# Runlayer — Full Reference > Runlayer is an enterprise AI platform — the AI control plane and enablement layer for AI agents. It gives every employee a governed “golden path” to use AI agents (Claude, Cursor, ChatGPT, Codex, and agents) by connecting them to approved capabilities, while platform, security, and IT teams enforce identity, policy, runtime security, and audit logging for every request. It is built for enterprises adopting AI agents faster than they can govern them. Runlayer pairs AI enablement (getting everyone delegating work to agents) with an AI control plane (securing and controlling everything agents do). It sits as a governed layer between the AI clients employees already use and company systems, so teams keep one golden path for access, policy, and audit. Agents connect to 18,000+ MCP servers across 300+ AI clients, with threat detection, fine-grained permissions, and complete observability. This is the full-text reference for Runlayer (https://www.runlayer.com), intended for single-fetch ingestion by AI answer engines. The shorter index is at https://www.runlayer.com/llms.txt. ## Key Facts - Company: Runlayer (operated by Anysource Inc.). - Category: enterprise AI platform — AI control plane, MCP gateway, agent identity and governance, runtime security, and observability for AI agents. - Connects AI agents to 18,000+ MCP servers. - Supports 300+ AI clients, including Claude, Claude Code, Cursor, ChatGPT, Codex, GitHub Copilot, VS Code, and Windsurf. - Runlayer Agents is an agent builder for creating governed agents on demand, with native Slack integration and self-healing agents that automatically update and adjust to fix issues and optimize performance. - Runlayer Catalog is Runlayer’s skills and plugins registry for publishing and distributing approved connectors, skills, and plugins to agents. - Compliance: SOC 2 Certified, HIPAA Compliant, and GDPR Compliant. - Runlayer is the only platform to achieve AARM Extended Conformance (R1–R9), the highest tier of the AARM (Autonomous Action Runtime Management) specification — a Vanta-backed open standard for AI agent runtime security created by Herman Errico — meeting the full and extended requirements out of 40+ builders in the AARM ecosystem. - Runtime Security runs tool scans at typical 50–100ms inference times. - Customers include Gusto, Baseten, Homebase, Decagon, PagerDuty, Opendoor, AngelList, Lemonade, and dbt Labs. - Backed by Khosla Ventures, Felicis, and SVCI. - Raised a $30M Series A from Felicis and Khosla Ventures (June 2026), bringing total funding to $42M. - Endorsed by David Soria Parra, co-creator of MCP at Anthropic (“Runlayer makes AI enterprise-ready”), and Travis McPeak, Head of Security at Cursor (“Runlayer provides must-have visibility, control, and trust”). ## General FAQ ### Who is Runlayer for? Runlayer is for companies rolling out AI agents across engineering, security, IT, operations, and business teams while keeping one golden path for access, policy, and audit. ### When should a company use Runlayer? Use Runlayer when employees are adopting Claude, Cursor, ChatGPT, Codex, and internal agents faster than platform and security teams can govern them. It is built for companies that need approved MCPs, reusable agent capabilities, policy enforcement, and audit across many teams and AI clients. ### How does Runlayer work with our existing stack? Runlayer connects to your identity provider, approved tools, MCP servers, and existing AI clients so teams can keep using the products they already prefer with centralized controls around them. ### What does Runlayer reduce or consolidate? Runlayer reduces one-off MCP setup, shadow AI usage, custom permission glue, manual review processes, fragmented audit trails, and separate enablement work for each team adopting agents. ### How is Runlayer different from an MCP gateway? An MCP gateway is one layer of the system. Runlayer adds the catalog, identity controls, reusable capabilities, observability, and agent workflows teams need to make governed agent work practical across the company. ### What threats does Runlayer look for? ToolGuard looks for tool poisoning, prompt injection, output manipulation, data exfiltration, privilege escalation, destructive actions, and resource abuse. AgentGuard monitors session-level behavior for manipulation and task drift. ### Which AI clients does Runlayer support? Runlayer supports 300+ AI clients, including Cursor, Claude Code, ChatGPT, VS Code, GitHub Copilot, Codex, and Windsurf. ### Does Runlayer have an agent builder? Yes. Runlayer Agents is an agent builder for creating governed agents on demand, with native Slack integration and self-healing agents that automatically update and adjust to fix