2026-07-28 12:50 UTCIn-site rewrite5 min readUpdated: 2026-07-28 12:55 UTC

Preloop: Open-source control plane for AI agents. See, govern, cut cost

Preloop is an open-source AI agent control plane that unifies an MCP firewall, AI model gateway, policy-as-code, human approvals, runtime observability, and audit trails. It enables one-command onboarding of existing agents and deployment of event-driven automations with governance.

SourceHacker News AIAuthor: dim0r

Uh oh!

There was an error while loading. Please reload this page.

Notifications You must be signed in to change notification settings

Fork 11

Star 40

BranchesTags

Open more actions menu

Folders and files

NameName

Last commit message

Last commit date

Latest commit

History

1,940 Commits

.github

.signpath/artifact-configurations

assets

backend

cli

docs

frontend

helm/preloop

runtime-plugins

scripts

.dockerignore

.env.example

.gitignore

.gitlab-ci.yml

.pre-commit-config.yaml

AGENTS.md

ARCHITECTURE.md

CHANGELOG.md

CLAUDE.md

CODE_OF_CONDUCT.md

CONTRIBUTING.md

Dockerfile

LICENSE

README.md

RELEASING.md

SECURITY.md

TESTING.md

VERSION

cliff.toml

docker-compose.override.yml

docker-compose.release.yaml

docker-compose.yml

glama.json

openapi.yaml

pyproject.toml

start.sh

Repository files navigation

Preloop is the open-source AI agent control plane. It unifies an MCP firewall for tool access, an AI model gateway for cost, safety and attribution, policy-as-code with human approvals, runtime session observability, and audit trails - in a single self-hostable platform.

Use Preloop to onboard existing agents with one command, and to deploy event-driven agentic automations with governed tools and budgets.

Works with OpenClaw, Claude Code, Codex CLI, Cursor, Gemini CLI, Hermes, OpenCode, Windsurf, and any MCP-compatible agent or managed runtime.

Run preloop agents discover and Preloop will find local agent configs, import representable MCP servers and model metadata, mint managed runtime credentials, and rewrite supported agents to route tool calls through the Preloop MCP Firewall and model traffic through the Preloop Gateway. For Agent Control, the CLI provisions the credential/config contract and can delegate plugin installation to the runtime marketplace, but the plugin is what keeps the live control channel connected.

Build automations with templates like the Pull Request Reviewer, or write your own.

Official documentation: Full guides and tutorials at docs.preloop.ai.

Preloop has two parts: the control plane (API, console, MCP firewall, and model gateway — use Preloop Cloud or self-host the open-source stack) and the CLI, which discovers your local agents and onboards them to whichever control plane you connect it to.

1. Install the CLI (macOS / Linux)

curl -fsSL https://preloop.ai/install/cli | sh

Windows (PowerShell):

irm https://preloop.ai/install/cli.ps1 | iex

2. Connect it to a control plane:

preloop signup # Preloop Cloud (fastest), or preloop login --url http://localhost:3000 # your self-hosted instance (see Getting Started)

3. Bring your local agents under governance

preloop agents discover

Windows install, Defender false-positive recovery, go install, and code-signing / VirusTotal status: docs/windows-cli.md, docs/windows-code-signing.md.

Code signing policy

Free code signing provided by SignPath.io, certificate by SignPath Foundation.

Windows CLI release binaries (preloop-windows-amd64.exe, preloop-windows-arm64.exe) on GitHub Releases are Authenticode-signed via SignPath. Full policy (roles, privacy): docs/code-signing-policy.md.

Watch it work

A short series covering onboarding, the MCP firewall, human approvals, and cutting session cost — recorded end to end against a real stack, no slideware.

Watch the full playlist →

What is Preloop?

Preloop is a single open-source platform that covers the five jobs teams otherwise buy from four different vendors:

Capability What it does Alternatives

MCP Firewall Govern every tool call an agent makes. Allow, deny, require approval, require justification. YAML + CEL policies. MintMCP, Lunar.dev MCPX, TrueFoundry MCP Gateway

AI Model Gateway OpenAI- and Anthropic-compatible gateway with per-account/flow budgets, allowed-model lists, token accounting, and runtime attribution. Portkey, Helicone, LiteLLM, Kong AI

Cost Analytics & Budgets Explain model spend by model, agent, session, API key, flow, and user; enforce budgets and inspect optimization opportunities. FinOps dashboards, vendor billing exports

Human Approvals Mobile, watch, Slack, Mattermost, email, or webhook notifications with one-tap decisions and full context. Approve any onboarded agent's tool calls — including native Bash/Edit — not just MCP tools. Async-safe. Custom Slack bots, Peta Desk

Runtime Observability Session-level timeline of tool calls, model calls, policy decisions, approvals, spend, and outcomes across agents. AgentOps, Langfuse, LangSmith

Audit & AI Act Evidence Durable logs with matched policy, approver, inputs, timestamps, and outcome. Ready for security review and EU AI Act work. Credo AI, IBM watsonx.governance

All shipped as Apache 2.0 software that runs on your infrastructure.

Why Preloop?

AI agents like Claude Code, Cursor, and OpenClaw are transforming how we work. But agents now deploy code, touch production data, change infrastructure, and spend money — and traditional IAM, prompt rules, and manual review were never built for that.

Accidental deletions. One wrong command and your production database is gone.

