attest_tag
Sign inTry it now
Menu
Comparisons

Comparisontheir pages read 22 Sep 2026

Gumloop vs attest_tag

Gumloop is for building and sharing agents over 300+ connectors, with a live credit count in the chat header and a per-app hold on writes you can switch on, so the difference is the defaults and the tiers: a hold on every write that is on by default rather than an “Always allow” default set per app, approvers who are never the requester, an audit log in the free plan rather than under Enterprise, and an MIT binary you can read and run on your own machine for nothing.

Try it nowDeploy it yourselfSkip to the table
The short versionTheir page, oursSide by sideQuestionsTry both

Which model answers

Any endpoint, per thread

What a turn costs, and who sees it

Model and cost under every reply

Where it runs

Hosted, or one binary of yours

Who holds the credentials

The proxy. Never the model

Who may approve

Never your own request

What you can audit

Every call, exportable

Pick attest_tag when

  • A credential is given to the service, never to the model: an in-process proxy injects it at the network edge one hop before the request leaves, the model only ever emits a URL and a method, and responses are scrubbed of anything secret-shaped before they reach the model or Slack.
  • A monthly budget for the workspace, another per channel, and a per-user hourly rate limit; the bot pauses at the ceiling and says so, rather than reporting having crossed it.
  • The model is set per workspace, per channel and per thread with !model; a heavy model is routed to automatically for code, long threads and turns that reach eight tool calls, and on OpenRouter only providers that do not train on prompts are used by default.
  • A flat monthly fee by the number of people who used the bot in the last 30 days, never per seat, and every feature — approval tiers, budgets, two-factor sign-in, MCP servers, fix jobs — in the free plan, which does not expire and needs no card.
  • “Fix this and raise a PR” hands the change to a separate worker container that clones the branch, runs the tests, makes the change, runs them again and opens a draft pull request; it pushes one branch and never merges.
  • You need HIPAA: run the same binary on your own infrastructure so protected health information never leaves it, and we sign a business associate agreement with you on request.
The ten questions, side by side

Their page, ours

What the hero says, and what the rest of the site does not.

A hero line is a promise about the product. The questions an engineer asks before rolling one out are usually answered somewhere else on the site — or not answered. These are the ones we looked for.

Gumlooptheir hero, verbatim

“Build, share, optimize & control agents”

An AI agent platform where anyone at a company builds, shares and controls agents that connect to their apps and run on triggers, deployable to Slack channels and Microsoft Teams.

What their pages do not say

  • A licence, or source you can read
  • A hold on writes that is on by default: their Human in the Loop docs make “Always allow” the default per app, and the hold is switched on by whoever builds the agent
  • An approver who is not the requester: their Human in the Loop docs send the approval card to the person who asked, and a separate approver tier is not described
  • The key that seals a stored token, and who holds it
  • How long audit logs are kept — retention is “according to Enterprise agreement terms”
  • An on-premise install, or a binary you download and run yourself

On the public pages listed under the table, as of 22 Sep 2026. An absence is a fact about a page, not about the product; if one of these has since been answered, we will change it.

attest_tagthe same questions, in writing

Side by side

Ten questions worth asking either way.

Our column is the same on every comparison, and each cell ends where the mechanism is shown. Theirs is Gumloop’s own pages, quoted or closely paraphrased, as read 22 Sep 2026.

01Which model answers

attest_tag

Any OpenAI-compatible endpoint — OpenRouter, a vendor API, or a model you host. Ships on google/gemini-flash, with a heavy model routed to automatically for code and long threads, and a per-thread override.
Models and cost

Gumloop

“You choose which models and providers your agents use”, with bring-your-own keys on both tiers. Pricing lists 35+ models on Pro, 35+ with custom proxy support on Enterprise; AI Model Access Control is listed under Enterprise. Their docs say new agents “normally default to Auto”, a router that picks a model per message, and the Recommended preset “Currently points to Grok 4.6”; Enterprise organisations default to Recommended.
02What a turn costs, and who sees it

attest_tag

Metered per completion and printed under the reply beside the model that answered, with !usage for the month by channel. A monthly budget for the workspace, another per channel, and a per-user hourly rate limit — the bot pauses at the ceiling rather than reporting having crossed it.
Audit and budgets

