Open Protocol, Closed Courtroom: Inside Runlayer v. Rippling, the First Trade-Secret Battle for the MCP Gateway Layer

The Hook: A Lawsuit, Not a Vulnerability

The first existential test of the MCP economy is not a smart-contract exploit. It is not a critical vulnerability in the protocol's reference implementation, and it is not the SEC finally declaring AI agents to be securities. It is a trade-secret complaint, filed in a U.S. courtroom, between two companies that most of the industry has never heard of.

Runlayer. Rippling.

Runlayer builds enterprise-grade gateways for the Model Context Protocol. Rippling, a multibillion-dollar platform that handles HR, IT, and payroll for tens of thousands of businesses, allegedly took Runlayer's gateway through a trial evaluation, signed a non-disclosure agreement, and then emerged months later with an internally built gateway that Runlayer claims copies its own architecture almost one-to-one.

This is the first formal collision between open standards and proprietary control planes in the AI-agent economy. The outcome will not merely decide a damages figure. It will define who may earn from an open protocol, and who may own what sits on top of it.

That is not hyperbole. That is the geometry of layered systems. The base layer is free. The value is in the clamps.

Code is law, but logic is fragile.

Context: The Highway and the Toll Booths

Before the courtroom, the protocol.

MCP, the Model Context Protocol, is the integration standard that lets AI models talk to external tools, data sources, and enterprise systems. It is an open specification. Anthropic helped birth it. A sprawling ecosystem of servers, clients, and orchestration layers has grown around it, and in late 2025 the community finalized a stateless specification: a milestone that reduced the complexity of connecting MCP servers and stabilized the wire format. If the protocol is a highway, the stateless spec is the lane marking that tells everyone which side to drive on.

But a highway without toll booths is a public good no business can sell. The toll booths of the MCP ecosystem are the gateways: centralized control planes that sit between enterprise AI agents and the protocols they talk to. Authentication. Access control. Observability. Policy enforcement. Routing. Audit trails. Data-lineage tracking. Every piece of unglamorous, security-critical machinery that makes an agent safe to deploy inside a corporate network.

Runlayer's product is one of those gateways. Rippling evaluated it in mid-2025, under an NDA. Price negotiations followed. They collapsed. Runlayer suspended service. Rippling announced it would build its own gateway internally. Runlayer filed suit, alleging trade-secret misappropriation and claiming Rippling's internal architecture was a near-verbatim reproduction of its own.

The timing is not accidental. Snowflake and AWS had already launched their own enterprise gateways by then. The market had validated the category. The question the lawsuit raises is narrower and more poisonous: once a protocol is open, how much of the machinery around it remains protectable as a secret?

This is not a DeFi courtroom drama. It is not about tokens. But it is precisely the kind of structural risk event that tokens cannot hedge, and it is the kind of story my nineteen years in this industry have trained me to read as a systemic signal rather than a legal sideshow.

Trust no one. Verify everything.

Core: The Anatomy of the First Gateway War

I have spent the better part of two decades watching protocols promise openness and then discover they need walls. My education began in 2017, during the ICO boom, when I spent three weeks dissecting the whitepaper of a token project and proved that its ERC-20 utility mechanics were not merely ambiguous but internally contradictory with its own roadmap. I built a framework out of that experience that still governs my work today: Claim versus Code. A project's marketing language is a statement of intent. The implementation is the only truth.

In Runlayer v. Rippling, the claims are legal, and the code is locked inside sealed exhibits. That makes this case simultaneously more opaque than any whitepaper audit I have ever conducted, and more consequential. Every subsequent analysis must begin with what is publicly knowable: the architecture of the MCP stack, the commercial behavior of both parties, and the structural incentives that produced this collision.

Let me start with the technical layer, because everything else flows from it.

The Layering Problem: Open Protocol, Closed Control Plane

MCP's stateless specification standardizes the wire format, the message semantics, and the lifecycle of a session between a host client and an MCP server. It does not standardize, and could not standardize, the control plane that governs who is allowed to talk, what they are allowed to say, and what is logged about the exchange. That gap is where enterprise value concentrates.