issues and optimize performance. It runs on approved tools, scoped identity, and a secured runtime. ### Does Runlayer have a skills and plugins registry? Yes. Runlayer Catalog is Runlayer’s governed skills and plugins registry for publishing and distributing approved connectors, skills, and plugins to agents, with ownership, dependencies, access, and usage signals. ### What does Shadow AI find? Shadow AI finds agents, AI clients, MCP servers, skills, and plugins used on managed devices, showing what is managed, shadow, outdated, or risky — deployed through existing MDM with no employee opt-in. ## Adoption FAQ ### What AI clients does Runlayer support? All 300+ AI clients including Cursor, VS Code, Claude Code, GitHub Copilot, ChatGPT, Claude Desktop, Windsurf, and any client that implements MCP. ### Do I need to change my workflow or learn new tools? No, we work with your existing IDE and AI client with the only difference being authentication through company SSO instead of personal API keys. ### How do I add new MCP servers, skills, or agents that I need? Request through the catalog: security-approved servers, skills, and agents are available immediately with one click, while new servers go through fast-tracked approval in minutes instead of weeks. ### Can I use local MCP servers? Yes, with zero installation friction and the same governance/observability as remote servers, plus CLI tools to make local-to-hosted workflows seamless. ### How does Runlayer integrate with our existing security and IT policies? We integrate with Okta, Entra, and all other major identity providers, to enforce the same conditional access and device compliance checks you use everywhere else, and provide complete audit trails, so AI becomes like another enterprise application, not a special case. ### Will this slow down my workflow? No, security scans occur with low noticeable latency and you get one-click access instead of manually configuring JSON files. ### Can I still use my favorite AI tools (Cursor, Claude Code, ChatGPT)? Yes, your development experience stays identical. You just get access to vetted, secure MCP servers, skills, and agents instead of random GitHub repos. ### Can I build custom MCP servers and skills for internal APIs? Yes, we help convert internal APIs into MCP servers that appear in the catalog alongside external ones with identical access controls and observability. ### What happens to my existing MCP, skills, and agent configurations and workflows? Minimal disruption: we import existing configurations and your prompts/workflows remain the same, with most teams starting new servers through Runlayer then gradually migrating existing ones. ## Platform ### Platform overview https://www.runlayer.com/platform One platform to accelerate and control AI usage — enablement plus an AI control plane. #### Who is Runlayer for? Runlayer is for platform, security, IT, and AI enablement teams that need employees to keep using agents while moving access, policy, runtime checks, and audit into one golden path. #### How does it work with existing AI clients? Runlayer is designed around the clients employees already use, including Claude, Cursor, ChatGPT, Codex, internal agents, and other MCP-capable tools. The platform adds a governed layer between those clients and company systems. #### What does Runlayer centralize? Runlayer centralizes approved capabilities, connector distribution, identity, policy decisions, runtime security checks, visibility, and audit history so teams do not need separate glue for every agent rollout. #### Where should a company start? Most teams start by identifying the AI clients and MCP sources employees already use, then publishing a golden path with the controls and auditability needed for broader adoption. ### Runlayer Agents https://www.runlayer.com/agents An agent builder for instant, governed agents created on demand — with native Slack integration and self-healing agents that automatically update and adjust to fix issues and optimize performance, backed by approved tools, scoped identity, and a secured runtime. #### How do Runlayer Agents drive AI adoption? They give employees a direct way to delegate recurring work: create an agent for a job, use the tools they are allowed to use, and run it from the places they already work. #### How do employees create Runlayer agents? Employees can create agents on demand from supported clients, including Slack, Claude, Cursor, ChatGPT, Codex, and the web. They define the job, then attach approved connectors, tools, skills, model settings, memory, and run options. #### Where do Runlayer Agents run? Runlayer Agents run through the Runlayer Agents runtime for your deployment. Depending on setup, that can be