Preloop vs Zenity: Developer-first AI agent governance

Preloop is the open-source AI agent control plane — an MCP firewall, AI model gateway, human approvals, runtime observability, and audit trail in one self-hostable platform. Zenity is commonly positioned as a closed-source AI Agent Security Platform for the CISO office, with full-lifecycle coverage including AI Observability, AI Security Posture Management (AISPM), Inline Enforcement, and AI Detection & Response. The honest one-liner: if you need a CISO-grade semantic threat-detection platform across many enterprise AI agents, Zenity is designed for that buyer; if you need a developer-first, open-source control plane that governs MCP tool calls, model traffic, and approvals at runtime, Preloop is designed for that buyer. The two are often complementary.

At a glance

What Zenity does well

Zenity is commonly described as a serious CISO-grade AI agent security platform:

• Semantic agent threat detection. Zenity's core strength is detecting agentic threats at the semantic level — prompt injection, misuse patterns, policy violations in natural-language behavior — not just at the tool-call layer.
• AI Security Posture Management (AISPM). Mapping agents, their identities, capabilities, and risks across an organization's SaaS and enterprise estate.
• AI Detection & Response. Incident-style workflows for when something goes wrong inside an agent session.
• Broad ecosystem coverage. Copilot Studio, Power Platform, enterprise SaaS agents, and other environments outside a developer-centric MCP stack.
• Enterprise-ready narrative. The product is positioned to land inside a security program, not only a platform engineering team.

If you are running a CISO-led AI security program across many vendors and copilots, Zenity is a credible anchor.

Where Preloop is different

Preloop is shaped for a different buyer and a different layer of the stack.

• Open source and self-hostable. Preloop's core is Apache 2.0 licensed. You can run it in your own VPC or on-prem, read the code, and adapt it — no enterprise procurement cycle is required to get started.
• Developer-first. Preloop is designed for platform and DevEx teams rolling out Claude Code, Codex CLI, Cursor, Gemini CLI, OpenClaw, and OpenCode to engineers. preloop agents discover onboards those agents in one command.
• MCP-native runtime enforcement. Every MCP tool call is evaluated against YAML + CEL policy and either allowed, denied, held for approval, or held for justification. Policies live next to your infrastructure code.
• Model gateway in the same product. Preloop ships a model gateway with per-agent, per-flow, per-key budgets and attribution. Tool governance and model governance share one surface.
• Approvals that fit engineering workflows. Mobile, watch, Slack, Mattermost, email, webhook, and async-safe mode for long-running reviews.
• Runtime session timelines. Drill from a fleet view into any session and see every tool call, model call, matched policy, approver, spend, and outcome — evidence that supports incident analysis and AI governance programs.

Preloop's prompt-injection coverage is honest and partial. Today, Preloop provides protection through per-parameter CEL conditions on tool arguments, required justifications, redaction in logs and notifications, and approval gates on risky tool calls. Dedicated semantic prompt-injection detection is on the near-term roadmap. For content-safety at the semantic level, Preloop is complementary to platforms like Zenity, Lakera, or Llama Guard — you can run semantic detection in front of Preloop and let Preloop enforce tool-call policy and approvals at runtime.

When to choose Zenity

• Your buyer is the CISO office and you need an enterprise AI security program with AISPM, semantic detection, and detection-and-response for many agents across your SaaS and copilot estate.
• Your primary concern is semantic-level misuse and prompt-injection detection across agents you do not directly build or run.
• You need a commercial vendor that maps to a formal security product category.

When to choose Preloop

• Platform and DevEx teams rolling out AI coding agents (Claude Code, Codex CLI, Cursor, Gemini CLI, OpenClaw, OpenCode) who need zero-touch onboarding and a runtime control plane.
• Security engineering teams in regulated SaaS that need policy-as-code, approvals, and runtime audit evidence living inside their own network.
• Open-source-first organizations that want a control plane they can read, fork, extend, and self-host.
• Teams building EU AI Act readiness evidence with durable logs of matched policies, approvers, and outcomes mapped to runtime sessions.
• Engineering teams standardizing on MCP that want native tool governance and a compatible model gateway in the same product.
• Organizations looking for a developer-friendly complement to a CISO-grade security platform.

Adoption notes — complementary deployment

Preloop and Zenity are often stronger together than either alone for organizations with both a CISO-grade AI security program and a serious platform engineering function rolling out coding agents.

A typical deployment pattern:

• Use Preloop as the control plane for developer-facing coding agents. preloop agents discover enrolls Claude Code, Codex CLI, Cursor, Gemini CLI, OpenClaw, and OpenCode in minutes.
• Enforce MCP tool-call policy, approvals, and model budgets in Preloop at runtime.
• Feed Preloop's runtime session and audit events into a semantic-detection layer (Zenity or equivalent) for posture management and detection-and-response.

This keeps the developer experience fast and open, while giving the security org the semantic coverage it expects.

FAQ

Is there an open-source alternative to Zenity? Preloop is an open-source AI agent control plane released under Apache 2.0. It is shaped differently from Zenity — Preloop focuses on runtime enforcement (MCP firewall, approvals, model gateway, audit) rather than semantic AISPM and detection-and-response. Many teams use Preloop for runtime control and a separate platform for semantic detection.

Does Preloop detect prompt injection? Partially. Preloop provides policy-based defenses today through CEL conditions on tool arguments, required justifications, redaction in logs and notifications, and approval gates on sensitive actions. Dedicated semantic prompt-injection detection is on the near-term roadmap. Teams needing full semantic coverage today typically run a content-safety layer (Lakera, Llama Guard, or Zenity) in front of Preloop.

Can Preloop run in a regulated or on-prem environment? Yes. The Apache 2.0 core is self-hostable on any infrastructure, including private VPCs and on-prem subnets, so MCP traffic, approvals, and audit evidence stay inside your network.

How does Preloop's policy model work? Policies are YAML files with ordered, priority-aware rules. Each rule can match on tool name, server, parameters, agent identity, or other context via CEL expressions, and decides allow, deny, require approval, or require justification.

Which AI coding agents does Preloop govern? Claude Code, Codex CLI, Cursor, Windsurf, Gemini CLI, Cline, OpenClaw, OpenCode, and any other MCP-compatible client or runtime.

Do I need to choose one vendor? No. Preloop focuses on developer-first runtime governance; platforms like Zenity focus on semantic threat detection and AISPM. Many organizations run both.

Try Preloop

• Start your free trial
• Book a demo
• Preloop on GitHub