Runlayer

• A platform owner holding the customer's data or identity, such as Microsoft, Google, AWS, or Snowflake, could ship native agent tool-gating inside tools enterprises already license, removing the third-party budget line Runlayer's platform depends on.
• Cloudflare, Docker, and Wiz already sell MCP security, so the gateway function could commoditize on features and push Runlayer to compete on price or on advisor and partner relationships rather than on product.
• Runlayer's relevance rests on MCP remaining the dominant agent-to-tool standard, so a shift toward vendor-native tool calling or a rival protocol would erode both the problem and the insider advantage.
• The named customers are press-reported logos and vendor-hosted testimonials with no disclosed contract size or retention, so a buyer relying on durable revenue proof has adoption signals rather than evidence the accounts have expanded.
• A larger security or platform vendor could acquire Runlayer for its team and relationships before it builds a standalone franchise, the path implied by Check Point's Lakera deal and Snowflake's pending agreement to buy Natoma.
• The $30 million Series A raised with no disclosed revenue raises the bar for commercial proof, so a slow conversion of logos into paying, expanding accounts would leave the raise ahead of results.

Runlayer sells to the enterprise IT and security team caught between two pressures: employees want to build and use AI agents everywhere, and the team is accountable for what those agents reach. The company frames the answer as a golden path, one platform that enables agent use while keeping identity, policy, threat screening, and audit in the security team's hands.

Independent reporting grounds the pain rather than leaving it as vendor framing. The Rising in Cyber 2026 survey of CISOs reports more than 70 percent running AI agents in production while only 11 percent rate their AI security as comprehensive. Gartner warns that building agentic AI on MCP raises new attack vectors, and TechCrunch points to real MCP failures in GitHub's and Asana's servers.

The Model Context Protocol is why the problem exists at this scale. Anthropic released MCP in 2024 and enterprises adopted it quickly to let agents act inside real systems, but the protocol shipped without much built-in security, so identity, access control, threat screening, and audit became the buyer's problem to solve. [s2, s11, s12, s9]

Runlayer has widened from a security gateway into a platform with three jobs: enable, secure, and control. On enablement, it lets teams start from more than 18,000 available MCP servers, approve and publish a vetted set, and serve them through a governed gateway to the AI clients employees use. On security and control, it ties access to enterprise identity, applies policy, screens tool calls, monitors agent sessions, and keeps audit logs.

The platform screens agent tool calls for MCP-specific attacks. SecurityWeek reports it aims to identify and block prompt injections, tool poisoning, data exfiltration, output manipulation, intent drift, shadow MCPs, and unmanaged agents, and the docs add session-level behavior monitoring that flags manipulation across an agent's run. A separate shadow-AI capability deploys configuration and controls to managed devices through mobile-device-management tools to surface and block unsanctioned MCP servers and skills. Independent research grounds why the screening matters: the MCPTox benchmark characterizes tool poisoning, malicious instructions hidden in a tool's metadata, as a fundamental MCP attack surface.

External validation is strong for a company this young, though it is endorsement rather than measured efficacy. The co-creator of MCP and Cursor's head of security advise the company, and public docs back the marketing pages with deployment guides for hosted and self-hosted AWS, Kubernetes, and Terraform. No independent efficacy benchmark of the screening is public. [s5, s17, s8, s13, s3]

Runlayer competes in the most crowded corner of AI security. TechCrunch calls the gateway the most common type of MCP security product and names Cloudflare, Docker, and Wiz already shipping in the space, so the core gating function is close to table stakes rather than a differentiator.

Runlayer's visible edge is trust, reach, and breadth rather than a unique mechanism. The co-creator of MCP advising, Cursor's head of security endorsing, and named enterprise customers give it standing rivals cannot easily copy, and the move into enablement aims to make Runlayer the place employees build agents, not just the checkpoint they pass through.

