Runlayer
by Runlayer
One control plane for enterprise AI agents, MCP servers, skills and plugins: enablement and security in a single model-neutral layer.
Runlayer is an AI control platform that sits between an enterprise's AI clients and the MCP servers, skills and agents they call. It enforces identity-based permissions, scans tool calls for threats and finds shadow AI. Security and IT teams can then roll agents out company-wide without a separate security review for every new connector.
Runlayer is a New York company founded in 2025. It sells a control plane for enterprise use of the Model Context Protocol (MCP) and the agents built on it. It came out of stealth in November 2025 with an $11M seed round led by Keith Rabois of Khosla Ventures, with Felicis participating. At launch it had eight unicorn or public-company customers after four months of running quietly. In June 2026 it raised a $30M Series A led by Felicis with Khosla Ventures, for $42M in total. The founders are CEO Andrew Berman and two former Zapier AI engineers, Tal Peretz and Vitor Balocco. David Soria Parra, a co-creator of MCP at Anthropic, is an advisor. The product has four parts. A governed MCP gateway serves many AI clients from a catalog of more than 18,000 MCPs. A policy engine scopes access by user, group, role, agent account, client, tool and runtime context. The ToolGuard and AgentGuard detection models look for prompt injection, tool poisoning, data exfiltration and intent drift. Shadow-AI discovery finds unmanaged MCPs, skills and plugins on endpoints through a signed CLI pushed out by Jamf, Intune, Kandji, Mosyle or SimpleMDM. Documented client integrations include Claude Code, Claude Cowork, Cursor cloud agents, ChatGPT, Codex and Salesforce Agentforce. Runlayer is hosted as a service or self-hosted in the customer's own AWS account on ECS Fargate through Terraform, or on EKS/Kubernetes. Named customers include Instacart, Gusto, Opendoor, dbt Labs, AngelList, Lemonade, Decagon and PagerDuty. In July 2026 Runlayer sued Rippling, alleging that Rippling cloned its gateway during an extended trial. Rippling denies the claim.
A CISO or head of IT at a company where employees already use several AI clients (Claude, Cursor, ChatGPT, Codex) with MCP servers and skills, and who needs one place to approve, scope and audit them.
Agents and MCP connectors can be rolled out company-wide through one governed gateway with identity-scoped permissions, runtime threat scanning and audit logs, without a separate security review for each new tool.
At a Glance
- Category
- Governance & Security
- Pricing
- Contact for pricing
- Target Market
- CISOs, CIOs, IT Leaders, Security Engineers, Enterprise Developers
- Deployment
- Cloud-first, Self-hosted, Hybrid
- Founded
- 2025
- Headquarters
- New York, United States
Key Features
- ✓Governed MCP gateway and catalog
Routes MCP traffic from many AI clients through one gateway, backed by a catalog of more than 18,000 MCPs plus an approval workflow for internal servers.
- ✓Context-aware access policies
Scopes what users and agents can reach by identity, group, OAuth grant, client, tool and runtime context, with spend and usage visible.
- ✓ToolGuard and AgentGuard detection
Runtime models inspect tool calls and outputs for prompt injection, tool poisoning, data exfiltration, output manipulation and intent drift.
- ✓Shadow AI discovery
A signed endpoint CLI, distributed through MDM tools such as Jamf, Intune and Kandji, finds and controls unmanaged AI clients, MCP servers, skills and plugins.
- ✓Sessions, incidents and audit logs
Records the full agent lifecycle and MCP activity history, so security teams can triage incidents and show auditors who accessed what.
- ✓Hooks SDK and inference hooks
TypeScript and Python hooks, plus Anthropic inference hooks, let teams inspect prompts and enforce policy inside their own agent runtimes.
Capabilities
Use Cases
- •Company-wide AI rollout
IT publishes vetted MCP connectors to every employee's Claude, Cursor or ChatGPT client, so connectors do not each wait months for their own security review.
