Preloop

The open-source AI agent control plane. See them, govern them, cut their cost.

Preloop is one self-hostable service that sits between your AI agents and everything they reach, so every tool call and every model call is governed, attributed, and visible. Four pillars:

• MCP firewall. Allow, deny, or require approval on any tool call.

• AI model gateway. OpenAI-, Anthropic- and Gemini-compatible ingress, with budgets, allowed-model lists, token accounting, and attribution.

• Policy-as-code with human approvals. YAML plus CEL. Approve from mobile, watch, Slack, Mattermost, email, or the CLI.

• Runtime session observability. One timeline per session: tool calls, model calls, policy, approvals, spend, outcomes.

Onboard existing agents with one command. Talk to long-running ones from the console, phone, or watch. Deploy event-driven automations when GitHub, GitLab, Jira, or a webhook fires. Works with OpenClaw, Claude Code, Codex CLI, Cursor, Gemini CLI, Hermes, OpenCode, Windsurf, and any MCP-compatible agent.

Flow presets can review pull requests, implement issues, scan for vulnerabilities, collect machine evidence for CRA- and EU AI Act-style reviews (SBOM verify, exploit check); Runtime Observability keeps the session timeline next to it. That is not a conformity assessment, certification, or legal advice. Presets: security audit presets.

Your first five minutes, start to finish:

# 1. Install the CLI (macOS / Linux)
curl -fsSL https://preloop.ai/install/cli | sh

# Windows (PowerShell): irm https://preloop.ai/install/cli.ps1 | iex
# Details: docs/windows-cli.md

# 2. Connect it to a control plane
preloop signup                                # Preloop Cloud (fastest), or
preloop login --url http://localhost:3000    # your self-hosted instance

# 3. Bring local agents under governance
preloop agents discover

preloop agents discover finds local agent configs, imports representable MCP servers and model metadata, mints managed credentials, and rewrites supported agents so tool calls go through the MCP Firewall and model traffic through the Gateway. For Talk (operator commands), the CLI can install the runtime plugin (preloop agents install-plugin, or preloop claude for Claude Code). The plugin is what keeps the control channel connected.

Pi and DeepSeek Harness support CLI onboarding, gateway routing, native tool approvals, active-session remote control, and ephemeral flows. Onboard with preloop agents onboard Pi --approvals or preloop agents onboard "DeepSeek Harness" --approvals.

Watch it work

Onboarding, the MCP firewall, human approvals, and cutting session cost. Recorded against a real stack, no slideware.

Guides: docs.preloop.ai. Start here: onboard local agents (60s).

A run in progress is not out of reach. Operator notes let an identified human (or, with an opt-in tool, another agent) steer a running agent: the note is delivered at the next turn boundary through the gateway or a hook, costs nothing when there is none, and is recorded with who sent it. Send one from the console, the API, or preloop notes send. The account kill switch goes the other way: it blocks gateway and tool traffic, freezes pending approval deadlines, and requests termination of active managed flow executions, with audited staged recovery.

Finished runs stay searchable, in the console, from preloop sessions search, and by an agent that has been given the search_sessions tool. Keyword ranking is always available, semantic and hybrid ranking are a per-account opt-in, every search is audited, and a question worth repeating can be saved under a name. Two exports turn the agent inventory and the failure record into files an auditor can read: DORA: the AI-agent slice. They feed an Art. 8 inventory and an Art. 28 register, and list Art. 17 incident candidates. Classification stays with your firm, and Preloop covers the agent slice of the ICT estate only.

Related MCP server: SentinelGate

What you get

Jobs teams otherwise buy from several vendors, in one Apache 2.0 stack:

Upstream providers include OpenAI, Anthropic, Google, AWS Bedrock, Alibaba Cloud Model Studio (Qwen), DeepSeek, Mistral, Moonshot (Kimi), Z.ai (GLM), OpenRouter, and any OpenAI-compatible endpoint you configure. Reviewed model pricing distributes verified tariffs to gateway, API, and worker processes, and Alibaba tariffs preserve regional and cache-policy differences. The weekly review preset prepares tested pricing PRs after you bind its repository and model; historical repricing is a separate operation. Models or billing modes without verified rates remain visibly unpriced. OTLP export is off by default; turn it on and governed model calls and MCP tool calls emit OpenTelemetry GenAI spans to any OTLP backend, without replacing the spend ledger.

AI Agent → Preloop → [Policy]  → Allow / Deny / Require Approval → Execute
                   → [Gateway] → Budget + attribution             → Model

Connect GitHub, GitLab, or Jira as flow triggers and issue tools. Automations ship as presets, including the Issue Triage Assistant, Pull Request Reviewer and Observe / Eval. Or write your own. A flow can also start another flow of the same account as a child of itself, and the execution page shows the resulting tree: flow delegation. Automated issue implementation can resume its PR branch and native agent conversation after review or CI feedback, with durable turn budgets and current-head gates. A finished run whose PR publication was not recorded can be recovered by explicitly selecting and verifying its published PR and branch; when the native checkpoint is unavailable, follow-up requires acknowledgment that it starts a fresh conversation.

