Preloop vs agentgateway: agent control plane vs agent data plane

Preloop is the open-source AI agent control plane: an MCP firewall, AI model gateway, human approvals, cost analytics, runtime observability, and audit trail in one self-hostable platform. agentgateway is an open source, Rust-based proxy, a Linux Foundation project that has joined the Agentic AI Foundation, created by Solo.io: one high-performance data plane for service, LLM, MCP, and agent-to-agent traffic.

The honest one-liner: agentgateway governs agent traffic; Preloop governs agents. Both are Apache 2.0 and self-hosted, and they sit at different layers of the same stack. agentgateway is the network hop: it routes, authenticates, rate-limits, and observes every request in flight, faster than almost anything else in the space. Preloop is the control loop around the agent itself: which tool call needs a human to approve it, what happened across an entire session, what a team actually spent. The dangerous thing an agent does is rarely a malformed packet. It is a well-formed request that nobody was asked about.

At a glance

What agentgateway does well

agentgateway is serious infrastructure, and it would be silly to pretend otherwise:

• Performance. It is written in Rust and its published benchmarks show roughly 37,000 QPS with sub-2 ms P99 latency and under 30 MB of memory, holding sub-millisecond P99 at a fixed 3,000 QPS. As proxy overhead goes, this is about as low as it gets.
• Protocol breadth. One binary handles plain HTTP/gRPC/TCP service traffic, LLM provider routing, MCP, and agent-to-agent (A2A) communication. If your agents talk to each other, agentgateway is one of the very few gateways that speaks A2A natively.
• Kubernetes-native. A built-in controller with Gateway API support, CRDs, and Helm charts, plus a standalone binary and Docker image for everything that is not a cluster.
• Neutral governance. It is a Linux Foundation project that has joined the Agentic AI Foundation, with contributing companies including Microsoft, AWS, Alibaba, Adobe, Cisco, and Salesforce listed on its site. That is a credible answer to the "what if the vendor pivots" question.
• Inline safety tooling. Guardrails with regex, OpenAI moderation, AWS Bedrock Guardrails, Google Model Armor, and custom webhooks, prompt guards, and rate limiting, applied in the request path.

If your job description is "give the cluster one fast, policy-aware front door for service, LLM, MCP, and A2A traffic," pick agentgateway and be happy.

Where Preloop is different

• The unit of governance is the decision, not the packet. agentgateway decides whether a request may pass: which identity, which tool, which rate. Preloop decides what happens around that request: its MCP firewall evaluates every tool call against ordered policy rules (allow / deny / require approval / require justification, with CEL conditions), and when policy says a human decides, the call waits for one.
• A human can be in the loop. agentgateway's controls are automated: CEL rules, guardrails, external authorization services. Preloop pauses the action and gives a reviewer full context and a one-tap decision on their phone, watch, or Slack, async-safe so the agent is not held open on a network hook. For the class of actions where "a model-armor check passed" is not enough, this is the difference that matters.
• Native tool calls are on the policy path. Claude Code's Bash and Edit, Codex shell commands: these execute locally and never transit any network gateway, agentgateway included. Preloop's native action gates route them through the same approval pipeline as MCP calls.
• Sessions, not requests. agentgateway emits excellent per-request telemetry over OpenTelemetry. Preloop builds one timeline per agent session: every model call, tool call, matched policy, approver, and dollar, with replay. That is evidence you hand to a security review, not a stream you still have to reconstruct.
• Onboarding is two commands. preloop agents discover finds existing local agent configs; preloop agents onboard backs them up and routes them through Preloop. With a pure data plane, enrolling each agent is your integration project.
• Cost you can defend. Both products attach cost to traffic. Preloop also marks subscription-covered usage (Claude Code and ChatGPT subscriptions) as subscription usage instead of API spend, keeps models without verified prices visibly unpriced rather than guessing, and, in Preloop Cloud and Preloop Enterprise, reconciles estimates against the provider's own billing APIs.
• Steering running agents. Operator notes let an identified person steer a running agent at its next turn, recorded with the sender, and the account kill switch stops gateway and tool traffic with audited recovery.

