What it is
Runlayer is a managed MCP gateway and agent control plane. Every MCP request from Claude, Cursor, ChatGPT, Codex or an internal agent passes through a single-tenant gateway on AWS — hosted by Runlayer or deployed into your own account — that authenticates the caller against your identity provider, checks policy, scans the call and writes it to an audit log. Around that gateway sit four things buyers actually evaluate: a catalogue of pre-vetted MCP servers staff pick from like an Okta app launcher, ToolGuard and AgentGuard for runtime threat detection, shadow-AI discovery for the servers and plugins people installed on their own, and session recording that captures prompts, tool calls and permission decisions.
The company came out of stealth on 17 November 2025 with an $11M seed led by Keith Rabois at Khosla Ventures and Felicis, and announced a $30M Series A led by Felicis with Khosla on 24 June 2026, for $42M raised in total. CEO Andy Berman previously founded Vowel, sold to Zapier in 2024; co-founders Tal Peretz and Vitor Balocco came from Zapier. MCP co-creator David Soria Parra is an angel. Named customers include Instacart, Gusto, Opendoor, dbt Labs, AngelList, Decagon and Lemonade.
The question it answers
“Our teams are wiring Claude and Cursor to MCP servers on their own — what governs which tools agents can call, and who audits it?” Runlayer’s answer is a vendor-run control plane rather than infrastructure you assemble. Okta and Entra groups sync over SSO and SCIM, so access to a Salesforce or Slack MCP server follows the same group membership as the app itself. Audit logs export continuously to S3 for Splunk, Sentinel or CrowdStrike, with telemetry to Datadog and Honeycomb. The platform is SOC 2 Type II and HIPAA certified.
The detection layer is what separates it from a pure gateway. ToolGuard is a set of ML models that scan tool definitions, calls and outputs for tool poisoning, prompt injection, credentials and invisible characters, with vendor-reported inference of 50-100 ms per call. AgentGuard watches the whole session for drift. In the February 2026 OpenClaw for Enterprise launch, Runlayer reported that ToolGuard raised prompt-injection resistance from an 8.7% baseline to 95% — a vendor benchmark, not an independent one. Discovery runs through an endpoint agent pushed by MDM, which finds unmanaged MCP servers on laptops.
Pricing reality
There is no public price. runlayer.com/pricing returns a 404, every deal starts with a demo, and there is no free tier or self-serve signup. Runlayer sells a platform fee scoped to deployment size and capabilities rather than per-seat pricing — the stated point is that adoption should not be taxed per head. The AWS Marketplace listing is a 12-month contract whose single dimension carries a $5,000,000 ceiling plus $20 per overage unit; treat that as a private-offer placeholder, not a quote. Its practical value is that buying through Marketplace can draw down an existing AWS spend commitment.
For scale: Obot is free under MIT if you run the Kubernetes yourself, and TrueFoundry publishes a $499-a-month Pro plan covering 25 MCP servers. Runlayer is priced as enterprise security software, above both. Budget it as a security-platform line item and expect the quote to move with the number of clients and servers in scope.
Best for
The head of IT or security at a 500-to-5,000-person company where Claude Code, Cursor and ChatGPT are already in daily use and MCP servers are multiplying faster than anyone can review them. The scoped case where Runlayer wins: RevOps and support teams reaching Salesforce, Slack and Notion through MCP, a security team that needs every tool call tied to an Okta identity and shipped to the SIEM, and no platform engineer available to run a self-hosted gateway.
Not for
A team under about 50 people, or anyone who wants to see a price before a sales call. It is also the wrong pick if your security review rejects closed-source software in the request path, or if you do not run on AWS — Runlayer’s hosted and self-hosted deployments are both AWS-based, with the Runlayer Operator also covering customer-managed EKS or GKE clusters.
Versus the alternatives
- Obot — MIT-licensed, self-hosted, one policy across tool calls and model calls. Pick it when you have Kubernetes skills and the requirement is that no vendor sits in the credential path. You give up ML threat detection and endpoint discovery.
- Docker MCP Gateway — the widest distribution in the category, shipped inside Docker Desktop’s MCP Toolkit. Pick it for safe local execution on developer machines. It does not answer “which employee authorized this write, company-wide.”
- Amazon Bedrock AgentCore Gateway — the hyperscaler option, turning APIs and Lambda functions into MCP tools inside AWS. Pick it when your agents are built on Bedrock and IAM is the identity model you already trust.
- Rippling AI Governance — the fastest-moving entrant: MCP gateway, AI gateway, agent identity and shadow-AI detection, launched in August 2026 right after Runlayer and Rippling withdrew their lawsuits against each other on 19 August with no settlement. Pick it when Rippling is already your HRIS and you want access to follow role and employment status without another vendor.
- Composio or Arcade — managed tool-auth with large integration catalogues. Pick them when the goal is agents that can write to hundreds of SaaS apps this quarter, not governing the tools employees already wired up.
If shadow AI across SaaS copilots is the real worry rather than MCP traffic, look at Zenity or WitnessAI first.
Watch-outs
- Closed source, vendor-run, and in the path of every agent call. An outage or a pricing change at Runlayer reaches every agent in the company. Guard: take the self-hosted deployment in your own AWS account if your team can operate it, get the uptime SLA and data-export terms in writing, and keep a documented bypass for critical MCP servers.
- Beta components in the documentation. Human-approval rules are marked beta and cannot yet be narrowed to specific resources; the LLM gateway is early access; self-hosted ToolGuard needs GPU capacity. Guard: list the exact controls your policy requires before the pilot and test each one against GA features only.
- The category leader is still being decided. Rippling now bundles a competing gateway into its HR platform, and Okta, Microsoft and AWS all ship agent-identity features. Guard: sign 12 months, not 36, cap the renewal uplift, and confirm audit logs export in a format your SIEM keeps if you leave.
- Vendor benchmarks on detection. The 95% injection-resistance figure is Runlayer’s own. Guard: red-team ToolGuard in the pilot with your own poisoned tool descriptions and track its false-positive rate on real traffic for two weeks before turning blocking on.