Runlayer-managed, single-tenant, or customer-hosted infrastructure. #### Can agents run from Slack? Runlayer Agents can be used from Slack when configured. They can also run interactively, on schedules, from webhooks, and through supported AI clients. #### Whose permissions does an agent use? Agents are built on Runlayer’s identity primitives. Activity can include the agent identity and the user it acts on behalf of, with policy and OAuth scope still enforced. #### Can teams share agents? Agents are private by default unless shared with approved users or groups. Owners and admins control access and lifecycle. #### Can agents use internal tools? Agents can use approved Runlayer connectors, including internal MCPs and custom capabilities that platform teams publish through the governed catalog. #### How do teams see what agents are doing? Agent activity includes run history, MCP activity, status, execution trace, security scan results, blocked requests, warnings, token and cost usage, and audit events. #### Who owns an internal agent? Each agent has an owner. Owners and admins manage core settings, access, and the agent lifecycle, from creation and deployment through upgrades and deprecation, along with activity and security history. ### Runlayer MCP Gateway https://www.runlayer.com/mcp-gateway Make approved MCP access the default across Claude, Cursor, ChatGPT, Codex, and agents, with policy, OAuth, runtime security, and an audit trail for every request. #### How is this different from a standalone MCP proxy? A standalone proxy routes traffic. Runlayer adds catalog, approvals, identity-aware policy, real-time security scans, audit logs, analytics, agent accounts, Runlayer Plugin, and Watch. #### Can we use internal MCP servers? Admins can add existing MCP endpoints, deploy custom MCPs to managed infrastructure, or package internal capabilities for approved users and agents. #### Does the Runlayer plugin grant new permissions? Runlayer Plugin exposes capabilities the user already has through Runlayer. Policy, OAuth checks, runtime security, and audit logging still apply when a tool runs. #### Which AI clients can use the gateway? Runlayer supports 300+ AI clients, including Cursor, Claude Code, ChatGPT, VS Code, GitHub Copilot, Codex, and Windsurf. #### How do employees get access to a new MCP server? Employees request connectors from the catalog. Admins approve access, set policy, and publish the connector to approved users, agents, and clients. #### Can access be limited to specific tools inside an MCP server? Runlayer policies can apply to whole servers, specific tools, specific resources, groups, roles, users, agent accounts, clients, and runtime conditions. ### Runtime Security https://www.runlayer.com/guard Catch risky behavior before it runs — inspect tools, outputs, PII, and agent behavior at runtime (ToolGuard and AgentGuard) before risky actions reach company systems. #### What threats does Runlayer look for? ToolGuard looks for tool poisoning, prompt injection, output manipulation, data exfiltration, privilege escalation, destructive actions, and resource abuse. AgentGuard monitors session-level behavior for manipulation and task drift. #### Can security controls be tuned? ToolGuard sensitivity can be set globally or per connector. Policies can include tool, resource, identity, client, network, OAuth, and runtime conditions. #### Where do security events go? Security events appear in the Security dashboard and audit logs. Audit logs can also export to S3 for SIEM ingestion. #### Are Runtime Security checks built for real-time use? Docs list typical 50-100ms inference times for ToolGuard scans, with sensitivity settings global or per connector. #### When does Runlayer scan? Tool List Guard scans definitions at registration. Tool Call Guard and Tool Intent Guard inspect runtime activity around MCP calls. AgentGuard monitors the session trajectory when session scanning is enabled. #### Can Runlayer detect sensitive data in MCP traffic? Runlayer includes PII detection for common sensitive data types, with configurable scan direction and custom rules for organization-specific patterns. #### How does agent security work with access policy? Security findings work alongside policy. Teams can combine ToolGuard, PII detection, identity, client, connector, tool, resource, and runtime conditions. ### ROI & Observability https://www.runlayer.com/visibility See usage, spend, adoption, and audit history across the users, clients, tools, agents, and workflows behind AI work — an audit trail for every action. #### What does ROI & Observability cover? ROI & Observability covers adoption, tool usage, agent activity, spend, policy decisions, blocked requests, findings, failures, and