Jan 27, 2026

•

Aidan Sochowski

Announcing Box and Runlayer's partnership on Enterprise MCP

Box and Runlayer are partnering to bring secure AI agent access to enterprise content. Starting today, the official Box MCP server is available in the Runlayer marketplace, and Runlayer is available in the Box integrations Center.

For organizations managing content in Box and adopting AI across their teams, this integration provides a governed path to connect the two.

The Integration

This is a two-way partnership:

In the Runlayer Marketplace: The official Box MCP server is now available for Runlayer customers. Enable it with one click and connect any MCP-compatible AI client to your Box content. Identity enforcement, audit logging, and security scanning are handled automatically.

In the Box Integrations Center: Runlayer is now listed as an official Box integration. Box administrators looking for an enterprise MCP platform can seamlessly enable access to Runlayer, with a streamlined setup path.

Why It Matters

AI agents are only as useful as the data they can access. For most enterprises, that means their contracts, reports, research, and documentation. The challenge is connecting AI to this content without creating security gaps or compliance risk.

Box has built the Intelligent Content Management platform that regulated industries trust. Runlayer has built the enterprise MCP platform that makes AI agent adoption enterprise-ready. Together, we are giving organizations a way to use AI with their most sensitive content, without compromise.

What This Enables

Teams using Box and Runlayer together can:

Query documents through AI. Ask questions across your Box content from Claude, ChatGPT, Cursor, or any MCP client, secured by Runlayer.
Build agentic workflows. Let AI agents leverage Box tools to ask questions, extract metadata, create folders and Hubs, and interact with Box content to complete complex tasks using skills in Runlayer.
Preserve existing access controls. Runlayer enforces Box permissions, so agents can only interact with content that users are authorized to access.
Maintain audit trails. Every agent interaction across clients with Box content is logged by Runlayer for compliance and security review.

For Regulated Industries

Both Box and Runlayer serve enterprises where security is not optional: financial services, healthcare, life sciences, legal. This integration preserves enterprise-grade security in Box while adding the MCP-specific protections that AI adoption requires, including threat detection for tool poisoning, prompt injection, and unauthorized data access.

Get Started

Box customers: Find Runlayer in the Box Integrations Center to connect your content to AI agents securely.

Runlayer customers: Enable the Box MCP server from your Runlayer connector catalog. Setup takes minutes.

The integration is live now.

Jan 27, 2026

•

Aidan Sochowski

Read more

MCP vs CLI Tools: Which is best for production applications?

CLI tools feel familiar to AI agents, but they break down in production due to brittle syntax, poor state management, and dangerous security assumptions. This post explains why CLI-based agent workflows fail and how a single-tool MCP using a known programming language offers a more reliable and secure alternative.

Runlayer Product Update: 1.25.0

This update is about momentum: moving faster in the CLI, getting clearer visibility into what’s running, and debugging with less friction. Expect smoother workflows, better control, and fewer surprises as you build and ship.

MCP Prompt Injection Attacks: How to Protect Your AI Agents

Two near-invisible prompt injection attacks showed how attackers can bypass default enterprise guardrails and trigger silent, ongoing data exfiltration by exploiting user and model trust. Runlayer blocks these attacks by treating every input as untrusted until it passes continuously updated security models trained on the latest real-world exploits.

Cursor Hooks + MCP Security: Official Runlayer Partnership Announcement

Runlayer is an official Cursor Hooks launch partner. With Cursor Hooks, securely allow or deny MCP tool calls with Runlayer's enterprise MCP platform.

Marcin Jan Puhacz

The main takeaways from GitHub’s MCP Vulnerability

GitHub’s MCP vulnerability revealed how AI agents can be weaponized through poisoned context in public repositories. This post analyzes the exploit, explains why permissions alone aren’t enough, and shares practical guardrails for preventing and mitigating agent-driven data exfiltration.

Runlayer Joins Anthropic, OpenAI, & Google as AAIF Founding Member

The Linux Foundation has launched the Agentic Artificial Intelligence Foundation (AAIF), with Runlayer joining sponsors Anthropic, OpenAI, Google, AWS, Microsoft. AAIF now oversees the Model Context Protocol (MCP), reinforcing MCP as a rising standard for AI agent integration. Runlayer supports AAIF’s open, secure, and scalable AI development mission.

Runlayer Raises $11M to Scale Enterprise MCP Infrastructure

MCP Security Risks: Your AI Agent is Probably Leaking Data Right Now

MCP adoption is accelerating across major platforms, but security risks—like malicious servers, prompt injection, and tool-level exploits—are growing just as fast. This post breaks down real attack scenarios that show how easily data can leak when MCP implementations are trusted by default. It also outlines practical defenses for users and builders, plus why companies need audited MCP catalogs, gateway proxies, and sandboxing to stay secure at scale.

Why MCP builders are transitioning from DCR to OAuth CIMD

Over the last year, MCP has surged in adoption. To little surprise, this has introduced some scaling issues. One of these is client registration; previously, systems were rigged together by humans. Today, AI agents discover and interface with MCP servers freely, requiring a new paradigm for client communications.

What is Dynamic Client Registration?

Tired of manually registering every AI agent with every OAuth server? Dynamic Client Registration (DCR) lets your agents authenticate with MCP servers at runtime, no human clicks required. Learn how DCR works, when to use it over traditional OAuth, and why it's becoming essential for scalable agentic systems.