A gateway is not an API proxy. An API proxy forwards requests. A gateway enforces a security policy across every request, in both directions, under the authority of the organization that controls it. The engineering is categorically more complex: role-based access control across heterogeneous data systems; permission caching with eviction semantics that must balance performance against revocation latency; audit logging tamper-evident enough to survive legal review; routing decisions that account for data residency requirements; policy compilation from human-readable rules into enforceable vectors; and data-lineage tracking that lets a compliance officer answer the question: which agent touched which record, and when?

None of that is specified by MCP. All of it is necessary for an enterprise to deploy MCP at scale. That is the architecture I call protocol-layer standardization, control-plane proprietary. It is the exact structure that produces protectable trade secrets, because the protocol forces interoperability but does not force implementation details. Two gateways can be fully standards-compliant and share zero engineering. The space between compliance and implementation is where a company like Runlayer makes its claim: this specific architecture is ours.

The timing of the lawsuit compounds the technical stakes. The stateless spec was finalized only recently, which means the protocol's own reference examples and best practices are not yet ossified. When a protocol is young, a vendor's particular way of composing authentication, routing, policy, and audit into a repeatable architecture is far more likely to be judged non-public, non-obvious technical information. If the spec had been mature for a decade, Runlayer's architecture might be deemed inevitable, the only way to build the thing. At this early stage, the specific gateway deployment architecture cited in the complaint has a real chance of being treated as genuinely secret.

The complaint's phrase almost one-to-one copy is doing heavy lifting. In trade-secret litigation, that allegation shifts the frame from functional similarity, which courts often tolerate as independent invention, to source-level or architectural reproduction, which they do not. A competitor who builds the same features by independent design has a defense. A competitor who copies the architecture itself has taken the crown jewels. If Runlayer can prove line-level, config-level, or even schema-level similarity, the case becomes dramatically stronger than a typical we-built-a-similar-product dispute.

But there is a defensive counter-move I expect Rippling to deploy, and it is formidable: the reference-implementation defense. If MCP's specification includes a public reference implementation, Rippling can argue that its gateway closely follows the spec's own examples, and that any similarity to Runlayer's product is a function of both parties faithfully implementing the same standard. Two implementations of the same spec will necessarily resemble each other. At what point does resemblance required by the protocol bleed into resemblance that only a thief could produce? That is the core technical question, and a court will need expert witnesses to answer it. Not lawyers. Engineers.

Here I will add an observation derived from my due-diligence years: if Runlayer had any forensic self-awareness, it planted watermarks. A watermarking scheme, unique identifier configurations, deliberately non-idiomatic error messages, unusual ordering of internal routines, is the standard technique for converting suspicion into proof. The complaint's one-to-one language suggests Runlayer believes it has something stronger than a hunch. But the sealed filings do not tell us what. Discovery will be brutal: Rippling will depose Runlayer's engineers about every design decision, and Runlayer will depose Rippling's engineers about the exact genesis of their architecture. That process will either vindicate the one-to-one allegation or dissolve it into a fog of independently re-derived best practices.

There is also a hidden technical asymmetry that favors the defendant, and it is worth stating plainly. Trade-secret law requires the plaintiff to have taken reasonable measures to protect the secret, and it requires the defendant's use to be unauthorized. If Runlayer's engineers discussed architecture freely in conference talks, blog posts, or GitHub issues, standard behavior for an MCP-ecosystem startup trying to build mindshare, the secret's scope has already eroded. Ecosystems reward transparency. Trade-secret law rewards concealment. Runlayer is trying to have both. So is every gateway vendor in the AI stack, which is precisely why this case will be read as a template far beyond its two parties.

The Commercial Toll Gate: Who Captures the Rent

Strip away the legal language and the commercial stakes become stark. The MCP gateway has become the most concentrated monetization point in the AI-agent value chain. Not the model. Not the agent framework. The gateway. It is the choke point through which enterprise data flows to agents, and it is the place where enforcement, compliance, and audit obligations, the things enterprises actually pay real money for, are fulfilled.

Runlayer's commercialization pattern is legible from the complaint's own account. Trial access. NDA. Commercial negotiation. That is a classic enterprise sales cycle, and it tells me Runlayer had moved past technology validation and into revenue motion. The company had a product. It had a sales process. It had pricing expectations.