audit history across Runlayer. #### How is ROI & Observability different from Shadow AI? Shadow AI detects unmanaged MCPs, skills, plugins, and client configs. ROI & Observability shows what is happening across approved Runlayer usage and the findings connected to it. #### Can teams trace decisions and outcomes? Yes. Runlayer records decisions and outcomes with actor, client, connector, tool, resource, agent account, credential source, and runtime context where available. #### Can teams export events? Runlayer audit logs and activity events can support export workflows for reporting, investigation, compliance evidence, and downstream analysis. #### Does ROI & Observability include agent runs? Agent activity can include run history, MCP activity, status, execution trace, findings, blocked requests, warnings, token and cost usage, and audit events. #### How does ROI & Observability help adoption? It shows which capabilities people use, where agent work fails, where adoption stalls, and which teams need better approved access. ### Runlayer Catalog https://www.runlayer.com/catalog A governed skills and plugins registry that distributes approved connectors, skills, and plugins to every agent, with ownership, dependencies, access, and usage signals. #### What belongs in Runlayer Catalog? Runlayer Catalog can include approved MCP connectors, skills, and plugins. It is the registry for reusable agent capabilities the company wants people and agents to find and use. #### How is Runlayer Catalog different from MCP Gateway? MCP Gateway governs tool access at runtime. Runlayer Catalog makes approved connectors, skills, and plugins discoverable, reusable, and tied to ownership, dependencies, and usage. #### Can teams publish their own connectors, skills, and plugins? Teams can package useful connectors, skills, and plugins for reuse, while platform owners control review, ownership, dependencies, sharing, and lifecycle. #### How does access work for Runlayer Catalog items? Runlayer Catalog items can be shared with approved users, groups, roles, teams, agents, or clients. Runtime access still depends on policy and credentials. #### Can connectors, skills, and plugins use internal tools? Yes. A connector, skill, or plugin can depend on approved internal MCPs and custom capabilities that platform teams publish through Runlayer. #### How do teams know what to maintain? Usage, failures, access decisions, findings, owners, versions, and audit history show which capabilities are worth improving, retiring, or promoting. ### Agent IAM & Governance https://www.runlayer.com/identity-policy Control what every agent can access by tying each request to an actor, credential source, policy decision, and audit record, across autonomous and delegated access models. #### How are agent identity and policy related? Agent identity establishes who is acting. Policy decides what that actor can do, which tools it can use, which resources it can reach, and which conditions must be true before the action runs. #### What is an agent account? An agent account is a registered client application for an AI service or agent. It can authenticate programmatically, call MCP tools, and use its own policies. #### When should an agent use on-behalf-of access? Use on-behalf-of access when the agent is acting for a specific user and the action should inherit that user’s policy boundaries and audit context. #### What can policies include? Policies can include users, groups, roles, attributes, agent accounts, servers, tools, resources, OAuth state, client, network, tool arguments, and session context. #### Can an agent exceed a user’s permissions? For delegated calls, Runlayer enforces the intersection of the agent account’s policies, the user’s policies, and server-level policies. #### When should an agent use machine-to-machine access? Use machine-to-machine access when an agent runs without a specific user context, such as background jobs, scheduled work, or service-level automation. #### How are OAuth credentials handled for agents? Session grants determine which OAuth credentials an agent account can use. Runlayer supports personal grants and shared grants depending on the use case. ### Shadow AI https://www.runlayer.com/watch Discover and control shadow AI across managed devices via existing MDM, then approve, migrate, remove, or block unmanaged MCPs, skills, plugins, and clients. #### What shadow AI does Runlayer find? Runlayer finds agents, AI clients (such as Claude Code, Codex, and Cursor), MCP servers, skills, and plugins used on managed devices. It shows what is managed, shadow, outdated, or risky. #### Can Runlayer help with shadow agent detection? Runlayer focuses on the MCP, skill, plugin, and client