Runlayer, under the hood

The company behind the category story

Runlayer is a real, fast-moving technical company. It is also a repeat-founder commercialization machine with unusually strong protocol, Cursor, investor, CISO, and prior-team advantages. Both facts matter.

The ten points worth remembering

1. The platform thesis came before MCP. Vowel was already becoming an AI command center that queried company apps and initiated actions. Early Anysource described an AI enablement layer with connectors, identity, observability, no-code agents, SSO/SCIM/RBAC, and private deployment. MCP supplied a sharp, urgent category wedge.
2. The hidden product is forward-deployed transformation. Gusto received connector building and recurring training. Homebase had engineers in Slack daily. The field team says its bottleneck is converting pilots to thousands of users. Software is only part of the delivered outcome.
3. Runlayer learned that fear did not close. Its founder says the early security pitch was backwards. Customers moved when the pitch became “help the company adopt AI faster without losing control.” Governance supports the purchase; acceleration drives it.
4. The new agent story is ahead of the public customer proof. The runtime is technically substantial, but the clearest case metrics are users, MCP counts, integration time, and human connector calls. Homebase explicitly calls the full agent operating model its next phase.
5. Watch is a supported-surface product, not omniscience. It finds configs, artifacts, processes, transcripts, and hook events on managed devices. Client and operating-system coverage differs. Linux is detect-only; unmanaged endpoints and many cloud paths remain outside it.
6. “Local MCP” does not mean local policy. The CLI can keep actual execution local while sending eligible tool metadata, arguments, and outputs to tenant pre/post endpoints for policy and scanning. Customer hosting changes the destination, not the conceptual flow.
7. ToolGuard is young. Its public model changelog starts April 2026 and records rapid retraining and architecture changes. Published performance numbers lack an independent public corpus or replication.
8. Notion reveals a second business. Its official subprocessor register names Runlayer for security for MCP connections. The likely surface is Notion Custom Agents, but Notion does not map specific controls to Runlayer. This is embedded agent-product infrastructure, not the standard employee control-plane sale.
9. The first customer graph overlaps the investor and advisor graph. Gusto, dbt, AngelList, Opendoor, Lemonade/SVCI, protocol creators, Cursor leaders, and security executives appear across customers, advisors, investors, and partners. It is brilliant distribution, but not a neutral sample of cold-market conversion.
10. Rippling exposes the danger of the motion. Runlayer says a near-year prospective trial involved code and roadmap access before a competing product appeared; Rippling denies misuse. The uncontested lesson is that long embedded trials need commercial and information boundaries.

Three execution planes, one control model

The durable product is not “an MCP proxy.” It is normalization: different clients and runtimes become the same identity, permission, scanner, approval, and trace model.

Native agent runtime: more than a prompt wrapper

What crosses the boundary and where it can fail

The architecture is conventional and credible. The hard diligence questions are coverage, data flow, fail-open behavior, model efficacy, and how much is actually contractual.

Managed remote MCP

Local MCP

Endpoint and browser gaps

Identity and credentials

• Agent Accounts use OAuth client credentials and RFC 8693 token exchange for delegated on-behalf-of access. Effective permission is the intersection of agent and user policy.
• Agent identity lives in Runlayer, not necessarily as an Okta or Entra service identity. One-hour tokens mean secret rotation does not revoke already-issued stateless tokens immediately.
• Resource/audience enforcement is documented as optional and off by default. Delegation and OAuth session grants have separate revocation paths.
• The hosted OAuth broker simplifies vendor callbacks for a limited set of services. Self-hosted customers must bring their own vendor applications.
• Identity Forward supports preferred short-lived EdDSA JWTs or plain headers. Plain headers are spoofable unless direct upstream access is blocked by the network.

Guard maturity

Infrastructure

Public docs and trust material point to React, FastAPI/Alembic, PostgreSQL, Redis, S3 or GCS, background workers, OpenTelemetry, AWS ALB/WAF/ECS/Fargate/Aurora/ElastiCache, plus EKS/GKE/Helm/operator self-hosting. Hook/session pipelines use streaming and object-store/Parquet materialization. WorkOS supports enterprise identity, with KMS/Secrets Manager and Sentry-related components disclosed in the trust center.

This is good enterprise engineering, not a proprietary new computing substrate. The moat must come from surface coverage, policy semantics, operational data, customer rollout, and embedded workflows.

Public artifact trail

The CLI shipped roughly 75 versions between October 2025 and August 2026. That cadence is evidence of execution and also of product volatility. Package, docs, SDK, Terraform, and plugin versions do not always move together.

What Watch uploads and does not upload

Other interception points

Connector work is pragmatic, not magical

Evidence-based maturity map

External partnership validation

• Cursor: Cursor's own Hooks partner material and marketplace validate the endpoint integration. Cursor security leaders are also advisors/investors, so testimonial and customer status are separate questions.
• Box: Box's own blog confirms marketplace, identity enforcement, audit, and scanning around Box MCP.
• 1Password: 1Password confirms op:// request-time secret retrieval without storing those secrets on disk or in Runlayer's database.
• AARM: an external conformance review validates Runlayer within its declared interception surface. AARM is young and does not prove universal coverage or model efficacy.
• AAIF: the Linux Foundation announcement lists Runlayer as a Gold member/supporter. Anthropic, Block, and OpenAI supplied the founding project contributions. “Founding member” should not be read as co-author of MCP.