CI can trigger a flow too: the run-flow GitHub Action (.github/actions/run-flow) starts a flow from a workflow job, streams the execution log, and fails the job on the execution's verdict. Where the agent container runs is your choice. Private runners run it on your own machines over an outbound WebSocket, with no inbound ports: preloop runner fg holds several executions at once (default 2), and --once --ephemeral is a one-shot runner that exists for a single CI job.

Policy-as-code

version: "1.0"
metadata:
  name: "Production Safeguards"

approval_workflows:
  - name: "deploy-approval"
    timeout_seconds: 600
    required_approvals: 1
    async_approval: true

tools:
  - name: "bash"
    source: mcp
    approval_workflow: "deploy-approval"
    justification: required
    conditions:
      - expression: "args.command.contains('deploy') && args.command.contains('production')"
        action: require_approval

Ship it with preloop policy apply <file> (validate / diff / export also exist).

Talk details for OpenClaw, Hermes, and Claude Code: OpenClaw, Hermes, runtime adapters.

Getting started

The CLI is a client. It talks to a control plane: Preloop Cloud or a stack you run.

Cloud (fastest)

curl -fsSL https://preloop.ai/install/cli | sh
preloop signup
preloop agents discover

Self-host (Docker Compose, data stays on your machine)

curl -fsSL https://preloop.ai/install/oss | sh
curl -fsSL https://preloop.ai/install/cli | sh
preloop login --url http://localhost:3000
preloop agents discover

Console: http://localhost:3000. The CLI stores the instance URL in ~/.preloop/config.yaml. Without --url or PRELOOP_URL, it defaults to https://preloop.ai.

Public TLS, SMTP (approvals, invites, password resets), upgrades, and Kubernetes: Install the OSS stack, TLS, Upgrading. Helm chart: helm/preloop (private cluster). Docker Compose and Helm are the supported install surfaces; this repository does not ship Terraform modules.

Production self-host: SECRET_KEY is required or the app refuses to start. Telemetry is a daily pseudonymous version check-in; set PRELOOP_DISABLE_TELEMETRY=true to disable. Event list: SECURITY.md.

Working in this repository

This file is the product intro. It is not the architecture and not the coding contract.

Do not load this README plus ARCHITECTURE.md end-to-end "for context." Pick the row above.

Open-source alternative to AWS Bedrock AgentCore

Same core jobs (runtime, gateway, identity, observability, policy), vendor-neutral and self-hostable. Full comparison: preloop.ai/vs/aws-agentcore.

Also compare: LiteLLM, Portkey, Helicone, MintMCP, Lunar, Runlayer, Zenity.

Editions

Unqualified Preloop is this repository (Apache 2.0, self-hosted). Preloop Cloud is the hosted service at preloop.ai. Preloop Enterprise is the commercial self-hosted edition.

Cloud is managed hosting. Cloud and Enterprise include support plans. Cloud billing owners can compare the available usage from the previous three completed months in Account settings before requesting a plan-change quote. Missing history is labeled explicitly; a change requires confirmation of its price, limits and effective date. Cloud plan limits do not apply to the open-source self-hosted edition.

Governance itself is open source: every model provider, flows, private runners, session search, operator notes, single-approver workflows and budgets scoped to the account, a flow, an API key or a managed agent all ship in this repository. What is commercial is the organizational layer on top of them: more than one approver, quorum, escalations, budgets scoped to a user or a team, budget notification routing, and users, teams and RBAC on one account. Cloud usage allowances and hosted credits are a separate thing from governance budgets.

A self-hosted OSS instance is one operator per account. Public signup, if left on, creates a separate account, not a teammate. Invitations, users, teams, and permission roles ship with Cloud and Enterprise.

Enterprise licensing: sales@preloop.ai.

Community

Discord for help, feedback, and the founder's build log.

Contributing

See CONTRIBUTING.md.

The disposable capacity lab measures authenticated MCP, model-gateway and execution-log workloads using local simulated providers.

License

Apache License 2.0. Copyright (c) 2026 Spacecode AI Inc.

Release assets carry signed Sigstore build provenance and checksums. See verification instructions.

Windows CLI release binaries pass a required Defender scan and ten-minute observation before publication. Optional VirusTotal scanning and SignPath Authenticode signing provide additional release checks; signing is pending. windows-cli.md, windows-code-signing.md, code-signing-policy.md.

Free code signing provided by SignPath.io, certificate by SignPath Foundation.

Execution environment profiles and hosted checkpoint recovery are documented in Environments and recovery.