configuration layer that agents use to reach tools. When agents or AI clients rely on unmanaged MCP servers or plugins on managed devices, Runlayer surfaces those artifacts for review and response. #### Does Runlayer require employees to opt in to shadow AI discovery? Runlayer deploys through existing MDM, so teams can scan managed devices for shadow MCPs, skills, plugins, and client configs without asking employees to install or approve anything. #### What can teams do with Runlayer shadow AI findings? Teams can migrate useful MCPs and skills into Runlayer, approve trusted usage with ownership and policy, remove stale configuration, or block high-risk shadow MCP activity. #### Which devices can Runlayer scan? Runlayer scans supported clients on macOS, Windows, and Linux. MDM rollout guides cover macOS and Windows, with custom and manual options for other environments. #### Which clients support blocking high-risk shadow activity? Runlayer can block shadow MCP activity in Cursor, Claude Code, and Codex on macOS today, with Windows and additional clients in development. #### How do platform and security teams use the inventory? IT & Security leads response. Platform and AI Transformation use the same inventory to see which capabilities employees are already trying to use. ## Solutions ### AI Transformation https://www.runlayer.com/solutions/ai-transformation Give employees a golden path to useful agents, with platform and security controls built in. #### How does Runlayer help beyond basic AI adoption? Runlayer gives employees approved agents, tools, and access for delegating real work, while platform and security teams keep the rollout governed. #### Can employees keep using their preferred AI clients? Yes. Runlayer publishes approved capabilities into the clients teams already use, including Cursor, Claude Code, ChatGPT, VS Code, GitHub Copilot, Codex, and Windsurf. #### How do platform and security teams stay involved? Identity, policy, security checks, audit history, and usage data stay attached to every approved capability and agent as adoption expands. ### AI Platform https://www.runlayer.com/solutions/ai-platform Publish approved tools and agents as reusable infrastructure across teams. #### How does Runlayer fit with our existing AI clients? Runlayer supports 300+ AI clients, including Cursor, Claude Code, ChatGPT, VS Code, GitHub Copilot, Codex, and Windsurf. #### Can we bring internal MCP servers and custom tools? Yes. Platform teams can add internal MCP servers, package custom tools, and publish them as governed capabilities in the catalog. #### How does this reduce platform bottlenecks? Runlayer turns repeated setup, access, credential, policy, and audit work into reusable infrastructure that teams can consume without starting a new one-off project. #### How does Runlayer integrate with identity and policy? Runlayer connects users, agents, clients, connectors, OAuth grants, policy decisions, and audit history in the same runtime flow. ### IT & Security https://www.runlayer.com/solutions/it-security Give teams a golden path to AI usage, with security and governance built in. #### Does shadow detection require users to opt in? Shadow AI runs through existing MDM deployment, so IT & Security can find unmanaged MCPs, skills, plugins, and client configs across managed devices. #### What does Runlayer detect? Runlayer detects unmanaged MCP servers, skills, plugins, AI client configs, risky tool usage, security findings, and adoption patterns across the company. #### How does Runlayer handle risky usage? Teams can convert useful patterns to managed access, apply identity and policy, run runtime security checks, and block risky actions or configurations when needed. #### How is access governed for users and agents? Access can be scoped by user, group, role, agent, AI client, connector, tool, OAuth state, runtime context, and security findings. ## Customers ### Gusto: How Gusto Ignited an AI-Driven Workflow Revolution Across 3,000+ Knowledge Workers With Runlayer https://www.runlayer.com/customers/gusto Gusto adopted Runlayer to wrangle decentralized AI experimentation through a unified command-and-control plane that securely connects tools, agents, and MCPs. ### Jane App: Jane App Moves 800+ Knowledge Workers From AI Experiments to Production Workflows With Runlayer https://www.runlayer.com/customers/jane-app Jane App adopted Runlayer as its AI command-and-control plane, driving AI adoption across the organization while unlocking 360-degree observability for every deployment. ### Homebase: Homebase Scaled Governed AI Workflows to 400+ Employees in Under 5 Months With Runlayer https://www.runlayer.com/customers/homebase Homebase implemented Runlayer to turn an