When to choose agentgateway

• You are a platform team standardizing cluster ingress and east-west traffic, and you want AI protocols handled by the same data plane as everything else.
• You run multi-agent systems that need native A2A routing with identity and tracing on every hop.
• Proxy overhead matters at your scale and you want the fastest MCP/LLM gateway you can benchmark.
• Your governance model is fully automated policy, and human approvals are out of scope.

When to choose Preloop

• Platform and DevEx teams rolling out Claude Code, Codex CLI, Cursor, Gemini CLI, OpenClaw, or OpenCode who must control what those agents do, including the local shell commands no network proxy can see.
• Security teams in regulated environments that need self-hostable tool governance, human approvals, and searchable audit evidence next to the model gateway, including EU AI Act readiness evidence.
• FinOps-minded teams that want spend attributed per agent and session, reconciled against provider invoices, and actionable, not just counted.
• Teams standardizing on one control plane instead of stitching a proxy, an approvals bot, an observability product, and an audit trail together.

Adoption notes

Preloop and agentgateway solve different problems and can coexist cleanly: agentgateway as the cluster's data plane, Preloop at the layer where the agents live. Both sides speak open protocols (Preloop's gateway is OpenAI/Anthropic-compatible; agentgateway fronts providers with an OpenAI-compatible API), so a layered setup is architecturally natural, though we have not shipped a tested integration and will not pretend otherwise. The qualitative pattern:

1. Run preloop agents onboard on a developer's machine to enroll one coding agent; Preloop applies tool policy, approvals, budgets, and session audit.
2. Keep agentgateway as the cluster's front door for service, MCP, and A2A traffic; Preloop's model-traffic upstream can be whatever your platform team already runs behind it.
3. Start with observability and approvals in Preloop; keep network-level authentication, rate limiting, and routing in agentgateway.

FAQ

Is Preloop an agentgateway alternative? At the gateway layer there is overlap: both ship a self-hosted, OpenAI-compatible model gateway with budgets, and both police MCP tool access. But they answer different questions. agentgateway is a data plane: it governs traffic, including plain service traffic and A2A, at very high performance. Preloop is a control plane: human approvals, native tool call governance, per-session audit timelines, and cost reconciliation. Teams that only need a proxy should use agentgateway.

Can I use agentgateway and Preloop together? Architecturally yes: agentgateway as the cluster data plane, Preloop where the agents are. Both are self-hosted and speak open protocols. We have not shipped a tested integration, so treat this as a pattern, not a certified pairing.

Does agentgateway have human-in-the-loop approvals? Not built in. Its policy model is automated: CEL-based RBAC, guardrails, rate limits, and an external authorization hook that delegates allow/deny to a service you write. Preloop ships per-call human approvals in its open-source core, delivered to mobile, watch, Slack, Mattermost, email, or webhook.

Does Preloop route A2A traffic? No. Preloop governs MCP tool calls, native agent tool calls, and OpenAI/Anthropic-format model traffic. If you need agent-to-agent protocol routing, that is agentgateway's territory, and a reason to run both.

Can agentgateway see Claude Code's Bash commands? No network proxy can: native tool calls execute locally and never cross the wire as governable requests. Preloop's native action gates hook them before execution and route them through the same policy and approval pipeline as MCP calls.

Is Preloop open source? Yes. The core (gateway, MCP firewall, approvals, budgets, cost overview, and session observability) is Apache 2.0 and self-hostable. Preloop Cloud and Preloop Enterprise add RBAC, team approvals with quorum, price overrides, reconciliation, and session optimization. agentgateway is likewise Apache 2.0 under Linux Foundation governance.

What is preloop agents discover? A read-only CLI command that scans a developer's machine for local Claude Code, Codex CLI, Cursor, Gemini CLI, OpenClaw, OpenCode, and other agent configurations and reports what each supports. preloop agents onboard then backs up and rewrites the supported ones to route through Preloop. No SDK changes.

Try Preloop

• Start your free trial
• Book a demo
• Preloop on GitHub

Last reviewed: 2026-10-08.