Preloop vs LiteLLM: agent control plane vs AI gateway

Preloop is the open-source AI agent control plane: an MCP firewall, AI model gateway, human approvals, cost analytics, runtime observability, and audit trail in one self-hostable platform. LiteLLM is a widely adopted open-source AI gateway: one API for 100+ LLMs with keys, budgets, rate limits, guardrails, MCP and agent gateways, and logging integrations, now with a Rust gateway core.

The honest one-liner: LiteLLM governs model traffic; Preloop governs agents. The gateway is LiteLLM's whole product; for Preloop it is one part of a control plane. In fact, Preloop's gateway embeds the LiteLLM Python library for provider translation, so the difference isn't proxy plumbing. The difference is everything an agent does that never touches chat/completions: the shell command, the file write, the tool call, and who gets to approve it.

At a glance

What LiteLLM does well

LiteLLM is a genuinely strong gateway, and it would be silly to pretend otherwise:

• Breadth and maturity. 1B+ requests served, 240M+ Docker pulls, 140+ LLM providers, and more than 60,000 GitHub stars. As proxy infrastructure it is battle-tested at a scale few products reach.
• Low overhead. Its new Rust gateway adds, by LiteLLM's own benchmark, 0.66 ms at p99 (litellm.ai).
• Provider routing depth. Fallbacks, load balancing, and consistent request shapes across many providers.
• Ecosystem integrations. First-class exporters for Datadog, OpenTelemetry, Prometheus, Langfuse, and the rest of the LLM-ops landscape.
• Extras a pure proxy buyer wants. Prompt management, batch APIs, pass-through endpoints.

If your job description is "put one URL in front of every LLM provider, enforce budgets per team, and ship logs to my observability stack," pick LiteLLM and be happy.

Where Preloop is different

• The unit of governance is the tool call, not the API key. LiteLLM decides who may call which model within what budget. Preloop additionally decides what the agent may do: its MCP firewall evaluates every tool call against ordered policy rules (allow / deny / require approval / require justification, with CEL conditions), and native action gates route even native tool calls (Claude Code's Bash and Edit, Codex shell commands) through the same pipeline. The dangerous thing an agent does rarely arrives via chat/completions; it arrives via the command the completion suggested.
• A human can be in the loop. When policy requires it, the action pauses and a reviewer gets full context and a one-tap decision on their phone, watch, or Slack, async-safe so the agent isn't held open on a network hook. LiteLLM's safety model is automated guardrails; there is no person in its loop.
• Onboarding is two commands. preloop agents discover finds existing local agent configs; preloop agents onboard backs them up and routes MCP and model traffic through Preloop. No SDK changes, no per-app proxy configuration.
• Sessions, not requests. One timeline per agent session (every model call, tool call, matched policy, approver, and dollar) with replay. That's operational evidence you can hand to a security review, not a log stream you still have to reconstruct.
• Cost you can defend. Both products count tokens. Preloop also marks subscription-covered traffic (Claude Code and ChatGPT subscriptions) as subscription usage instead of API spend, keeps models without verified prices visibly unpriced rather than guessing, and, in Preloop Cloud and Preloop Enterprise, reconciles its estimates against the provider's own billing APIs and adds session optimization.
• Steering running agents. Operator notes let an identified person steer a running agent at its next turn, recorded with the sender; the account kill switch stops gateway and tool traffic with audited recovery.

When to choose LiteLLM

• You need a high-scale, multi-provider LLM proxy with routing depth, and nothing on the tool path.
• Your observability stack is settled and you want per-request logs shipped into it.
• You don't need human approvals, MCP policy, or session-level audit in the same product.

When to choose Preloop

• Platform and DevEx teams rolling out Claude Code, Codex CLI, Cursor, Gemini CLI, OpenClaw, or OpenCode who must control what those agents do, not only which model they call.
• Security teams in regulated environments that need self-hostable tool governance, human approvals, and searchable audit evidence next to the model gateway, including EU AI Act readiness evidence.
• FinOps-minded teams that want spend attributed per agent and session, reconciled against provider invoices, and actionable, not just counted.
• Teams standardizing on one control plane instead of stitching a proxy, an approvals bot, an observability product, and an audit trail together.

Adoption notes

Preloop and LiteLLM coexist well: Preloop already embeds the LiteLLM library internally. A common pattern keeps LiteLLM as the upstream model router (for its provider breadth) with Preloop's gateway in front of it applying tool policy, approvals, budgets, and audit:

1. Run preloop agents onboard on a developer's machine to enroll one coding agent.
2. Point that agent's model traffic at Preloop; configure your LiteLLM deployment as an OpenAI-compatible upstream in Preloop.
3. Start with observability and approvals; introduce deny rules and budgets incrementally.

FAQ

Is Preloop an alternative to LiteLLM? For the gateway layer, yes: Preloop ships an OpenAI-, Anthropic- and Gemini-compatible gateway with budgets and attribution. But Preloop's scope is the whole agent: MCP tool policy, native-tool approvals, session observability, cost reconciliation, and audit. Teams that only need a proxy should use LiteLLM.

Can I use LiteLLM and Preloop together? Yes: Preloop in front, LiteLLM as the upstream provider router. Preloop even embeds the LiteLLM library for provider translation, so compatibility is structural, not incidental.

Does Preloop have budgets and rate limits like LiteLLM? Yes: account, flow, API-key, and agent budgets in the open-source core, plus user and team budgets in Cloud and Enterprise, checked before dispatch and attributed per session.

How is Preloop's cost tracking different? Preloop treats cost as evidence: streaming-accurate token accounting with cache and reasoning-token breakdowns, reviewed model pricing with a standard update path, subscription attribution for OAuth-covered traffic, and (Cloud and Enterprise) reconciliation against provider billing APIs.

Is Preloop open source? Yes. The core (gateway, MCP firewall, approvals, budgets, cost overview, session observability) is Apache 2.0 and self-hostable. Preloop Cloud and Preloop Enterprise add RBAC, team approvals with quorum, price overrides, reconciliation, and session optimization. (LiteLLM similarly gates SSO/RBAC and advanced features behind its enterprise tier.)

What is preloop agents discover? A read-only CLI command that scans a developer's machine for local Claude Code, Codex CLI, Cursor, Gemini CLI, OpenClaw, OpenCode, and other agent configurations and reports what each supports. preloop agents onboard then backs up and rewrites the supported ones to route through Preloop. No SDK changes.

Try Preloop

• Start your free trial
• Book a demo
• Preloop on GitHub

Last reviewed: 2026-10-08.