The structural question is who ends up owning this layer. A platform that already holds the enterprise's data, identity, or developer tools is the natural owner of agent tool access too, and larger vendors are buying in rather than only building. Snowflake signed a definitive agreement to acquire Natoma, an MCP gateway, and Check Point agreed to acquire Lakera, an agentic-AI security platform. Runlayer is betting it can build an independent business in this layer before a platform owner bundles it away. [s9, s1, s14, s15]

Runlayer launched naming recognizable enterprise customers and now shows named executives vouching for it. The engineering pages carry endorsements from Gusto's CISO and CIO and Jane's Chief AI Transformation Officer, who calls Runlayer the backbone of Jane's AI strategy. The Series A blog names Instacart, Gusto, Decagon, Opendoor, dbt Labs, AngelList, and Lemonade plus a number of Fortune 500s, and The AI Insider reports dozens of customers within months of stealth while TechCrunch reports eight unicorns or public companies among them.

Partnerships extend the motion beyond a customer list. Runlayer's own blog says it is an official Cursor Hooks launch partner able to allow or deny MCP tool calls inside Cursor, a channel that puts the product in front of developers where they already work. That is a distribution path a feature-copying rival cannot reproduce by writing software alone.

The funding has stepped up behind that motion. An initial seed led by Keith Rabois of Khosla Ventures and Felicis preceded the named-logo launch, and a $30 million Series A led by Felicis in June 2026 brought the total raised to $42 million. What the public record still lacks is contract size, retention, or revenue, so the logos and the follow-on round are adoption evidence rather than proof the accounts have expanded. [s4, s7, s10, s9, s16, s8]

Runlayer's founders built AI products and MCP tooling before starting the company. The about page says the founding team raised over $200 million cumulatively across prior companies and created Zapier MCP and Agents. CEO Andy Berman co-founded Nanit and Vowel, which Zapier acquired, and was Director of AI at Zapier. TechCrunch frames him as a three-time founder building a tool to keep business users' AI agents operating securely.

The co-founders bring complementary depth. Tal Peretz led machine learning in the Israeli Air Force and built Zapier's MCP integration, and Vitor Balocco was a staff AI engineer at Zapier who speaks publicly on MCP security. The advisor bench is unusually strong for the stage, including the MCP co-creator, Cursor's head of security, the CEO of Neon, and the chief product officer of SentinelOne.

The credibility gap is that the verifiable prior exit was a productivity product rather than a security company. Berman's track record is real and traceable through a named acquisition, but it sits in workflow software, so the team reads as strong AI builders newly entering security rather than repeat security founders with an established buyer relationship. The advisor relationships help a buyer choose but are not an asset the company owns. [s3, s10, s9]

Runlayer backs its assurance claims with an inspectable trust portal rather than footer badges alone. The Trust Center at trust.runlayer.com, rendered this analysis, lists SOC 2 Type 2, HIPAA, and GDPR in its compliance section and offers a SOC 2 Type II report, a penetration test, and security policies under an access request rather than open download. It also names its subprocessors, including AWS and WorkOS for authentication and directory sync.

The product's own controls are the rest of the trust case. Runlayer ties access to enterprise identity through single sign-on and SCIM directory sync, applies policy to agent connections, screens tool calls, and keeps request and response logs for compliance and incident response. A self-hosted deployment in the customer's own AWS account answers the concern of regulated buyers who will not route agent traffic through a vendor.

The gap a reviewer would still note is breadth and openness of assurance. No ISO 27001 certification appears, the SOC 2 and penetration-test reports sit behind an access request, and no third-party efficacy benchmark of the screening is public. For a company founded in 2025 the attestations also carry a short track record, so a security reviewer pairs the published controls with the gated artifacts and a sales conversation. [s6, s2, s5, s1]

Add analyzed competitors to compare them side by side with Runlayer.

Runlayer sells to the enterprise IT and security team accountable for how employees' AI agents reach company tools. The buyer is the team that must enable agent use across the business while keeping identity, policy, and audit in its own hands, not the individual developer wiring up a personal key.

