Preloop vs Zenity: Developer-first AI agent governance

Preloop is the open-source AI agent control plane: an MCP firewall, AI model gateway, human approvals, runtime observability, and audit trail in one self-hostable platform. Zenity is a commercial AI agent security and governance platform for enterprise security teams, with AI observability, AI security posture management (AISPM), exposure management, agentic identity, MCP security, and AI detection and response (AIDR) across SaaS, cloud, and endpoint agents. The honest one-liner: if you need a CISO-grade security platform across many enterprise agents and copilots, Zenity is built for that buyer; if you need a developer-first, open-source control plane for the agents your engineers run, with approvals, budgets, and runtime evidence, choose Preloop.

At a glance

What Zenity does well

Zenity is a serious, well-funded AI agent security platform:

• Funding and recognition. Zenity announced a $125 million Series C led by Norwest on August 3, 2026, and its site reports a "Market Shaper" placement in Gartner's AI application security report (zenity.io).
• Breadth of agent coverage. It covers agents embedded in SaaS (Microsoft 365 Copilot, Salesforce Agentforce, ServiceNow), homegrown agents on cloud platforms, and coding agents on endpoints (platform).
• Posture and inventory. AI observability "builds a live inventory of agents across SaaS, custom, and endpoint deployments, and tracks the data each one touches" (platform).
• Detection and response. Intent-based detection and AIDR, positioned to land inside a security operations program.

If you are running a CISO-led AI security program across many vendors and copilots, Zenity is a credible anchor.

Where Preloop is different

Preloop is shaped for a different buyer and a different layer of the stack.

• Open source and self-hostable. Preloop's core is Apache 2.0. Run it in your own VPC or on-prem, read the code, and start without a procurement cycle.
• Developer-first. Preloop is built for platform and DevEx teams rolling out Claude Code, Codex CLI, Cursor, Gemini CLI, OpenClaw, and OpenCode. preloop agents discover finds those agents and preloop agents onboard routes them through Preloop.
• A human can decide a single call. Every governed tool call is evaluated against YAML and CEL policy and either allowed, denied, held for approval, or held for justification. Native action gates extend that to shell commands and file edits.
• Model gateway in the same product. Budgets and attribution per agent, flow, and key. Tool governance and model governance share one surface.
• Runtime session timelines. Every tool call, model call, matched policy, approver, spend, and outcome in one place, with audit rows sealed into a hash chain with signed checkpoints.

Preloop's prompt-injection coverage is honest and partial. Model content policies can score prompts and completions with deterministic prompt-injection heuristics and deny, notify, or require approval, and the docs call the scoring best-effort. Tool argument conditions, required justifications, redaction, and approval gates limit what an injected instruction can do. For semantic detection, run a content-safety layer or a platform like Zenity alongside Preloop.

When to choose Zenity

• Your buyer is the CISO office and you need AISPM, detection, and response for many agents across your SaaS and copilot estate.
• Your main concern is agents you do not build or route yourself, such as Microsoft 365 Copilot or Salesforce agents.
• You need a commercial vendor that maps to a formal security product category.

When to choose Preloop

• Platform and DevEx teams rolling out AI coding agents who need a runtime control plane with approvals and budgets.
• Security engineering teams that need policy-as-code, approvals, and runtime audit evidence inside their own network.
• Open-source-first organizations that want a control plane they can read, fork, extend, and self-host.
• Teams building EU AI Act readiness evidence with durable records of matched policies, approvers, and outcomes mapped to runtime sessions.

Adoption notes: complementary deployment

Preloop and Zenity can be stronger together for organizations with both a security program and a platform team rolling out coding agents:

• Use Preloop as the control plane for developer-facing coding agents and automations.
• Enforce MCP tool policy, approvals, and model budgets in Preloop at runtime.
• Send Preloop's signed outbound events (approvals, denials, budget crossings, closed sessions) and OpenTelemetry spans to the security stack where Zenity or your SIEM correlates them.

We have not built or tested a Zenity-specific integration. This is a deployment pattern.

FAQ

Is there an open-source alternative to Zenity? Preloop is an open-source AI agent control plane under Apache 2.0. It is shaped differently: runtime enforcement (MCP firewall, approvals, model gateway, audit) rather than posture management and detection and response.

Does Preloop detect prompt injection? Partially. Model content policies include deterministic prompt-injection heuristics, documented as best-effort, and tool policies, justifications, redaction, and approvals limit the damage. Teams that need semantic coverage run a content-safety layer as well.

Can Preloop run in a regulated or on-prem environment? Yes. The Apache 2.0 core is self-hostable on any infrastructure, so MCP traffic, approvals, and audit evidence stay inside your network.

Which AI coding agents does Preloop govern? Claude Code, Codex CLI, Cursor, Gemini CLI, OpenCode, Hermes, OpenClaw, Windsurf, Copilot CLI, and any MCP-compatible client.

Do I need to choose one vendor? No. Preloop focuses on developer-first runtime governance; Zenity focuses on security posture, detection, and response. Many organizations will run both.

Try Preloop

• Start your free trial
• Book a demo
• Preloop on GitHub

Last reviewed: 2026-10-08.