Preloop MCP
Preloop is an open source agent control plane: an MCP firewall, a budgeted model gateway and event-driven agent runs.
- 96 ★ on the repository
- Last commit
- Apache-2.0
Broad access
Why this level
- The service sees and routes tool and model calls of every connected agent.
- The software factory runs agents with access to repositories and trackers.
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add mcp/preloopDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- The service sees and routes tool and model calls of every connected agent.
- The software factory runs agents with access to repositories and trackers.
This is third-party code. Review the repository files before installing.
What it does
Preloop installs as one service between your agents and everything they reach. Every tool and model call passes the rules, gets an owner and lands on a single session timeline. The MCP firewall allows, denies or holds a call for human approval; the model gateway counts spend by model, agent, session, key and flow and caps it with budgets. Rules are written as code in YAML and CEL. The second half, the software factory, runs agents in containers or on your runners when GitHub, GitLab, Bitbucket Cloud, Jira, a webhook or a CI job fires: pull request review, issue implementation, ticket triage, vulnerability scans. Results arrive as pull requests. `preloop agents discover` finds local agent configurations and `preloop agents onboard` connects them.
Who it is for. Platform and security teams that want agents under policy and visible spend before production.
Good fit when
- A risky tool call is held until a person approves it.
- You need a spend report on models by agent, session and key, with limits.
- A Jira ticket starts an agent and the result arrives as a pull request.
- All local agents of a team connect to one gateway and log.
- The course of a running agent is steered from the console or a phone.
Not a fit when
- You want a ready service with no install: the open source edition is yours to deploy and maintain.
- You need vendor-backed support: you deploy and maintain the open source edition yourself.
- There is one agent and no need for policies or budgets.
Example request
Connect my local agents to Preloop, show which tool calls will pass the firewall and add a rule that holds risky calls until I approve.MCP
- Transport
- http
- Authentication
- API key
Environment variables
SECRET_KEYrequired, secret- Application secret for production; the service will not start without it
Limitations
The open source edition does not separate permissions between users of an account: roles and access control exist in Preloop Cloud and Enterprise. Production needs `SECRET_KEY` or the app will not start, and the Helm chart refuses to install with an empty `environment.jwtSecret`. Installation uses `curl | sh`: read the script before running it. Copilot usage is shown separately as vendor-reported data. Read the credential storage upgrade guide before upgrading.
How to disable. Disable the managed MCP entry with the CLI or remove it from the agent configuration, then stop the stack with `docker compose down` and delete the data volumes if needed.
FAQ
What is an MCP firewall?
A layer that agent tool calls pass through. It allows, denies or holds a call for human approval according to YAML and CEL rules.
Which agents are supported?
Claude Code, Codex CLI, OpenCode, Cursor, Gemini CLI, Hermes, OpenClaw, Devin, Copilot CLI and any MCP client that connects to `/mcp`.
How do I self-host?
Run `curl -fsSL https://preloop.ai/install/oss | sh`: Docker Compose starts and the console is at `http://localhost:3000`. A `helm/preloop` chart exists for Kubernetes.
How does the open source edition differ from the cloud one?
The open edition is free and self-run but has no roles or access control between users. They exist in Preloop Cloud and Enterprise.
Is there a cloud version?
Yes. Preloop Cloud and Preloop Enterprise implement roles and access controls between users. The open source edition has none.
Discussion
No questions or reviews yet.
Related
MCP serversA bridge between local CLI agents: Codex, Cursor or Claude Code delegate work to Antigravity, Grok, Kimi and seven more.
PromptOps keeps Claude Code, Codex and Gemini CLI side by side by project and gives a lead agent MCP to launch helpers
An MCP server that lets Claude Code, Codex and other agents call Gemini, GPT, Grok and local models for review, debugging and consensus
UseAgent’s MCP server sends tasks to remote agents, collects their results and records the runs in an organization’s ledger.
An MCP server and CLI coordinate specialized agents, retain working patterns and connect tasks with project hooks.
Local context compression for agents: tool outputs, logs, files and RAG chunks shrink before reaching the LLM. Proxy, CLI, library and MCP
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Authentication | Repository stars | Main difference |
|---|---|---|---|---|
| Preloop (this card) | yes | API key | 96 | |
| MCP Gateway Registry | no | OAuth | 1,048 | collects and routes MCP servers; Preloop adds YAML and CEL policies, human approval and model budgets |
| Agentgateway | yes | OAuth | 6,144 | a gateway for agent traffic; Preloop joins it with agent runs triggered by ticket and CI events |
README in short
A self-hostable service in two parts: a control plane (firewall, gateway, policies, timeline) and a software factory (flows start agents on events). Apache-2.0 licensed, with a CLI, a Helm chart and a PyPI package.