Independent reporting confirms the pain. The Rising in Cyber 2026 CISO survey reports more than 70 percent running AI agents in production while only 11 percent rate their AI security as comprehensive. Gartner frames the same gap, warning that building agentic AI on MCP raises new attack vectors and immature practices elevate risk.

The segment is broad on paper and concentrated in evidence. Runlayer supports the range of AI clients an enterprise uses and lets teams draw from more than 18,000 available MCP servers, positioning it for any team adopting agents, yet the named customers in fetched sources are a specific set, Gusto, Instacart, Decagon, Opendoor, dbt Labs, and Jane, plus unnamed Fortune 500s. How far it reaches beyond that early cohort the public record does not yet answer.

Runlayer is a platform that enables agent use and secures it in the same place. It lets teams draw from more than 18,000 available MCP servers, approve and publish a vetted set, and serve them through a governed gateway to the AI clients employees use, then ties that access to enterprise identity, with its trust center listing WorkOS for single sign-on and SCIM directory sync. The stated technical claim is control over the whole agent-to-tool path rather than a single integration.

The platform screens agent tool calls for the protocol's own attack surface. Per SecurityWeek it aims to identify and block prompt injections, tool poisoning, data exfiltration, output manipulation, intent drift, shadow MCPs, and unmanaged agents, and the docs add session-level behavior monitoring that flags manipulation across an agent's run. A separate shadow-AI capability, deployed through the customer's mobile-device-management tools, surfaces shadow MCP usage and can block servers not managed by Runlayer. Independent research corroborates the surface: the MCPTox benchmark characterizes tool poisoning, malicious instructions hidden in a tool's metadata, as a fundamental MCP vulnerability distinct from attacks in tool outputs.

External validation is strong for the stage, though it is endorsement rather than measured efficacy. The co-creator of MCP and Cursor's head of security are listed among its advisors and backers, and public docs detail hosted and self-hosted AWS, Kubernetes, and Terraform deployment. No independent benchmark of the screening's detection quality appears in fetched sources, so the efficacy claims rest on the vendor's description plus ecosystem endorsements.

Runlayer launched out of stealth naming recognizable enterprise customers and now shows named executives endorsing it. The AI Insider reports dozens of customers within months of quiet operation, TechCrunch reports eight unicorns or public companies among them, and the company's own pages carry endorsements from Gusto's CISO and CIO and Jane's Chief AI Transformation Officer, who calls Runlayer the backbone of Jane's AI strategy. Named references across non-vendor sources are the clearest traction signal in the record.

Partnerships extend the motion past a customer list. Runlayer's own blog says it is an official Cursor Hooks launch partner able to allow or deny MCP tool calls inside Cursor, putting the product in front of developers where they already work. That is a distribution channel a feature-copying rival cannot reproduce by writing software alone.

The funding has stepped up behind that motion. An initial seed led by Keith Rabois of Khosla Ventures and Felicis preceded the named-logo launch, and a $30 million Series A led by Felicis in June 2026 brought the total raised to $42 million. What the public record still lacks is contract size, retention, or revenue, so the logos and the follow-on round are adoption evidence rather than proof the accounts have expanded.

Runlayer publishes no price in fetched sources, so the charged unit and list rate stay private. The site routes buyers to a demo rather than a self-serve tier, the posture of a vendor selling negotiated enterprise deals, which fits the enterprise IT and security buyer it names.

The likely metering unit is inferable but unstated. Because Runlayer governs access for users, teams, and agents and screens every tool call, cost would plausibly track seats, connected agents, or call volume, the consumption logic adjacent gateway products use, but no fetched page states the unit. What Runlayer believes buyers pay for stays an inference.

The hidden-price posture signals where the company expects the deal to happen. A negotiated enterprise sale may fold the cost into a larger security or platform agreement, though the public record does not describe Runlayer's contract structure, and a developer evaluating the product finds no transparent paid plan or published commercial entry point. Confirming the unit and whether usage is capped would require a sales conversation.

Runlayer is delivered as software the customer deploys and configures. Its docs offer a hosted deployment or self-hosting in the customer's own AWS account through Kubernetes, Helm, and Terraform, so a security team chooses the placement that fits its environment, and the shadow-AI controls deploy through the customer's mobile-device-management tools.