Leaked secrets. API keys pushed to public repos before anyone notices.

Runaway costs. Agents spinning up expensive cloud resources without limits.

Breaking changes. Untested deployments to production at 3am.

Most teams face an impossible choice: give AI full access and move fast (but dangerously), or lock everything down and lose the productivity gains.

Preloop solves this. Govern what agents are allowed to do, route risky actions to the right human, attribute model spend to the right team, and keep a searchable record of every important decision — without rebuilding your stack or instrumenting SDKs.

AI Agent → Preloop → [Policy check] → Allow / Deny / Require Approval → Execute → [Gateway] → Budget + attribution → Model

Core Capabilities

Managed Agent Onboarding (preloop agents discover)

One command discovers and enrolls existing local agents into your control plane.

preloop agents discover

Preloop inspects local configurations for Claude Code, Codex CLI, Cursor, Gemini CLI, Hermes, OpenClaw, OpenCode, and other MCP-compatible runtimes, imports representable MCP servers and model metadata into your account, mints a durable credential, backs up the existing config, and rewrites supported local endpoints to Preloop-managed MCP and gateway URLs. Legacy and current config locations are supported, JSON5/YAML parsing included.

Managed onboarding has two layers: CLI provisioning and runtime behavior. The CLI can create credentials, write preloop.control configuration, and invoke runtime-native plugin installation where the target runtime supports that workflow. It cannot, by itself, make an unmodified agent process stay online for Agent Control. Live OpenClaw/Hermes Agent Control requires the standalone Preloop runtime plugin to be loaded in the agent process.

To make Talk appear for OpenClaw or Hermes, the agent must be active, have a preloop.control block with a valid runtime bearer token, and have the Preloop runtime plugin online. The normal CLI path is:

preloop agents onboard openclaw preloop agents install-plugin openclaw preloop agents validate openclaw

preloop agents onboard hermes preloop agents install-plugin hermes preloop agents validate hermes

After installing the plugin, restart the agent runtime. When the plugin connects to WS /api/v1/agents/control/ws and advertises capabilities, Preloop marks the Agent Control channel verified and the web/mobile Talk controls become available. The plugin-only path uses the same contract: install @preloop-ai/openclaw-plugin or preloop-hermes-plugin, provide a valid preloop.control block, start the runtime, and let the plugin connect.

Don't have the runtime installed yet? preloop agents install-runtime installs it locally and onboards it through Preloop in one step. To route an agent's native tool calls (e.g. Claude Code Bash/Edit) through Preloop approvals, onboard with preloop agents onboard --approvals — or just answer yes when interactive onboarding offers it for supported agents.

Access Policies & Approval Workflows

Define fine-grained access controls for any AI tool or operation. Tools support multiple ordered access rules that evaluate in priority order. When an AI attempts a protected operation, Preloop pauses and notifies you:

Instant notifications via mobile app, email, Slack, Mattermost, or custom webhook.

One-tap approvals from your phone, watch, or desktop — for any onboarded agent's tool calls, including native Bash/Edit actions, not just MCP tools.

Async approval mode lets the agent poll for status instead of blocking network hooks.

Agent questions — beyond allow/deny, agents can call the built-in ask_user tool to ask the operator a question with multiple-choice options and/or a free-text reply, and get the answer back. Rendered as option buttons + an answer field in the mobile and watch apps.

Per-tool justification — require (or optionally request) the agent to explain why a tool is being called.

Full Audit Trail — every action is logged with full context: what was attempted, the matched policy, execution duration, and who approved it.

Policy-as-Code

Define policies in YAML and manage via CLI or API to version-control your safeguards alongside your infrastructure:

Example: Require approval for production deployments

version: "1.0" metadata: name: "Production Safeguards" description: "Require approval before deploying"

approval_workflows:

name: "deploy-approval"

timeout_seconds: 600 required_approvals: 1 async_approval: true

tools:

name: "bash"

source: mcp approval_workflow: "deploy-approval" justification: required conditions:

expression: "args.command.contains('deploy') && args.command.contains('production')"

action: require_approval

AI Model Gateway

Preloop safely routes model traffic on behalf of managed runtimes instead of handing provider credentials to potentially vulnerable agent containers.

OpenAI-compatible (/openai/v1/models, /openai/v1/chat/completions, /openai/v1/responses) and Anthropic-compatible (/anthropic/v1/messages) endpoints with SSE streaming.

Budget enforcement at account, flow, and subject scopes using configurable cost tracking limits.

Allowed-model lists per account, flow, API key, or managed agent.

Usage accounting persisted as a canonical ApiUsage ledger — token usage, estimated cost, runtime-principal attribution, and provider-neutral conversation previews.

Secret custody — provider API keys stay with Preloop; runtimes receive short-lived gateway tokens instead of raw credentials.

Cost Analytics & Budgets

Preloop makes model spend explainable, not just counted. The Console has a dedicated Cost area with subviews that help operators answer:

How much have we spent? Spend, token volume, and request counts over time by model, provider, account, flow, managed agent, runtime session, API key, and user.

Who or what spent it? Attribution from ApiUsage, runtime principals, subject-scoped governance, and session timelines.

Why was it spent? Drill-down from aggregate charts into session transcripts, model-call previews, tool calls, approvals, and flow outcomes.

Was the o

[truncated for AI cost control]