And the pricing expectations are the most revealing detail in the entire commercial sequence. When negotiations broke down, Runlayer suspended service rather than lower its price or extend a free trial. That is not the behavior of a startup desperate for revenue. It is the behavior of a company that believes its gateway is worth a specific price and will not compromise its long-term economics to keep a single customer, even a customer the size of Rippling. In enterprise software, the willingness to walk away is pricing power. Runlayer walked.

But the strategic error may have been baked into that decision. Consider what Rippling actually is. It is not a software vendor that happens to need a gateway. It is a data platform sitting on an extraordinary asset: the HR, IT, and payroll records of thousands of companies. Employee lists. Salary structures. Device inventories. Access patterns. That is the highest-value data a corporate AI agent could possibly touch. When Runlayer connected its gateway to Rippling's internal systems during the trial, Rippling did not just see a tool. It saw its own moat being externalized. The realization, this capability should be ours, because the data is ours, likely transformed the negotiation from a procurement exercise into a strategic decision. Rippling was not buying a tool. It was deciding whether to buy the capability. And once the capability was understood, it chose to build.

That is the deeper commercial lesson of this case. The gateway is not just a toll booth. In a data-rich platform, the gateway is the castle gate. If you control the gate, you control every agent that enters the castle. Rippling's internal gateway is not merely a replacement for Runlayer. It is the foundation of a closed data-access perimeter: AI tool enters, Rippling data flows out, and every action is governed by Rippling's own policy engine, its own audit trail, and its own commercial terms.

Runlayer's independent position now faces a vice. On one side, cloud giants like AWS and data-cloud giants like Snowflake are shipping gateway capabilities bundled into compute and storage contracts, often at near-zero marginal cost. On the other side, platform companies with proprietary data, Rippling is not the only one, are internalizing gateway technology to protect their perimeters. The independent gateway startup is being squeezed from above by bundling and from below by internalization. Runlayer's lawsuit is the sound of a company defending not only its secret, but its entire commercial category.

The pain is compounded by a structural knowledge problem. In my 2020 work modeling DeFi composability risk, I watched the lend-to-trade loop create correlated failure modes that no single protocol could see. The gateway market has a similar hidden correlation: every independent gateway vendor is competing for the same enterprise accounts, building on the same open protocol, and differentiating on the same narrow feature set of governance and compliance. When the differentiation space is that thin, the temptation to study a competitor's architecture closely crosses the line into copying. The lawsuit is a warning to every founder in the category: your differentiation may be thinner than you think, and your trial evaluations may be reading sessions for a future competitor.

The Cost of Enterprise Adoption

Here is the uncomfortable insight for everyone who cheered the open MCP spec: this lawsuit is the price of enterprise adoption.

MCP is leaving the era of developer experiments. It is entering the era of enterprise procurement. And procurement brings lawyers. Enterprises do not deploy open protocols without security reviews, compliance frameworks, and contractual commitments. They also do not deploy them without asking who controls the components, and who will indemnify what happens when a gateway misroutes a customer's payroll data into a third-party model.

The lawsuit crystallizes three industry-level questions that the MCP ecosystem has been able to defer until now.

First, can an open protocol coexist with trade secrets? The answer is not obviously yes. A protocol is open precisely so that many implementations can interoperate. But interoperability creates the appearance of sameness, and sameness invites infringement claims. Every gateway vendor that studies another gateway's behavior to achieve compatibility now operates under a shadow: at what point does studying become copying? The MCP ecosystem's collaborative norms, sharing architecture in community calls, publishing implementation notes, cross-reviewing code, now carry legal risk. The chilling effect will be real. Engineers will stop talking. The ecosystem's velocity will slow. I have seen this movie before in the aftermath of the Terra collapse in 2022, when the forensic post-mortem I directed revealed how the algorithmic stablecoin's death spiral was visible in on-chain data months before the crash, yet nobody spoke because the incentives to remain silent were stronger than the incentives to warn. Legal fear produces the same silence, and it is just as dangerous.

