Preloop vs LiteLLM: agent control plane vs AI gateway

Preloop is the open-source AI agent control plane — an MCP firewall, AI model gateway, human approvals, cost analytics, runtime observability, and audit trail in one self-hostable platform. LiteLLM is a widely adopted open-source AI gateway: a proxy for 100+ LLM providers with keys, budgets, rate limits, guardrails, and logging integrations.

The honest one-liner: LiteLLM governs model traffic; Preloop governs agents. The gateway is LiteLLM's whole product — for Preloop it is one part of a control plane. In fact, Preloop's gateway embeds the LiteLLM Python library for provider translation, so the difference isn't proxy plumbing. The difference is everything an agent does that never touches chat/completions: the shell command, the file write, the tool call — and who gets to approve it.

At a glance

What LiteLLM does well

LiteLLM is a genuinely strong gateway, and it would be silly to pretend otherwise:

• Breadth and maturity. 1B+ requests served, 240M+ Docker pulls, Fortune 500 and federal deployments, SOC2/FedRAMP-ready posture — as proxy infrastructure it is battle-tested at a scale few products reach.
• Provider routing depth. Fallbacks, load balancing, and consistent request shapes across 100+ providers.
• Ecosystem integrations. First-class exporters for Datadog, OpenTelemetry, Prometheus, Langfuse, and the rest of the LLM-ops landscape.
• Extras a pure proxy buyer wants. Prompt management, batch APIs, pass-through endpoints.

If your job description is "put one URL in front of every LLM provider, enforce budgets per team, and ship logs to my observability stack," pick LiteLLM and be happy.

Where Preloop is different

• The unit of governance is the tool call, not the API key. LiteLLM decides who may call which model within what budget. Preloop additionally decides what the agent may do: its MCP firewall evaluates every tool call against ordered policy rules (allow / deny / require approval / require justification, with CEL conditions), and per-agent adapters route even native tool calls — Claude Code's Bash and Edit, Codex shell commands — through the same pipeline. The dangerous thing an agent does rarely arrives via chat/completions; it arrives via the command the completion suggested.
• A human can be in the loop. When policy requires it, the action pauses and a reviewer gets full context and a one-tap decision on their phone, watch, or Slack — async-safe so the agent isn't held open on a network hook. LiteLLM's safety model is automated guardrails; there is no person in its loop.
• Onboarding is one command. preloop agents discover finds existing local agent configs, backs them up, and rewrites them to route MCP and model traffic through Preloop. No SDK changes, no per-app proxy configuration.
• Sessions, not requests. One timeline per agent session — every model call, tool call, matched policy, approver, and dollar — with replay. That's operational evidence you can hand to a security review, not a log stream you still have to reconstruct.
• Cost you can defend. Both products count tokens. Preloop also prices subscription-covered traffic (Claude Code Max, ChatGPT plans) at its true $0 marginal cost while tracking the API-equivalent value, self-heals prices for brand-new models, and — in Preloop Cloud and Preloop Enterprise — reconciles its estimates against the provider's own billing APIs with drift alerts, and generates optimization recommendations whose savings are measured, not guessed.
• Live Agent Control. An audited operator channel into long-running agents: send instructions, interrupt, recover missed commands after reconnects — with every command persisted and attributable.

When to choose LiteLLM

• You need a high-scale, multi-provider LLM proxy with routing depth, and nothing on the tool path.
• Your observability stack is settled and you want per-request logs shipped into it.
• You don't need human approvals, MCP policy, or session-level audit in the same product.

When to choose Preloop

• Platform and DevEx teams rolling out Claude Code, Codex CLI, Cursor, Gemini CLI, OpenClaw, or OpenCode who must control what those agents do, not only which model they call.
• Security teams in regulated environments that need self-hostable tool governance, human approvals, and searchable audit evidence next to the model gateway — including EU AI Act readiness evidence.
• FinOps-minded teams that want spend attributed per agent and session, reconciled against provider invoices, and actionable — not just counted.
• Teams standardizing on one control plane instead of stitching a proxy, an approvals bot, an observability product, and an audit trail together.

Adoption notes

Preloop and LiteLLM coexist well — remember, Preloop already speaks LiteLLM's language internally. A common pattern keeps LiteLLM as the upstream model router (for its provider breadth) with Preloop's gateway in front of it applying tool policy, approvals, budgets, and audit:

1. Run preloop agents discover on a developer's machine to enroll one coding agent.
2. Point that agent's model traffic at Preloop; configure Preloop's upstream to your LiteLLM deployment.
3. Start with observability and approvals; introduce deny rules and budgets incrementally.

FAQ

Is Preloop an alternative to LiteLLM? For the gateway layer, yes — Preloop ships an OpenAI/Anthropic-compatible gateway with budgets and attribution. But Preloop's scope is the whole agent: MCP tool policy, native-tool approvals, session observability, cost reconciliation, and audit. Teams that only need a proxy should use LiteLLM.

Can I use LiteLLM and Preloop together? Yes — Preloop in front, LiteLLM as the upstream provider router. Preloop even embeds the LiteLLM library for provider translation, so compatibility is structural, not incidental.

Does Preloop have budgets and rate limits like LiteLLM? Yes: account, flow, API-key, agent, and per-user budgets with hard/soft limits and period windows (hourly through yearly), enforced before dispatch and attributed per session.

How is Preloop's cost tracking different? Preloop treats cost as evidence: streaming-accurate token accounting with cache and reasoning-token breakdowns, deterministic vendored pricing with a standardized update path, subscription-aware $0 pricing for OAuth-covered traffic, and (Enterprise) reconciliation against OpenAI's and Anthropic's own billing APIs with drift alerting.

Is Preloop open source? Yes. The core — gateway, MCP firewall, approvals, budgets, cost overview, session observability — is Apache 2.0 and self-hostable. Preloop Cloud and Preloop Enterprise add RBAC, team approvals with quorum, price overrides, reconciliation, and session optimization. (LiteLLM similarly gates SSO/RBAC and advanced features behind its enterprise tier.)

What is preloop agents discover? A CLI command that scans a developer's machine, finds local Claude Code, Codex CLI, Cursor, Gemini CLI, OpenClaw, and OpenCode configurations, backs them up, and rewrites them to route through Preloop. No SDK changes.

Try Preloop

• Start your free trial
• Book a demo
• Preloop on GitHub