Preloop vs Runlayer: Open-source MCP security with per-call human approvals

Preloop is the open-source AI agent control plane: an MCP firewall, AI model gateway, per-call human approvals, runtime observability, and a hash-chained audit trail you can self-host under Apache 2.0. Runlayer is a venture-backed, commercial "AI Control Plane" for enterprise AI enablement: a governed MCP gateway and catalog, shadow AI discovery, runtime security models, and AI spend management. The honest one-liner: Runlayer is a broad enterprise AI enablement platform; choose Preloop when you need an open, auditable control plane where human approval of individual risky actions lives in the free core.

At a glance

What Runlayer does well

Runlayer has moved fast and covers a lot of ground:

• Enterprise momentum. A $30M Series A brought total funding to $42M, and its homepage carries named customer case studies and a quote from a co-creator of MCP (runlayer.com).
• Enablement, not only security. A governed MCP catalog, role-based bundles of tools, and "governed AI coworkers" that employees create from Slack or their workspace (runlayer.com).
• Endpoint reach. Its AI Watch component ships as signed packages for common MDMs, so discovery and endpoint controls reach laptops (docs index).
• Deployment choice. Hosted, or self-hosted in your AWS account with Terraform (docs).

If you want a vendor-supported platform to roll AI tools out to every employee, with a large MCP catalog and endpoint discovery, Runlayer is a credible option.

Where Preloop is different

Preloop overlaps with Runlayer on MCP governance, discovery, and spend. It is a different shape of product: an open-source control plane whose headline primitive is a human decision on a single risky action.

• Open source and self-hostable anywhere. Preloop's core is Apache 2.0. Run it in your own VPC on any cloud, on-prem, or air-gapped, and read the enforcement code instead of trusting a black box.
• Per-call human approvals in the free core. When a policy routes a tool call for review, the right person is paged on mobile, Apple Watch, Slack, Mattermost, email, or webhook, with the tool, arguments, agent reasoning, and matched policy in front of them. Runlayer's documented approvals cover requests for MCP servers and access; its runtime checks on tool calls are automated security models.
• Native agent actions. Native action gates for Claude Code, Codex CLI, Cursor, Copilot CLI, OpenCode, and others put shell commands and file edits on the same approval path as MCP calls.
• One control plane. The MCP firewall, the model gateway with budgets and per-agent attribution, runtime session observability, and the audit trail share one data model.
• Policy-as-code with CEL. Ordered YAML rules with CEL expressions evaluate tool arguments and version-control with the rest of your infrastructure.
• Evidence. Audit rows are sealed into a per-account hash chain with signed checkpoints that you can keep outside the platform.

When to choose Runlayer

• You want a commercial platform to enable AI for every employee, with a large MCP catalog and vendor support.
• Endpoint discovery through your MDM is a first requirement and you prefer a packaged agent for it.
• AWS is your deployment target for self-hosting, or you are happy with a hosted service.

When to choose Preloop

• Platform and DevEx teams rolling out Claude Code, Codex CLI, Cursor, Gemini CLI, OpenClaw, or OpenCode who need to govern local agents without changing developer workflows.
• Security teams that need a control plane they can read and audit, deployable on any infrastructure.
• Teams whose core requirement is human-in-the-loop approval of risky actions: selective, policy-driven, context-rich review of individual calls, in the free core.
• Open-source-first organizations that will not adopt a closed-source enforcement layer.
• Teams building EU AI Act readiness evidence that want durable records of matched policy, approver, justification, inputs, and outcomes.

FAQ

Is there an open-source alternative to Runlayer? Preloop is an open-source AI agent control plane under Apache 2.0: MCP firewall, per-call human approvals, AI model gateway with budgets, runtime observability, and audit trail. It does not ship an MCP catalog of Runlayer's size or an MDM-packaged endpoint agent.

Can I self-host my MCP security layer? Yes, with either product. Preloop runs on any infrastructure, including air-gapped environments. Runlayer documents self-hosting in your own AWS account.

Are approvals a paid feature in Preloop? No. Single-approver, per-call approvals are in the open-source core. Multiple approvers, quorum, and escalations are in Cloud and Enterprise.

Which AI coding agents does Preloop govern? Claude Code, Codex CLI, Cursor, Gemini CLI, OpenCode, Hermes, OpenClaw, Windsurf, Copilot CLI, and any MCP-compatible client.

How do I onboard existing agents to Preloop? Install the Preloop CLI, run preloop agents discover to find local agent configurations, then preloop agents onboard to route the supported ones through Preloop.

Try Preloop

• Start your free trial
• Book a demo
• Preloop on GitHub

Last reviewed: 2026-10-08.