Second, where is the line between protectable gateway architecture and unprotectable implementation of a standard? Courts have never answered this for the MCP layer specifically. The closest analog is the API-copyright jurisprudence that roiled the software industry, which carved out broad space for functional interoperability. If the court in Runlayer v. Rippling imports that logic, it will hold that whatever is necessary for interoperating with MCP is fair game, but whatever is unnecessary, the specific architecture, the internal design choices, can be protected. That is the most likely doctrinal landing zone. But most likely is not certainty, and a sloppy opinion could swing toward a far more restrictive reading, treating gateway architecture as inherently expressive and thus protectable, which would devastate the open-source gateway ecosystem overnight.

Third, and perhaps most corrosive, will the MCP ecosystem's trust fabric survive? The protocol's power comes from coordination among many independent builders. Trade-secret litigation is the rupture of that coordination. It converts partners into adversaries. It converts shared infrastructure into contested territory. Every company now deciding whether to share technical details with a potential partner must weigh the probability that the partner becomes the next plaintiff or defendant. The transaction cost of collaboration in the MCP ecosystem just went up. It will never go back down. That is the real damage of this case, and it is damage that a settlement cannot fully reverse.

The Competitive Shape of the Gateway Layer

Let me survey the battlefield, because the lawsuit is also a map of where the money is moving.

AWS entered the gateway market before the lawsuit. That is the clearest possible signal that the gateway layer has become cloud infrastructure, not a thin proxy. AWS does not enter thin markets. Snowflake followed with a data-cloud-native gateway that plugs directly into its governance and data-sharing machinery. Both moves validate the category and simultaneously endanger the category's independents. A standalone gateway startup is now competing against the enterprise sales forces, compliance certifications, and bundled pricing of the largest software vendors on earth. The math is brutal: the hyperscalers can give the gateway away because they monetize the data and compute flowing through it. The independent must charge for the gateway itself.

Rippling's entry, post-lawsuit, is a different animal. Rippling is not a hyperscaler. It is a data platform with an installed base of business-critical systems. Its gateway is not a product to sell; it is a moat to maintain. By building it, Rippling ensures that any AI tooling its customers adopt can be mediated through Rippling's own access-control systems, data policies, and audit logs. The AI tool becomes a feature of Rippling. The customer's data never escapes the perimeter. That is vertical integration, and it is far more threatening to independent gateway vendors than AWS's bundling, because it is invisible. It simply deprives the independent of a potential customer without a competitive announcement or a pricing war.

The strategic lesson for independent gateway startups distills into a single phrase: architectural lock-in. The gateway is the architecture into which all future agents must plug. Whoever owns the gateway owns the upgrade path, the data-egress policy, and the compliance narrative. Runlayer's lawsuit is, finally, an attempt to protect an architectural position that the cloud giants and data platforms were already converging to capture. The question is whether a court will help a startup hold that position, or whether the doctrine of open-standard interoperability will hand it to the largest balance sheets.

Black Boxes and Blind Trust: The Security Contradiction

Now the dimension that mainstream coverage will ignore, and the one that matters most for the actual users of this technology: security.

A gateway is security infrastructure. It enforces authentication. It filters what agents may access. It records what they did. Enterprises that deploy a gateway are making it the first line of defense against malicious or broken AI agents. The safety of an entire MCP deployment depends on the gateway's correctness. Yet trade secrets and security infrastructure have a fraught relationship. The most effective security review is open: code that can be inspected, audited, and challenged by independent researchers. A secret gateway architecture is a black box, and black boxes are where vulnerabilities go to mature.

If trade-secret litigation pushes gateway vendors further into concealment, the security posture of the entire AI-agent ecosystem degrades. This is not abstract. Enterprise security standards increasingly demand that AI infrastructure vendors demonstrate auditability. A vendor that asserts the code is a trade secret, you cannot see it, trust our claims, will find itself locked out of the most security-conscious procurement pipelines. The irony is sharp: Runlayer sues to protect its gateway architecture, and the lawsuit itself may become the reason enterprises refuse to adopt that architecture without full source escrow or independent audit rights.

