Preloop

The open-source AI agent control plane. See them, govern them, cut their cost.

Preloop is a single self-hostable platform: an MCP firewall for tool access, an AI model gateway for cost, safety and attribution, policy-as-code with human approvals, and runtime session observability.

Flow presets can collect machine evidence for CRA- and EU AI Act-style reviews (SBOM verify, exploit check); Runtime Observability keeps the session timeline next to it. That is not a conformity assessment, certification, or legal advice. Presets: security audit presets.

Onboard existing agents with one command. Talk to long-running ones from the console, phone, or watch. Deploy event-driven automations when GitHub, GitLab, Jira, or a webhook fires. Works with OpenClaw, Claude Code, Codex CLI, Cursor, Gemini CLI, Hermes, OpenCode, Windsurf, and any MCP-compatible agent.

# 1. Install the CLI (macOS / Linux)
curl -fsSL https://preloop.ai/install/cli | sh

# Windows (PowerShell): irm https://preloop.ai/install/cli.ps1 | iex
# Details: docs/windows-cli.md

# 2. Connect it to a control plane
preloop signup                                # Preloop Cloud (fastest), or
preloop login --url http://localhost:3000    # your self-hosted instance

# 3. Bring local agents under governance
preloop agents discover

`preloop agents discover` finds local agent configs, imports representable MCP servers and model metadata, mints managed credentials, and rewrites supported agents so tool calls go through the MCP Firewall and model traffic through the Gateway. For Talk (operator commands), the CLI can install the runtime plugin (`preloop agents install-plugin`, or `preloop claude` for Claude Code). The plugin is what keeps the control channel connected.

Watch it work

Onboarding, the MCP firewall, human approvals, and cutting session cost. Recorded against a real stack, no slideware.

Guides: docs.preloop.ai. Start here: onboard local agents (60s).

What you get

Jobs teams otherwise buy from several vendors, in one Apache 2.0 stack:

AI Agent → Preloop → [Policy]  → Allow / Deny / Require Approval → Execute
                   → [Gateway] → Budget + attribution             → Model

Connect GitHub, GitLab, or Jira as flow triggers and issue tools. Automations ship as presets, including the Pull Request Reviewer and Observe / Eval. Or write your own.

Policy-as-code

version: "1.0"
metadata:
  name: "Production Safeguards"

approval_workflows:
  - name: "deploy-approval"
    timeout_seconds: 600
    required_approvals: 1
    async_approval: true

tools:
  - name: "bash"
    source: mcp
    approval_workflow: "deploy-approval"
    justification: required
    conditions:
      - expression: "args.command.contains('deploy') && args.command.contains('production')"
        action: require_approval

Ship it with `preloop policy apply ` (`validate` / `diff` / `export` also exist).

Talk details for OpenClaw, Hermes, and Claude Code: OpenClaw, runtime adapters.

Getting started

The CLI is a client. It talks to a control plane: Preloop Cloud or a stack you run.

Cloud (fastest)

curl -fsSL https://preloop.ai/install/cli | sh
preloop signup
preloop agents discover

Self-host (Docker Compose, data stays on your machine)

curl -fsSL https://preloop.ai/install/oss | sh
curl -fsSL https://preloop.ai/install/cli | sh
preloop login --url http://localhost:3000
preloop agents discover

Console: `http://localhost:3000`. The CLI stores the instance URL in `~/.preloop/config.yaml`. Without `--url` or `PRELOOP_URL`, it defaults to `https://preloop.ai`.

Public TLS, SMTP (approvals, invites, password resets), upgrades, and Kubernetes: Install the OSS stack, TLS, Upgrading. Helm chart: `helm/preloop` (private cluster). Docker Compose and Helm are the supported install surfaces; this repository does not ship Terraform modules.

Production self-host: `SECRET_KEY` is required or the app refuses to start. Telemetry is a daily pseudonymous version check-in; set `PRELOOP_DISABLE_TELEMETRY=true` to disable. Event list: SECURITY.md.

Working in this repository

This file is the product intro. It is not the architecture and not the coding contract.

Do not load this README plus ARCHITECTURE.md end-to-end "for context." Pick the row above.

Open-source alternative to AWS Bedrock AgentCore

Same core jobs (runtime, gateway, identity, observability, policy), vendor-neutral and self-hostable. Full comparison: preloop.ai/vs/aws-agentcore.

Also compare: LiteLLM, Portkey, Helicone, MintMCP, Lunar, Runlayer, Zenity.

Editions

Unqualified Preloop is this repository (Apache 2.0, self-hosted). Preloop Cloud is the hosted service at preloop.ai. Preloop Enterprise is the commercial self-hosted edition.

Cloud is managed hosting. Cloud and Enterprise include support plans.

A self-hosted OSS instance is one operator per account. Public signup, if left on, creates a separate account, not a teammate. Invitations, users, teams, and permission roles ship with Cloud and Enterprise.

Enterprise licensing: sales@preloop.ai.

Community

Discord for help, feedback, and the founder's build log.

Contributing

See CONTRIBUTING.md.

License

Apache License 2.0. Copyright (c) 2026 Spacecode AI Inc.

Windows CLI release binaries: `SHA256SUMS` plus a VirusTotal scan; SignPath Authenticode signing is pending. windows-cli.md, windows-code-signing.md, code-signing-policy.md.

Free code signing provided by SignPath.io, certificate by SignPath Foundation.