The operational promise is governed access without slowing developers. Approved servers are published to users while unvetted ones go through review, and the same identity and policy the enterprise already enforces apply to agent connections. Runlayer pitches the platform as enforcement that keeps pace with developer demand rather than a review queue teams route around.

The operational risk profile leans on the customer, especially when self-hosted. A self-hosting buyer configures policy and runs the software in its own environment, and the public materials describe tooling and deployment options rather than a managed detection service or an outcome guarantee. Published uptime, support commitments, and incident-response terms do not surface in fetched pages, so a buyer resolves those in the contract.

Runlayer backs its assurance claims with an inspectable trust portal rather than footer badges alone. The Trust Center at trust.runlayer.com, rendered this analysis, lists SOC 2 Type 2, HIPAA, and GDPR and offers a SOC 2 Type II report, a penetration test, and security policies under an access request. It names its subprocessors, including AWS and WorkOS for authentication and directory sync, useful procurement assurance for a product in the path of agent access to sensitive systems.

The product's own controls are the rest of the trust case. Runlayer ties access to enterprise identity with single sign-on and SCIM, applies policy to those connections, and screens tool calls, allowing or denying them. Its documentation adds session-level behavior monitoring that the company says detects manipulation across an agent's full run. A self-hosted deployment lets a regulated buyer keep agent traffic inside its own environment.

The gap a reviewer would still note is breadth and openness of assurance. No ISO 27001 certification appears, the SOC 2 and penetration-test reports sit behind a request gate, and no third-party efficacy benchmark of the screening is public. For a company founded in 2025 the attestations carry a short track record, so a reviewer pairs the published controls with the gated artifacts and a sales conversation.

Runlayer positions itself as the control point for the whole enterprise agent estate, not a single integration. It brokers access between AI clients and the MCP servers, skills, and agents they call, lets teams vet and publish a set drawn from more than 18,000 available servers, and serves them across the AI clients an enterprise uses. The platform claim rests on owning the chokepoint every agent connection passes through.

That chokepoint also makes Runlayer dependent on the ecosystem around it. Its MCP gateway and approved-tool catalog are exposed if MCP stops being how agents reach tools, though the company also sells controls that sit beside the protocol, including enforcement hooks inside the Cursor client and session-level monitoring of an agent's run, and it integrates with identity providers, AI clients, and servers it does not own. The Cursor Hooks partnership shows the upside, an enforcement point inside a popular client, and the dependency in the same move, since that channel belongs to Cursor.

What exposes Runlayer is who ends up owning this layer. A platform that already holds the enterprise's data, identity, or developer tools is the natural owner of agent tool access too, and the nearest rivals drew buyers on exactly that logic. Snowflake signed a definitive agreement to acquire Natoma to extend its governance from data to AI actions, and Check Point agreed to acquire Lakera to fold agentic-AI security into its stack, so the layer Runlayer is building independently is ground platform owners are well placed to absorb.

Runlayer's founders built AI products and MCP tooling before starting the company. The about page says the founding team raised over $200 million cumulatively and created Zapier MCP and Agents, and names CEO Andy Berman for Nanit and for Vowel, which Zapier acquired. TechCrunch frames him as a three-time founder building a tool to keep business users' AI agents operating securely.

The insider standing around the company is unusual for its stage. The co-creator of MCP and Cursor's head of security advise it, and SentinelOne's chief product officer appears among the backers Runlayer lists publicly, signals from the protocol and tool ecosystem rather than vendor demos. That standing helps a buyer choose among gateways that look alike on a feature sheet, though it is a relationship rather than an asset the company owns.

The credibility gap is that the cited prior company exit was in productivity software rather than a dedicated security vendor, though the record shows MCP-security expertise through Balocco. Berman's exit is traceable through a named acquisition but sits in workflow software, so the team reads as strong AI builders newly entering security rather than repeat security founders with an established buyer relationship.