Gumloop

One credit is $0.005, and “The running cost of a conversation appears next to the chat's name in the chat header and updates live.” Billed as model cost, 1 credit per successful tool call plus that tool's own charge, 5 per session-minute, plus an 8% orchestration fee, 16% on BYOK.
03Where it runs

attest_tag

Hosted by us, or one MIT-licensed Go binary with the console embedded on your own infrastructure — Docker, Cloud Run, Fargate, Container Apps or Kubernetes. The same code either way. Where HIPAA applies, run it yourself so nothing leaves your network, and we sign a business associate agreement with you.
Self-hosted

Gumloop

Managed SaaS, or under Enterprise “deploy into your own cloud (VPC), in the region of your choice”: AWS, Azure or Google Cloud. Virtual Private Cloud is marked x under Pro and “Optional” under Enterprise. An on-premise install or a binary you run is not stated.
04Who holds the credentials

attest_tag

The service, never the model. Sealed with AES-256-GCM at rest — under a key you hold, on a self-host — injected by a proxy at the network edge, and scrubbed back out of every response before it reaches the model or the thread.
Credentials, in the guardrails

Gumloop

“Secrets are managed centrally, and never sit in plaintext on someone's laptop”, encrypted in transit and at rest, with rotation, revocation and your existing vault. In Slack an agent uses your own default credentials, not its creator's, unless team apps are configured. The key that seals a token is not stated.
05Before it changes something

attest_tag

Any method other than GET, HEAD or OPTIONS is held for a card in the thread — Confirm, Cancel, or say what you actually wanted. Pending writes expire after five minutes. A fix job opens a draft pull request and never merges.
Human-in-the-loop writes

Gumloop

Their Human in the Loop docs add per-app Approval Settings: “Always allow” (“This is the default”), “Ask each time”, “Ask for writes/deletes” — “Read-only tools run freely. Write and delete operations require approval.” — and Custom per tool. “For Slack-connected agents, approval buttons appear directly in the Slack thread” with Approve, Reject and Open in Gumloop. The enterprise page adds “plain English rules that block, tag, or log actions before they run”, agent-scoped on Pro and org-wide on Enterprise.
06Who may approve

attest_tag

Writes that grant access leave the thread and go to an approver’s DM. Nobody approves their own request — enforced three times over, once in SQL — and a request routes to the least powerful tier that covers every call in it.
Access requests and tiers

Gumloop

Tool-call approvals go to the person chatting: “You receive an approval request via in-app notification, Slack DM, or directly in the chat thread”, with a “Don't ask again for this tool” checkbox; an approver who is not the requester is not described. The enterprise page adds “Cap spend by agent, team, or org, and approve costly actions”, beside a credit increase request mockup with Approve and Deny.
07What you can audit

attest_tag

Every turn, tool call, proxied request and completion — with tokens and cost — in a console you run, exportable as CSV. Self-hosted, it is a table in your own database.
The audit trail

Gumloop

Under Enterprise: “Capture detailed audit trails for actions across the organization”, streamed to S3, Datadog or a custom endpoint with an audit log data drain. Only users with their Admin organization role can access them; retention is “according to Enterprise agreement terms”.
08Source and licence

attest_tag

MIT. The repository is the product: the hosted service runs the same binary you can clone, read and build.
The same binary, inside your network

Gumloop

Not stated on their site.
09What it costs

attest_tag

A free plan that does not expire — $5 of model spend a month — then a flat monthly fee by plan size, $49 for up to 10 users to $599 for up to 250 users, with AI credit included. Never per seat, and every feature in every plan.
Pricing

Gumloop

Pro “Starts at $37 / month” with 20,000 credits, unlimited seats and teams, an 8% orchestration fee and a 14-day free trial; overage at $0.005 a credit once pay as you go is enabled. Enterprise is custom pricing. No free tier is listed.
10Where it lives

attest_tag

Slack and Microsoft Teams, from one console: channels, threads and DMs in Slack; channel reply chains, group chats and one-to-one chats in Teams. It joins the channels you invite it to, and there is no second place for the team to go.
Threads and streaming

Gumloop

Slack channels and threads on @mention, and DMs to the Gumloop app “answered by your own Gumball” — “DMs never reach a custom agent”. The same agents deploy to Microsoft Teams channels; a web app, and “Gumloop CLI” and “Gumloop MCP” rows on the pricing table, are also listed.