environment of disparate MCP and agent experimentation into a governed, observable ecosystem that accelerated the path to AI transformation. ## Blog ### Runlayer AI Spend & ROI: comprehensive, defensible, and flexible by design https://www.runlayer.com/blog/runlayer-ai-spend-and-roi Most enterprises can tell you what they spend on AI. Very few can tell you what that spend produced. Runlayer AI Spend & ROI ties every AI session to the work it created, so you can prove real ROI to Finance and the board. ### Runlayer Sessions & Shadow AI: proactive, deep, and built for enterprise scale https://www.runlayer.com/blog/runlayer-sessions-and-shadow-ai Runlayer Sessions & Shadow AI gives security teams what they've been missing: pre-execution scanning, full session telemetry across every tool call and reasoning step, and enterprise-scale deployment that covers every endpoint from day one. ### Runlayer Agents: powerful, optimized, and secure by design https://www.runlayer.com/blog/runlayer-agents Enterprises shouldn't have to choose between shipping agents fast or knowing those agents are secure. Runlayer doesn't make you choose. Runlayer Agents are powerful, secure by design, and easy to use. ### Runlayer named an AI Security Endpoint Leader in Latio’s 2026 AI Security Market Report https://www.runlayer.com/blog/runlayer-named-ai-security-endpoint-leader-in-latio-report Runlayer is proud to be recognized as an AI Security Endpoint Leader in Latio's 2026 AI Security Market Report. Runlayer provides in-depth security and control of AI use on the endpoint, delivering the golden path to AI transformation. ### 3 lessons from Fal.Con 2026 on securing AI agents https://www.runlayer.com/blog/3-lessons-from-fal-con-2026 The Runlayer team spent the week at Fal.Con 2026 hearing how top security leaders are securing AI agents, and we're recapping the top takeaways here. Learn how to apply the security fundamentals to agents that move at machine speed. ### Runlayer agents are now in Slack, and secure by design https://www.runlayer.com/blog/runlayer-agents-now-in-slack Runlayer is a launch partner for "Add to Slack", bringing governed agents into the place employees get work done. With Runlayer, it's easier than ever for employees to build and run agents without compromising on security. ### Run Kimi K3 with Baseten Inference + Runlayer Agents https://www.runlayer.com/blog/run-kimi-k3-with-baseten-inference-runlayer-agents Runlayer agents can now run on open-source models served by Baseten, frontier-class performance, on inference you control. ### Join Runlayer at Black Hat 2026 https://www.runlayer.com/blog/runlayer-black-hat-2026 Meet the Runlayer team at Black Hat USA 2026 in Las Vegas, August 1–6. Book a private executive briefing at the Four Seasons or join us for Supercar Track Day at SpeedVegas on Wednesday, August 5. ### We Raised $30M to Help Companies Go All In on AI https://www.runlayer.com/blog/series-A-30m-fundraise-felicis-khosla We've raised a $30M Series A from Felicis and Khosla Ventures, bringing total funding to $42M, to build the golden path for AI: one platform that lets every team build agents without losing security and control. ### What are the Best Practices for AI Agent Audit Trails https://www.runlayer.com/blog/ai-agent-audit-trails-dos-and-donts When an agent makes the wrong call, your audit trail is the only record of what happened. Here's what most logs leave out and how to fix yours before an incident. ### Traditional API Observability versus MCP Observability https://www.runlayer.com/blog/api-observability-vs-mcp-observability APM tools assume deterministic systems. AI agents break that at the client. Here's why MCP traffic defeats traditional observability, and why the real gap is reconstructing intent from a trace. ### Breaking down the latest MCP Authorization SEPs https://www.runlayer.com/blog/the-latest-MCP-Authorization-SEPs MCP's new authorization hardening RC quietly landed six spec fixes that most people glossed over. We broke them down into three problem clusters: trust domain confusion, credential lifecycle management, and authorization boundaries. ### Runlayer and Anthropic MCP Tunnels: connecting Claude to systems behind your firewall https://www.runlayer.com/blog/anthropic-mcp-tunnels Runlayer and Anthropic collaborated on MCP Tunnels, which invert the connection direction so your network reaches out to Anthropic instead of exposing inbound ports, removing the security wall that blocks Claude from accessing internal systems like Jira, databases, and telemetry. ### Don’t build your own MCP gateway https://www.runlayer.com/blog/mcp-gateway-build-vs-buy Senior engineers look at an MCP gateway and see a reverse proxy with auth and logs. That instinct