- •Shadow AI clean-up
Security pushes the Runlayer CLI through MDM to inventory unsanctioned MCP servers and plugins on laptops, then blocks or approves each one.
- •Agent threat monitoring
The SOC watches live tool calls for injection and exfiltration attempts and triages flagged sessions from a central incidents view.
- •No-code agent enablement
Business teams build agents on approved connectors inside guardrails, while admins keep permission scopes and audit trails in one place.
Ideal For
Best For
- ✓Governing MCP server access across 5-20 AI clients from one policy layer
- ✓Finding shadow AI: unmanaged MCPs, skills, plugins and agent configs on employee laptops
- ✓Detecting prompt injection, tool poisoning and data exfiltration in live agent tool calls
- ✓Regulated or security-conscious companies that want the control plane self-hosted in their own AWS account
Not Ideal For
- ✗Organisations that need agent identities resolved directly to Okta or Entra ID, or ISO 27001 certification. A third-party comparison reports neither is currently offered
- ✗Multi-cloud or non-AWS shops that want to self-host. Self-hosted deployment is documented only for AWS (ECS Fargate or EKS)
- ✗Teams that need published list pricing or a self-serve plan. Pricing is sales-led only
Integrations
Deployment
Market Analysis
Pros
- ✓Well-known production customers (Instacart, Gusto, Opendoor, dbt Labs, AngelList, Lemonade)
- ✓Threat detection built specifically for MCP risks such as tool poisoning, prompt injection and shadow MCPs
- ✓Flexible deployment: hosted SaaS or self-hosted in the customer's own AWS account
- ✓Advised by a co-creator of MCP, and well funded ($42M raised by June 2026)
Cons
- ✗No public pricing; sales-led only
- ✗A third-party comparison reports agent identity uses vendor-native accounts rather than Okta/Entra, Linux endpoint enforcement is detection-only, and there is no ISO 27001
- ✗Self-hosting is AWS-only, and the LLM gateway was reported as early access
- ✗An HN commenter noted it covers coding agents but not yet web-based agents
- ✗Young vendor (founded 2025) currently in litigation with Rippling over an alleged gateway clone
Pricing
Enterprise
Contact for pricing
- ✓Governed MCP gateway and catalog
- ✓Policies, roles and audit logs
- ✓ToolGuard/AgentGuard threat detection
- ✓Shadow AI discovery
- ✓Hosted or self-hosted in customer AWS
Runlayer publishes no list prices. runlayer.com/pricing returned 404 on 2026-09-28, and every sale starts with a demo request. Neither the vendor nor the third-party comparisons fetched disclose how it is metered (seats, agents or traffic), so budget for a sales-led enterprise contract.
Security & Compliance
Sources
This page was written from 11 sources, 8 on domains other than runlayer.com.
- 1.runlayer.com — runlayer.comvendor
- 2.runlayer.com — series A 30m fundraise felicis khoslavendor
- 3.docs.runlayer.com — llms.txt
- 4.runlayer.com — itvendor
- 5.securityweek.com — runlayer raises 30 million in series a funding
- 6.fintech.global — runlayer raises 11m to secure enterprise mcp tools
- 7.speakeasy.com — runlayer alternatives
- 8.mintmcp.com — mintmcp vs runlayer
- 9.composio.dev — runlayer alternatives
- 10.runtimewire.com — runlayer sues rippling alleging source code access preceded
- 11.hn.algolia.com — search
Stay Ahead of the Curve
Weekly enterprise AI insights for technology leaders. No spam, no vendor pitches—unsubscribe anytime.
SubscribeRelated Products
Baselayer
Business identity, risk and fraud infrastructure that now verifies AI agents before they transact
SAS AI Navigator
SaaS AI governance inventory for models, agents and use cases, sold through Microsoft Marketplace
Rein Security
Runtime security for enterprise AI agents, deployed as a sidecar inside your own cloud
Armadin
Autonomous offensive security: AI agent swarms that chain your weak spots into proven attack paths before an attacker does