There is a second, more uncomfortable ethical issue: the conduct around the trial itself. Rippling's evaluation under NDA was a legitimate business exercise. But an enterprise that enters a trial evaluation with preexisting intent to build internally, using the vendor's architecture as a blueprint, is engaged in a practice that amounts to industrial espionage by procurement. The complaint suggests Rippling's senior engineers were brought into technical details during the trial, and that the internal build followed suspiciously quickly. If true, Runlayer's claim is not merely legal; it is ethically compelling. A startup spent weeks granting privileged access to a supposed customer and then watched that customer become a competitor with an inside view of its architecture.

Yet the counter-argument deserves its full weight. Rippling will respond that trial evaluations routinely expose customers to architecture; that the gateway design space is small; that any competent engineering team could independently arrive at the same solution; and that trade secrets expire the moment they are disclosed to a third party without adequate protection. The NDA was Runlayer's chosen instrument of protection. If the NDA's scope was too narrow, if it permitted Rippling's engineers to use information for evaluation but did not clearly restrict residual knowledge from being applied to internal development, Runlayer's case weakens. The lesson for every startup is unforgiving: an NDA is not a force field. It is a legal claim on a conversation's aftermath. And in this ecosystem, the aftermath is now a courtroom exhibit.

The Litigation Discount and the Validation Premium

The venture market will not ignore this case, and neither should any analyst modeling the AI-infrastructure sector. The lawsuit changes the risk profile of the entire gateway category in ways that are only beginning to be priced.

For existing gateway startups, exposure to trade-secret litigation is now a line item in due diligence. Investors will ask: who has seen our architecture? Under what NDA? What did our engineers post publicly? What conferences did they speak at? Companies that have been aggressively transparent to build ecosystem trust will now be instructed to go dark. The transparency that fueled MCP's adoption just became legally radioactive. That is a perverse outcome, but it is the outcome the market will enforce.

For valuations, the impact is subtler and more interesting. The gateway layer is becoming infrastructure, and infrastructure is valued on defensibility. A proprietary control plane above an open protocol is, in theory, a gorgeous moat: the protocol guarantees network effects, the control plane captures the rent. Runlayer v. Rippling is the first test of whether that moat is legally enforceable. If Runlayer wins, gateway valuations rise; proprietary architecture is confirmed as a protectable asset, and investors will pay a premium for implementation depth. If Runlayer loses, the floor collapses beneath the entire category's thesis: if an open protocol makes your architecture feel inevitable, you own nothing that is not coded into enforceable patents.

The market will initially treat this lawsuit as a negative for Runlayer regardless of merits. Litigation is expensive, discovery is invasive, and a startup that must allocate engineering hours to depositions instead of product is a startup losing the only race that matters. But the asymmetric outcome favors the plaintiff if the facts are real. One credible injunction against an enterprise customer is worth more than a year of sales calls. One public settlement that includes a license fee establishes a pricing benchmark that every future negotiation will reference. The legal system is slow, but its outputs compound.

My own prior on gateway economics, formed while modeling the 2026 AI-agent economy in my whitepaper on autonomous economic agents, is that the gateway layer will absorb an outsized share of infrastructure spend precisely because it mediates trust. Trust is the scarcest input in the agent economy. A lawsuit that confirms the protectability of trust-mediating architecture will accelerate capital into the category. A lawsuit that fails will push capital toward cloud bundlers and away from independents. Either way, the litigation itself is information, and the information has already moved the market.

The New Stack: From Interoperability to Control

Finally, the layer that will be felt long after the legal fees are paid: infrastructure architecture.

The MCP ecosystem is converging on a standard stack: open protocol, stateless specification, and a control plane with proprietary implementations. The Runlayer case accelerates the divergence between these layers. The protocol will stay open, it must, or the ecosystem dies. The control plane will become increasingly protected, increasingly consolidated, and increasingly owned by the largest balance sheets. In two years, I expect the gateway market to split into a hyperscale tier (AWS, Snowflake, and the other cloud giants), a platform tier (Rippling-like data companies building moats around their perimeters), and a boutique tier of specialists serving compliance-heavy verticals where no generalist can effectively compete.