is wrong. MCP attack vectors shift constantly, performance breaks at scale in specific ways, and threat detection requires MCP-specific signals that generic tools miss. ### Fine-Grained Permissions and Identity Management for AI Agents https://www.runlayer.com/blog/ai-agent-identity-permissions-management MCP adoption has exploded inside enterprises, with shadow servers and over-provisioned agents creating an attack surface most security teams haven't caught up to. Traditional IAM, OAuth, and RBAC weren't built for non-deterministic agents that delegate to other agents. ### Runlayer named to Rising in Cyber 2026 https://www.runlayer.com/blog/rising-in-cyber-2026 Runlayer was named to Notable Capital & Morgan Stanley's 2026 Rising in Cyber list, voted on by 150 sitting CISOs. Andy Berman on why the recognition matters, and what it signals about how AI-native companies are getting built. ### Why production AI systems need MCP gateways https://www.runlayer.com/blog/MCP-gateways An MCP gateway acts as the centralized proxy layer for agent-to-tool communications, handling tool discovery, authentication, input/output filtering, and observability across an organization's agentic systems. ### The MCP STDIO RCE class, and why Runlayer doesn't run what the LLM asks it to https://www.runlayer.com/blog/mcp-stdio-rce-class-why-runlayer-doesnt-run-what-llm-asks OX Security found a design-level flaw in Anthropic's Model Context Protocol. MCP's STDIO transport turns a config file into a command executor. Here's how Runlayer's control plane breaks each of the four attack vectors. ### Runlayer and AARM Partner to Secure Enterprise Agents https://www.runlayer.com/blog/runlayer-and-aarm-partner-to-secure-enterprise-agents Runlayer achieves AARM Extended Conformance (R1–R9), partnering with the Vanta-backed open specification to define how enterprises secure AI agents at runtime. ### What Project Glasswing means for enterprise security https://www.runlayer.com/blog/what-project-glasswing-means-for-enterprise-security What Project Glasswing and Claude Mythos mean for enterprise security teams, and why your patch workflows, dependency management, and MCP governance need to evolve now. ### The Danger of Fake MCP Servers https://www.runlayer.com/blog/fake-mcp-servers-security-risks-prevention Fake MCP servers pose a growing security risk, enabling data leaks, tool poisoning, and compromised AI behavior. Learn how these attacks work and how organizations can prevent them with proper controls and monitoring. ### Runlayer + 1Password: Secure Credential Access for AI Agents https://www.runlayer.com/blog/1password-partnership Runlayer and 1Password partner to bring secure, auditable credential access to autonomous AI agents. The integration lets enterprises inject secrets from 1Password vaults into agent sessions managed by Runlayer, replacing plaintext .env files with centralized governance, real-time retrieval, and full audit logging across human and non-human identities. ### Honestly, MCP doesn’t “suck” https://www.runlayer.com/blog/mcp-vs-cli-for-ai-agents Garry Tan recently argued that MCP “sucks,” citing context-window bloat and weak authentication. This article breaks down why those criticisms miss the mark, and why MCP remains the better foundation for agents operating at enterprise scale. ### FGA is not enough for your agent authorization https://www.runlayer.com/blog/for-agents-pbac-beats-fga PBAC beats FGA for agent authorization, context-aware, auditable, asymmetric access control without graph complexity. ### OpenAI Agent Builder’s MCP Problem https://www.runlayer.com/blog/openai-agent-builders-mcp-problem OpenAI AgentKit/Agent Builder launched in Oct 2025 but, despite early hype, its limited integrations and weak security (e.g., unverified MCP servers, no namespace isolation, insufficient guardrails) create a large enterprise attack surface, prompting calls for controls like a trusted MCP catalog, tool gateway auditing, RBAC/least privilege, and stronger governance (e.g., via Runlayer). ### Pwning OpenClaw in 50 Messages: Social Engineering Claude Opus Into Handing Over the Keys https://www.runlayer.com/blog/pwning-openclaw-in-50-messages A Claude Opus–powered OpenClaw agent with Slack and shell access was social-engineered in ~50 messages to rebind its UI, install ngrok, expose the dashboard publicly, reveal its gateway token, and approve the attacker’s device. ### Unpacking the OWASP Top 10 for MCP https://www.runlayer.com/blog/owasp-mcp-top-10-security-risks-guide An overview of the OWASP MCP Top 10, highlighting the biggest security risks in MCP-enabled AI systems and the key safeguards teams can use to prevent them. ### MCP Apps highlight the power of protocol governance