Preloop vs Runlayer: Open-source MCP security with per-call human approvals

Preloop is the open-source AI agent control plane — an MCP firewall, AI model gateway, per-call human approvals, runtime observability, and a tamper-evident audit trail you can self-host under Apache 2.0. Runlayer is a closed-source, venture-backed MCP-security platform. The honest one-liner: choose Preloop when you need an open, auditable control plane where human-in-the-loop approvals live in the free core.

At a glance

Runlayer is closed-source, so the most concrete, verifiable comparison is on openness, self-hostability, and where the human-approval primitive lives.

What Runlayer does well

Runlayer is a well-funded entrant in the MCP-security space — reported to have raised roughly $11M from Khosla and Felicis with several large customers engaged before launch. That kind of backing and early traction signals a serious, fast-moving team.

• Category momentum. Strong funding and named early adopters give it visibility in the MCP-security conversation.
• Focused MCP-security positioning. The product centers on securing agent tool calls, which keeps the evaluation surface narrow for buyers shopping specifically for that.
• Managed offering. Teams that want a vendor to operate the platform for them get a hosted path.

If you want a closed, vendor-operated MCP-security SaaS and the open-source/self-host question is not a constraint, Runlayer is a credible option.

Where Preloop is different

Preloop overlaps with Runlayer on MCP tool-call security, but it is a different shape of product: an open-source, self-hostable control plane whose differentiator is the human-approval primitive itself.

• Open source and self-hostable. Preloop's core is Apache 2.0. You can run it in your own VPC, on-prem, or air-gapped, and you can read, fork, and audit the enforcement code rather than trusting a black box. There is no requirement to route agent traffic through a third-party SaaS.
• Per-call human approvals in the free core. When a policy routes a tool call for review, the right person is paged on mobile, Apple Watch, Slack, Mattermost, email, or a custom webhook — with the tool, arguments, agent reasoning, and matched policy in front of them. This is the headline capability, and it is not paywalled.
• One control plane, not one layer. Preloop bundles the MCP firewall with an OpenAI/Anthropic-compatible model gateway (budgets and per-agent attribution), runtime session observability, and a tamper-evident audit ledger. You do not stitch a security product, a gateway, an approvals tool, and an observability vendor together.
• preloop agents discover for local coding agents. One command enrolls Claude Code, Codex CLI, Cursor, Gemini CLI, OpenClaw, and OpenCode on a developer's machine — no SDK changes, no per-repo setup.
• Policy-as-code with CEL. Ordered YAML rules with CEL expressions evaluate tool arguments, not just tool names, and version-control alongside the rest of your infrastructure.

When to choose Runlayer

• You want a closed, vendor-operated MCP-security SaaS and have no open-source or self-host requirement.
• Your evaluation is scoped strictly to MCP tool-call security, separate from model traffic, approvals UX, and audit evidence.
• You prefer to buy from a venture-backed vendor with a hosted-only deployment.

When to choose Preloop

• Platform and DevEx teams rolling out Claude Code, Codex CLI, Cursor, Gemini CLI, OpenClaw, or OpenCode who need to govern local agents without changing developer workflows.
• Security teams in regulated SaaS that need an on-prem or VPC-deployable control plane they can read and audit, with searchable evidence inside their own network.
• Teams whose core requirement is human-in-the-loop approvals — selective, policy-driven, context-rich review of risky tool calls, in the free core rather than behind an enterprise tier.
• Open-source-first organizations that will not adopt a closed-source enforcement layer.
• Teams building EU AI Act readiness evidence that want durable records of matched policy, approver, justification, inputs, and outcomes in a self-hostable platform.
• Teams looking for an open-source alternative to closed MCP-security vendors without losing approvals, gateway, or observability.

FAQ

Is there an open-source alternative to Runlayer? Yes. Preloop is an open-source AI agent control plane released under Apache 2.0. It includes an MCP firewall with policy-as-code, per-call human-in-the-loop approvals, an AI model gateway with budgets, runtime observability, and a tamper-evident audit trail — and it is self-hostable.

Can I self-host my MCP security layer? Yes, with Preloop. The core is Apache 2.0 and runs on your own infrastructure, including private VPC, on-prem, and air-gapped environments where routing agent traffic to a third-party SaaS is not acceptable.

Does Preloop require approvals to be a paid feature? No. Per-call human approvals are part of the free open-source core. Reviewers get the tool, arguments, agent reasoning, and matched policy on mobile, watch, Slack, Mattermost, email, or a custom webhook.

Which AI coding agents does Preloop govern? Claude Code, Codex CLI, Cursor, Windsurf, Gemini CLI, Cline, OpenClaw, OpenCode, and any other MCP-compatible client or runtime.

How do I onboard existing agents to Preloop? Install the Preloop CLI and run preloop agents discover. Preloop finds local Claude Code, Codex CLI, Cursor, Gemini CLI, OpenClaw, and OpenCode configurations, backs them up, and rewrites them to route through Preloop.

Try Preloop

• Start your free trial
• Book a demo
• Preloop on GitHub