The open-source AI agent control plane. See them, govern them, cut their cost.
Preloop is a single self-hostable platform: an MCP firewall for tool access, an AI model gateway for cost, safety and attribution, policy-as-code with human approvals, and runtime session observability.
Basic account, agent, API-key and model budgets and single-person human approval workflows are included in the open-source core and cloud Free. Multi-user approval routing, quorum, escalations and advanced organization administration are commercial features. Cloud usage allowances and hosted credits are separate from governance budgets.
Flow presets can collect machine evidence for CRA- and EU AI Act-style reviews (SBOM verify, exploit check); Runtime Observability keeps the session timeline next to it. That is not a conformity assessment, certification, or legal advice. Presets: security audit presets.
Onboard existing agents with one command. Talk to long-running ones from the console, phone, or watch. Deploy event-driven automations when GitHub, GitLab, Jira, or a webhook fires. Works with OpenClaw, Claude Code, Codex CLI, Cursor, Gemini CLI, Hermes, OpenCode, Windsurf, and any MCP-compatible agent.
# 1. Install the CLI (macOS / Linux)
curl -fsSL https://preloop.ai/install/cli | sh
# Windows (PowerShell): irm https://preloop.ai/install/cli.ps1 | iex
# Details: docs/windows-cli.md
# 2. Connect it to a control plane
preloop signup # Preloop Cloud (fastest), or
preloop login --url http://localhost:3000 # your self-hosted instance
# 3. Bring local agents under governance
preloop agents discoverpreloop agents discover finds local agent configs, imports representable MCP servers and model metadata, mints managed credentials, and rewrites supported agents so tool calls go through the MCP Firewall and model traffic through the Gateway. For Talk (operator commands), the CLI can install the runtime plugin (preloop agents install-plugin, or preloop claude for Claude Code). The plugin is what keeps the control channel connected.
Onboarding, the MCP firewall, human approvals, and cutting session cost. Recorded against a real stack, no slideware.
Guides: docs.preloop.ai. Start here: onboard local agents (60s).
Operator notes let an identified human steer a running agent: the note is delivered at the next turn boundary through the gateway or a hook, costs nothing when there is none, and is recorded as a human decision.
The account kill switch blocks gateway and tool traffic, freezes pending approval deadlines, and requests termination of active managed flow executions, with audited staged recovery.
Two exports turn the agent inventory and the failure record into files an auditor can read: DORA: the AI-agent slice. They feed an Art. 8 inventory and an Art. 28 register, and list Art. 17 incident candidates. Classification stays with your firm, and Preloop covers the agent slice of the ICT estate only.
Jobs teams otherwise buy from several vendors, in one Apache 2.0 stack:
| Capability | What it does | Alternatives |
|---|---|---|
| MCP Firewall | Govern every tool call. Allow, deny, require approval, require justification. YAML + CEL. | MintMCP, Lunar.dev MCPX, TrueFoundry |
| AI Model Gateway | OpenAI- and Anthropic-compatible. Budgets, allowed-model lists, token accounting, attribution. | Portkey, Helicone, LiteLLM, Kong AI |
| Flows | Start an agent when a tracker or webhook fires, with the same firewall, approvals, and cost. preloop flow trigger. |
Custom CI glue, AgentCore Runtime |
| Cost & Budgets | Spend by model, agent, session, API key, flow, and user, including usage you import when the model never hits the gateway. | FinOps dashboards, vendor billing exports |
| Human Approvals | Mobile, watch, Slack, Mattermost, email, webhook, or preloop approvals. Native Bash/Edit. Agents can ask_user. |
Custom Slack bots, Peta Desk |
| Runtime Observability | One session timeline: tool calls, model calls, policy, approvals, spend, outcomes. | AgentOps, Langfuse, LangSmith |
| Evidence packs | Apache flow presets write result.json plus an evidence directory for CRA / AI Act-style work. Not a certification. |
Custom GRC folders |
AI Agent → Preloop → [Policy] → Allow / Deny / Require Approval → Execute
→ [Gateway] → Budget + attribution → Model
Automated issue implementation can resume its PR branch and native agent conversation after review or CI feedback, with durable turn budgets and current-head gates. A finished run whose PR publication was not recorded can be recovered by explicitly selecting and verifying its published PR and branch; when the native checkpoint is unavailable, follow-up requires acknowledgment that it starts a fresh conversation.