The jurisdictional question will also matter. If this case proceeds in a jurisdiction historically sympathetic to trade-secret plaintiffs, expect a wave of similar lawsuits from other gateway vendors. Then expect the security community to revolt, because every litigation target is also an audit target, and nobody audits a black box. The discovery process itself may become a weapon: the threat of a trade-secret suit can be used to freeze a competitor's hiring, or to compel an enterprise customer to sever an integration with a rival gateway. Litigation as a denial-of-service attack on a competitor's engineering velocity. I have already seen this pattern in the DeFi world, where the threat of regulatory action was used as a competitive tool. The MCP ecosystem will learn the same move.

The deeper infrastructure story is the shift from interoperability as the goal to control as the goal. MCP was built to make agents interoperable. The gateway war is about making agents governable. Interoperability is a commons problem; governance is a power problem. The Runlayer case is the first legal battle in the transition from commons to power. And the transition will not stop at gateways. It will extend to every layer of the AI stack where standards end and implementation begins.

Contrarian: The Bear Case for the Plaintiff

Now the position I am obligated to argue, and which I genuinely believe deserves scrutiny: the bear case for Runlayer's own lawsuit.

Trade-secret litigation is a double-edged sword, and the blade swings toward the plaintiff more often than the plaintiff expects. To win, Runlayer must prove four things: the information was a secret; Rippling had access to it; the information was misappropriated; and, in some jurisdictions, the information was not discoverable by legitimate means. That fourth element is where the MCP ecosystem becomes a minefield for the plaintiff.

The open protocol's existence cuts against secrecy. The more MCP's specification constrains gateway design, and the more reference implementations and community patterns show how to build a compliant gateway, the more Rippling can argue that Runlayer's secret architecture was an engineering inevitability. Every public conference talk, every GitHub discussion, every architecture blog post from Runlayer's team becomes an exhibit in Rippling's defense. The same transparency that built Runlayer's brand in the ecosystem will be used to dissolve its secrets. That is not a pleasant thought, but it is a true one.

There is also a commercial reality the plaintiff's advisors have surely flagged. Litigation is a public declaration that your sales motion failed. An enterprise customer evaluated your product, then built internally. By suing, Runlayer has now told every future customer: we are willing to turn a failed negotiation into a court case. Some enterprises will respect the defense. Others will simply cross Runlayer off their vendor lists to avoid the headache. Litigation is a reputation tax. In a market where independent gateway vendors are already squeezed by cloud bundling, a reputation tax can be fatal.

The cynical interpretation deserves airtime: the lawsuit may have less to do with winning remedies than with signaling. A young company whose product faces existential competitive pressure needs the financial community to believe it has a defensible asset. A trade-secret complaint is a way to manufacture that belief. It says: our architecture is valuable enough to steal, we are the wronged party, and therefore our technology has value. The investment narrative becomes protecting our crown jewels instead of struggling to find pricing power. That narrative does not require a victory. It only requires that the case remain alive long enough for the next fundraising round to close.

Which brings me to my own contrarian conclusion: this lawsuit will most likely settle. The discovery burden is enormous for both sides. The technical complexity is massive. And the ecosystem's future participation is more valuable to both companies than any remedy. A settlement with mutual non-disparagement, a modest payment, and a license arrangement would return Runlayer to business and Rippling to market focus. The precedent would be set not in a courtroom but in contract language. The MCP ecosystem would learn exactly nothing, and repeat exactly this conflict, with different names and different gateways, within eighteen months.

Takeaway: Watch the Deposition Schedule

Ignore the headline. Watch the discovery calendar.

The next narrative pivot in the AI infrastructure sector will not be a new model release. It will be the discovery phase of Runlayer v. Rippling, when the technical details of the one-to-one copy allegation either materialize or evaporate. If they materialize, every enterprise with an internal AI-gateway project will audit its own architecture's provenance. If they evaporate, every independent gateway vendor will quietly accelerate its patent filings before the next company learns this lesson the hard way.

The broader signal is already clear. Open protocols lower the cost of entry. They do not lower the cost of trust. The market for trust in the MCP layer is now a courtroom in the United States, docket number pending.

Code is law, but logic is fragile. Trust no one. Verify everything. And if you are a founder building on top of an open standard, remember what I learned auditing ICO whitepapers in 2017: the claims are going to look beautiful. The implementation is the only truth. The lawsuit is just another whitepaper. Read it like one.