https://www.runlayer.com/blog/mcp-apps-highlight-the-power-of-protocol-governance MCP Apps let tools render interactive UIs directly in chat via the same MCP protocol, not a new execution path. With Runlayer intercepting tool calls, resource fetches, and auth headers, existing MCP security controls apply from day one. ### Announcing Box and Runlayer's partnership on Enterprise MCP https://www.runlayer.com/blog/box-and-runlayer-mcp-partnership Connect AI agents to Box content with enterprise security. The official Box MCP server is live in the Runlayer marketplace, with identity enforcement, audit logging, and threat detection built in. Box customers can find Runlayer in the Box Integrations Center. Setup takes minutes. ### MCP vs CLI Tools: Which is best for production applications? https://www.runlayer.com/blog/mcp-vs-cli-for-ai-agents-choosing-the-right-interface CLI tools feel familiar to AI agents, but they break down in production due to brittle syntax, poor state management, and dangerous security assumptions. This post explains why CLI-based agent workflows fail and how a single-tool MCP using a known programming language offers a more reliable and secure alternative. ### Runlayer Product Update: 1.25.0 https://www.runlayer.com/blog/runlayer-product-update-1-25-0 This update is about momentum: moving faster in the CLI, getting clearer visibility into what’s running, and debugging with less friction. Expect smoother workflows, better control, and fewer surprises as you build and ship. ### MCP Prompt Injection Attacks: How to Protect Your AI Agents https://www.runlayer.com/blog/protecting-yourself-from-last-weeks-prompt-injection-attacks Two near-invisible prompt injection attacks showed how attackers can bypass default enterprise guardrails and trigger silent, ongoing data exfiltration by exploiting user and model trust. Runlayer blocks these attacks by treating every input as untrusted until it passes continuously updated security models trained on the latest real-world exploits. ### Cursor Hooks + MCP Security: Official Runlayer Partnership Announcement https://www.runlayer.com/blog/cursor-hooks Runlayer is an official Cursor Hooks launch partner. With Cursor Hooks, securely allow or deny MCP tool calls with Runlayer's enterprise MCP platform. ### The main takeaways from GitHub’s MCP Vulnerability https://www.runlayer.com/blog/github-mcp-ai-agent-security-vulnerability GitHub’s MCP vulnerability revealed how AI agents can be weaponized through poisoned context in public repositories. This post analyzes the exploit, explains why permissions alone aren’t enough, and shares practical guardrails for preventing and mitigating agent-driven data exfiltration. ### Runlayer Joins Anthropic, OpenAI, & Google as AAIF Founding Member https://www.runlayer.com/blog/runlayer-joins-anthropic-openai-google-as-aaif-founding-member The Linux Foundation has launched the Agentic Artificial Intelligence Foundation (AAIF), with Runlayer joining sponsors Anthropic, OpenAI, Google, AWS, Microsoft. AAIF now oversees the Model Context Protocol (MCP), reinforcing MCP as a rising standard for AI agent integration. Runlayer supports AAIF’s open, secure, and scalable AI development mission. ### MCP Security Risks: Your AI Agent is Probably Leaking Data Right Now https://www.runlayer.com/blog/your-ai-agent-is-probably-leaking-your-data-right-now MCP adoption is accelerating across major platforms, but security risks, like malicious servers, prompt injection, and tool-level exploits, are growing just as fast. This post breaks down real attack scenarios that show how easily data can leak when MCP implementations are trusted by default. It also outlines practical defenses for users and builders, plus why companies need audited MCP catalogs, gateway proxies, and sandboxing to stay secure at scale. ### Why MCP builders are transitioning from DCR to OAuth CIMD https://www.runlayer.com/blog/why-mcp-builders-are-transitioning-from-dcr-to-oauth-cimd Over the last year, MCP has surged in adoption. To little surprise, this has introduced some scaling issues. One of these is client registration; previously, systems were rigged together by humans. ### What is Dynamic Client Registration? https://www.runlayer.com/blog/what-is-dynamic-client-registration Tired of manually registering every AI agent with every OAuth server? Dynamic Client Registration (DCR) lets your agents authenticate with MCP servers at runtime, no human clicks required. ### Scale MCP with Dynamic Tool use https://www.runlayer.com/blog/scale-mcp-with-dynamic-tool-use Dynamic tool use cuts token waste from MCP by replacing bulk tool loading with lightweight search, saving cost without custom implementation. _Last updated: 2026-10-08._