Preloop vs Lunar.dev MCPX: Human approvals in the free core
Preloop is the open-source AI agent control plane — an MCP firewall, AI model gateway, human-in-the-loop approvals, runtime observability, and a tamper-evident audit trail in one self-hostable Apache 2.0 platform. Lunar.dev MCPX is an open-core MCP gateway whose governance-critical features sit in paid tiers. The honest one-liner: choose Preloop when you want the approval and governance primitives in the free core, not gated.
At a glance
| Feature | Preloop | Lunar.dev MCPX |
|---|---|---|
| License | Apache 2.0 (open source core) | Open-core (open-source gateway + paid tiers) |
| Self-hosted option | Yes, on any infrastructure | Yes, but with a heavier footprint |
| Human-in-the-loop approvals | Yes — in the free core | Gated — governance-critical features sit in paid tiers |
| MCP firewall | Yes — allow / deny / require-approval / require-justification | Yes — MCP gateway/proxy |
| Model gateway with budgets | Yes — OpenAI/Anthropic-compatible, per-agent attribution | Out of scope / partial |
| Runtime observability | Yes — session timelines, tool and model calls, spend | MCP traffic focus |
| Audit / evidence | Tamper-evident, append-only ledger | Varies by tier |
| Policy-as-code | Yes — YAML + CEL on tool arguments | Yes — gateway policy |
| Deployment footprint | Lightweight; Docker or Kubernetes | Heavier; Kubernetes-oriented |
| Pricing of governance features | Free in the open-source core | Open-core players in this cluster carry roughly $499–$2,999/mo floors |
| Onboards existing local agents | Yes — preloop agents discover |
No direct equivalent |
| Works with any agent runtime | Yes — Claude Code, Codex CLI, Cursor, Gemini CLI, OpenClaw, OpenCode, any MCP client | MCP clients |
What Lunar.dev MCPX does well
Lunar.dev MCPX is a legitimate open-core MCP gateway with an open-source component, which makes it easy to evaluate without a sales call.
- Open-source starting point. You can stand up the gateway and inspect it before committing.
- MCP-focused. A clean, gateway-shaped product for teams shopping specifically for MCP tool routing and policy.
- Self-hostable. Teams that want to run their own gateway can, on Kubernetes.
If your requirement is an open-core MCP gateway and you are comfortable that the governance-critical features live in paid tiers, Lunar.dev MCPX is a reasonable option.
Where Preloop is different
Preloop and Lunar.dev MCPX both sit in front of MCP tool calls, but they draw the open-core line in different places.
- Approvals and governance in the free core. Preloop's differentiator — per-call human-in-the-loop approvals — is part of the Apache 2.0 free core, not an enterprise upsell. Reviewers get the tool, arguments, agent reasoning, and matched policy on mobile, Apple Watch, Slack, Mattermost, email, or a custom webhook. Selective, policy-driven approvals are available to every user from day one.
- A control plane, not just a gateway. Preloop bundles the MCP firewall with an OpenAI/Anthropic-compatible model gateway (budgets, per-agent attribution), runtime session observability, and a tamper-evident audit ledger — one product, one data model, one dashboard.
- Lighter to run. Preloop runs from Docker or Kubernetes without a heavy cluster prerequisite, which lowers the bar for a platform team to pilot it.
preloop agents discoverfor local agents. One command enrolls Claude Code, Codex CLI, Cursor, Gemini CLI, OpenClaw, and OpenCode on a developer's machine — no SDK changes.- Policy-as-code with CEL. Ordered YAML rules with CEL conditions evaluate tool arguments, not just tool names, and version-control with the rest of your infrastructure.
When to choose Lunar.dev MCPX
- You want an open-core MCP gateway and are comfortable with governance-critical features in paid tiers.
- You already run Kubernetes and a heavier gateway footprint is not a concern.
- Your scope is MCP tool routing, separate from model traffic, approvals UX, and audit evidence.
When to choose Preloop
- Platform and DevEx teams that want human approvals and policy enforcement in the free core, not behind an enterprise paywall.
- Teams rolling out coding agents (Claude Code, Codex CLI, Cursor, Gemini CLI, OpenClaw, OpenCode) who need zero-touch onboarding via
preloop agents discover. - Security teams in regulated SaaS that need a self-hostable control plane with searchable audit evidence inside their own network.
- Engineering teams standardizing on one control plane for MCP governance, model traffic, approvals, and audit — instead of assembling several products.
- Teams building EU AI Act readiness evidence that need durable records of matched policy, approver, justification, and outcomes.
- Teams that want a lightweight footprint without a mandatory Kubernetes cluster to get started.
FAQ
Is there an open-source MCP gateway with approvals in the free core? Yes. Preloop is Apache 2.0 and ships per-call human-in-the-loop approvals as part of the free core, alongside an MCP firewall, AI model gateway, runtime observability, and a tamper-evident audit trail.
Are Preloop's approvals an enterprise-only feature? No. Selective, policy-driven approvals are in the open-source core. Reviewers approve or deny tool calls on mobile, watch, Slack, Mattermost, email, or webhook with full context.
Can I self-host Preloop without Kubernetes? Yes. Preloop runs from Docker for a single-node setup and scales to Kubernetes when you need it, so a platform team can pilot it quickly.
Does Preloop cover model traffic in addition to MCP? Yes. Preloop includes an OpenAI/Anthropic-compatible model gateway with budgets and per-agent, per-flow, and per-key attribution, so you govern tool calls and model spend in one product.
How do I onboard existing agents to Preloop?
Run preloop agents discover. Preloop finds local Claude Code, Codex CLI, Cursor, Gemini CLI, OpenClaw, and OpenCode configurations, backs them up, and rewrites them to route through Preloop.