“Not stated on their site.” means we read the pages below on 22 Sep 2026 and did not find it — not that the product lacks it. Ask them; a vendor that answers all ten in writing is a good sign about the vendor. If we have something wrong, tell us and we will fix the page.

Pages read: Gumloop homepagePricingEnterpriseSecurity and trust at GumloopUsing Agents in Slack (docs)Audit Logging (docs)Credits (docs)Connectors (docs)Human in the Loop (docs)AI Models (docs)Trust center

Questions

What people ask about Gumloop and attest_tag.

Is attest_tag an open-source alternative to Gumloop?
attest_tag is under the MIT licence: one Go binary with the admin console embedded, one database, the same code the hosted service runs, in a public GitHub repository. Gumloop's pages do not state a licence or whether its source is available. Both answer in Slack channels and threads and both reach Microsoft Teams; Gumloop also builds agents in a web app.
Can I run attest_tag on my own servers?
Yes, at no fee and with no limits set by us: Docker on a laptop or VM, Google Cloud Run, AWS Fargate, Azure Container Apps, or Kubernetes with Helm. Credentials are sealed under a MASTER_KEY you hold, and the audit log is a table in your own database. Gumloop runs as managed SaaS or, under Enterprise, as a VPC deployment inside your own AWS, Azure or Google Cloud; a binary you download and run is not stated.
Which model does each run on?
Gumloop says “You choose which models and providers your agents use”, with bring-your-own keys on both tiers and 35+ models listed; new agents “normally default to Auto”, a router that picks a model per message, the Recommended preset “Currently points to Grok 4.6”, and restricting which models teams may use is an Enterprise control. attest_tag talks to any OpenAI-compatible endpoint, ships on google/gemini-flash, sets the model per workspace, channel and thread with !model, and routes to a heavier model for code, long threads and turns that reach eight tool calls.
What does a turn cost, and who sees it?
Gumloop bills a chat in credits at $0.005 each — the model's cost, one credit per tool call, five credits per session-minute and an 8% orchestration fee, 16% on your own keys — and the running cost appears in the chat header. attest_tag measures every completion's tokens and cost and prints them under the reply; !usage shows the month's spend by channel against the budget, and the bot pauses at the ceiling. A typical answered question on the default model costs about $0.002.
Does Gumloop hold a write for a human before it runs?
Yes, when the agent's builder turns it on. Their Human in the Loop docs offer per-app Approval Settings — “Always allow” is the default; “Ask for writes/deletes” means “Read-only tools run freely. Write and delete operations require approval.” — and “For Slack-connected agents, approval buttons appear directly in the Slack thread”. The hold is a setting per app on each agent. In attest_tag the hold is the default rather than a setting: any method other than GET, HEAD or OPTIONS is held, the bot posts what it intends to do with Confirm, Cancel and “Something else…”, and the pending write expires after five minutes; an admin can pre-approve an expected write with a plain-sentence allow rule, checked strictly.
Can someone approve their own request?
Not in attest_tag. A write that grants access leaves the thread and goes to an approver as a DM with Approve and Deny; nobody approves their own request, enforced three times over, once in SQL, and a request routes to the least powerful tier that covers every call in it. In Gumloop's Human in the Loop docs the approval card goes to the person who asked — “You receive an approval request via in-app notification, Slack DM, or directly in the chat thread” — so the requester resolves their own agent's tool calls; the enterprise page's credit increase request shows Approve and Deny, and who may resolve that one is not stated.

More comparisons

The same ten questions, asked of the others.

All comparisons

Try both

Run both in the same channel for a week.

We mean it. attest_tag answers in threads, so it will not collide with whatever else is in the channel, and a week of your own questions settles this faster than any table.

Try it nowDeploy it yourself

Half an hour to set up, one channel to start, and the free plan needs no card. See what it costs.