Connect GitHub, GitLab, or Jira as flow triggers and issue tools. Automations ship as presets, including the Issue Triage Assistant, Pull Request Reviewer and Observe / Eval. Or write your own.
version: "1.0"
metadata:
name: "Production Safeguards"
approval_workflows:
- name: "deploy-approval"
timeout_seconds: 600
required_approvals: 1
async_approval: true
tools:
- name: "bash"
source: mcp
approval_workflow: "deploy-approval"
justification: required
conditions:
- expression: "args.command.contains('deploy') && args.command.contains('production')"
action: require_approvalShip it with preloop policy apply <file> (validate / diff / export also exist).
Talk details for OpenClaw, Hermes, and Claude Code: OpenClaw, runtime adapters.
The CLI is a client. It talks to a control plane: Preloop Cloud or a stack you run.
Cloud (fastest)
curl -fsSL https://preloop.ai/install/cli | sh
preloop signup
preloop agents discoverSelf-host (Docker Compose, data stays on your machine)
curl -fsSL https://preloop.ai/install/oss | sh
curl -fsSL https://preloop.ai/install/cli | sh
preloop login --url http://localhost:3000
preloop agents discoverConsole: http://localhost:3000. The CLI stores the instance URL in ~/.preloop/config.yaml. Without --url or PRELOOP_URL, it defaults to https://preloop.ai.
Public TLS, SMTP (approvals, invites, password resets), upgrades, and Kubernetes: Install the OSS stack, TLS, Upgrading. Helm chart: helm/preloop (private cluster). Docker Compose and Helm are the supported install surfaces; this repository does not ship Terraform modules.
Production self-host: SECRET_KEY is required or the app refuses to start. Telemetry is a daily pseudonymous version check-in; set PRELOOP_DISABLE_TELEMETRY=true to disable. Event list: SECURITY.md.
This file is the product intro. It is not the architecture and not the coding contract.
| If you need | Read |
|---|---|
| How the system fits together | ARCHITECTURE.md is the map. Read one chapter under docs/architecture/ for the subsystem you are changing. Do not load every chapter "for context." |
| Commands, DB/CRUD rules, Lit frontend | AGENTS.md |
| PR process | CONTRIBUTING.md |
| Operator and client guides | docs.preloop.ai |
| Policy examples | backend/presets/ |
Do not load this README plus ARCHITECTURE.md end-to-end "for context." Pick the row above.
Same core jobs (runtime, gateway, identity, observability, policy), vendor-neutral and self-hostable. Full comparison: preloop.ai/vs/aws-agentcore.
| Preloop | AWS Bedrock AgentCore | |
|---|---|---|
| Open source (Apache 2.0) | Yes | No |
| Self-hostable (VPC / on-prem) | Yes | No |
| Policy-as-code (YAML + CEL) | Yes | Limited |
| MCP-native tool governance | Yes | Partial |
| Human approvals (mobile, Slack, webhook) | Yes | Limited |
Onboard existing local agents (preloop agents discover) |
Yes | No |
Also compare: LiteLLM, Portkey, Helicone, MintMCP, Lunar, Runlayer, Zenity.
Unqualified Preloop is this repository (Apache 2.0, self-hosted). Preloop Cloud is the hosted service at preloop.ai. Preloop Enterprise is the commercial self-hosted edition.
Cloud is managed hosting. Cloud and Enterprise include support plans. Cloud billing owners can compare the available usage from the previous three completed months in Account settings before requesting a plan-change quote. Missing history is labeled explicitly; a change requires confirmation of its price, limits and effective date. Cloud plan limits do not apply to the open-source self-hosted edition.
| Feature | Open Source | Cloud / Enterprise |
|---|---|---|
| Users, teams, and RBAC on one account | No | Yes |
A self-hosted OSS instance is one operator per account. Public signup, if left on, creates a separate account, not a teammate. Invitations, users, teams, and permission roles ship with Cloud and Enterprise.
Enterprise licensing: [email protected].
Discord for help, feedback, and the founder's build log.
See CONTRIBUTING.md.
The disposable capacity lab measures authenticated MCP, model-gateway and execution-log workloads using local simulated providers.
Apache License 2.0. Copyright (c) 2026 Spacecode AI Inc.
Release assets carry signed Sigstore build provenance and checksums. See verification instructions.
Windows CLI release binaries: optional VirusTotal scanning; SignPath Authenticode signing is pending. windows-cli.md, windows-code-signing.md, code-signing-policy.md.
Free code signing provided by SignPath.io, certificate by SignPath Foundation.
Execution environment profiles and hosted checkpoint recovery are documented in Environments and recovery.