for teams running agents in production. Agents call tools, spend tokens, and touch real systems. Most teams find out what they did after the fact. Preloop changes that by giving you a stopping point: every tool call and model request passes through a control plane you configure.
The product covers two things that usually live in separate tools. An MCP firewall decides which tool calls are allowed, denied, or need a human to sign off, and a model gateway routes traffic so each token is charged back to the agent or API key that spent it. Rules are written in YAML with CEL expressions, so you can inspect arguments, not just tool names.
The catch is scope. Preloop is built for teams already running MCP-compatible agents, and it assumes you're comfortable with config files, version control, and self-hosting if you skip the cloud plan. It's not a no-code dashboard. Someone who just wants a chatbot to answer questions won't get much here. If nobody on your team owns infrastructure, the setup will feel heavier than the problem it solves.
Getting Started
- Install the CLI on macOS or Linux with the one-line curl script from the Preloop site.
- Run
preloop agents discover, which finds local agents like Claude Code, Codex CLI, and Cursor and backs up their configs before rewriting them. - Point tool calls at the MCP firewall and model traffic at the gateway.
- Write your first policies in YAML, deciding which tool calls are allowed, denied, or gated behind approval.
- Connect an approval channel such as mobile, Slack, or a webhook, then watch activity from the fleet view.
Product Information
A quick look at Preloop's pricing, supported platforms, and performance.
Best for
The users, tasks, and scenarios where this tool fits best.
Users
- Platform and infrastructure teams
- Security and compliance leads
- Small AI product teams on a budget
Tasks
- Blocking high-risk tool calls
- Tracking AI spend by agent
- Reviewing what an agent did in a session
Scenarios
- Rolling out coding agents across a team
- Preparing machine-readable evidence for a compliance program
- Capping runaway model cost on a side project
Key features
MCP Firewall With CEL Rules
The firewall intercepts tool calls and applies ordered rules that carry priorities. Because rules use CEL expressions, they can read the arguments inside a call, so a transfer of 5000 can be treated differently from a transfer of 5. Denied calls fail immediately with a message the agent can read and act on. Good. That keeps the agent useful instead of stuck.
Model Gateway and Cost Attribution
Model traffic runs through a gateway that speaks both OpenAI and Anthropic formats. Every token gets attributed to the agent, flow, or API key that spent it, and you can set soft and hard budgets per account and per flow. When a provider reports the true cost, Preloop records it over its own estimate. Usage it can't price is labeled unpriced rather than shown as zero. No fake precision.
Human-in-the-Loop Approvals
This is where Preloop separates itself from plain proxies. When a call matches an approval rule, the person who needs to decide gets the arguments, the surrounding context, and the rule that triggered it on mobile, a watch, Slack, Mattermost, email, or a webhook. They approve with one tap. Low-risk actions never wait. An async mode lets the agent poll for the decision instead of blocking its whole run.
One-Command Agent Onboarding
Running preloop agents discover finds Claude Code, Codex CLI, Cursor, Gemini CLI, Hermes, OpenClaw, and OpenCode on the machine. It backs up each config and rewrites it to send tool calls through the firewall and model traffic through the gateway. No SDK. No agent code changes. That last part is why teams adopt it without a migration project.
Audit Trail and Session Replay
Every action lands in the agent audit trail: tool, inputs, matched rule, decision, approver, model spend, and outcome. You can move from a fleet-level view down into one session timeline. That turns a vague "the agent did something odd" report into a concrete sequence you can review.
Self-Hosted and Apache-2.0
The whole platform can run on your own infrastructure under an Apache-2.0 license, so your provider keys and data stay on your machines. That matters for teams that can't send agent traffic to a third party. It also makes the open-source edition a real fallback when cloud plans don't fit.
Pros and cons
Pros
- Open-source and self-hostable under Apache-2.0, so there's no vendor lock-in on keys or data.
- Onboarding works with existing MCP agents through config rewrites rather than a new SDK.
- Approval gates can pause a call and ask a person, which most MCP proxies can't do.
- Per-agent and per-flow budgets put a hard ceiling on model spend.
- Audit logging maps to common compliance programs, including EU AI Act and DORA.
Cons
- The benefits only kick in for teams running MCP-compatible agents; other stacks get little from it.
- Rule authoring leans on YAML and CEL, so it asks for someone comfortable with config and policy logic.
- Self-hosting is free but pushes operational work onto your own team, including upgrades and support.
Frequently asked questions
It's a control plane that sits between your AI agents and the tools and models they call. It decides which tool calls are allowed, routes model traffic for cost tracking, and logs everything for review. That's the whole job.
Related content
Explore related tools, skills, and articles for Preloop.
Preloop Alternatives
Base Code
Base44 (Wix) · Coding · ProductivityBase Code is a shared cloud development environment from Base44. Teammates describe changes to an existing GitHub codebase in chat, preview them live and send them back as pull requests.
Google EmbeddingGemma 2
Google DeepMind · Writing · Image · CodingGoogle EmbeddingGemma 2 is a 740M-parameter open model that turns text, code, images, audio, and video frames into vectors in one 768-dimension space, running on phones and laptops.
GitGlow
GitGlow · Coding · ProductivityGitGlow is a local-first desktop Git client that lets independent developers review their own code and their AI agents' changes in one place before shipping.