What each account is actually buying

A logo is not a deployment. The table below separates detailed production evidence, thin but credible usage, hidden vendor evidence, endorsements, and a failed trial.

The actual closing machine

The sales loop combines founder credibility, strategic networks, a diagnostic wedge, embedded engineering, change management, and land-and-expand product packaging.

Buyer profile

Why it works

A second GTM lane: embedded infrastructure

Notion is the clearest evidence that Runlayer can sell into an agent-product builder rather than an internal AI transformation team. In that lane, Runlayer becomes part of another company's security and MCP connection path and may process that company's end-customer data. The buyer is more likely product, platform, and product security; the integration and contract are closer to OEM infrastructure; the unit of expansion is product usage rather than employee seats. Exact Notion implementation, champion, and economics are not public.

The wedge narrowed, then the platform reappeared

The simplest public story says Runlayer started as MCP security and expanded. The evidence suggests a broader pre-existing AI command-center thesis, temporarily narrowed for market entry.

Founding advantage

The capability layer becomes the durable asset

The narrow framing is “Okta for MCP.” The larger framing is a system of record for governed capabilities that survives model, client, and agent churn.

The flywheel they are trying to create

A crowded stack, with bundling as the real threat

Runlayer competes across several markets because its platform spans them. The nearest startup is not necessarily the greatest strategic threat.

Threat ranking

1. Microsoft / Okta / AWS / ServiceNow: most dangerous because procurement and control can be bundled into installed platforms.
2. Native model and client vendors: can make gateway and policy features default, especially within their own surfaces.
3. Direct MCP control startups: closest feature overlap and pricing pressure, but equally exposed to bundling.
4. Agent builders and connector platforms: can move upward into governance once they own repeated workflow usage.
5. Internal platform teams: remain the alternative when control requirements or economics justify assembly.

Runlayer's strongest defense is not “more security features.” It is becoming the neutral adopted layer across otherwise competing ecosystems, then owning the inventory, capability graph, policy, trace, and improvement loop.

What to believe, discount, and ask next

Twenty diligence questions

Legal and commercial limits

Public terms support custom order forms, possible usage billing, auto-renewal, and up to a 5% renewal increase absent different order terms. Beta services can be withdrawn. Security commitments include encryption, testing, log and recovery targets, but customer-hosted customers must apply patches and customers retain responsibility for backup/archive/retention of their data. The website terms say feature, security, compliance, and future descriptions are informational and non-contractual. Trust reports are gated.

Use the MSA, Security Addendum, DPA, and Trust Center as diligence sources, not the homepage badges alone.

Steal the learning, not the surface area

The overlap is now substantial. That is category validation, not a reason to force artificial differentiation. The best lessons concern wedge, buyer, rollout, durable ownership, and honest measurement.

1. Land on a useful existing agent. A creator with repeat usage and a second user proves the job before IT buys infrastructure. Start from demonstrated pull, then promote the agent into company operations.
2. Make the diagnostic show useful work and risk together. Inventory agents, skills, credentials, schedules, owners, clients, and successful repeated workflows. Do not reduce discovery to a scary count of shadow tools.
3. Target a buyer who owns both adoption and control. CISO approval without an AI operator produces shelfware. An AI champion without IT authority produces shadow infrastructure. The dual mandate closes.
4. Observe before enforcing. A defined visibility phase identifies real usage, stakeholders, and permission boundaries and avoids breaking the power users creating internal pull.
5. Embed deeply, but productize aggressively. FDE work is priceless early discovery. Track each custom connector, identity exception, policy, and training intervention until repeated work becomes standard product.
6. Own the maintained job, not the current interface. Claude Code, Codex, Cursor, Slack, and future agents are work surfaces. Durable value is job definition, context, credentials, approvals, schedule, execution, recovery, and operator responsibility.
7. Measure work completed without the creator. Second-user adoption, scheduled-run reliability, completed jobs, intervention rate, recovery time, and business outcome are stronger than seats and tool calls.
8. Protect the pilot. Agree on price range, conversion date, success criteria, source access, roadmap disclosure, ownership, and clean termination before embedding for months.
9. Keep an evidence-grade customer ledger. Separate paid production, paid pilot, free trial, design partner, investor/advisor, ecosystem partner, logo permission, active-user depth, and actual autonomous runtime.
10. Do not underread Runlayer. It is no longer merely MCP security. It is moving toward the same company-agent operating layer. Decawork can coexist in a large market while learning from a formidable adjacent execution.

How this reconstruction was made

Sources were triangulated across official pages, technical artifacts, customer-side posts, independent reporting, archived pages, legal terms, job descriptions, registries, forums, and ecosystem evidence. Official claims are not treated as independent proof.

This file is self-contained and print-friendly. Use the browser print dialog to save a PDF with source URLs.