Open Protocol, Locked Gates: Runlayer v. Rippling and the First Trade Secret War Over MCP

The complaint landed without fanfare, but the timing is doing heavy lifting. Runlayer, a company most of the market had never heard of, is suing Rippling — a platform that sits on payroll, IT, and HR data for tens of thousands of businesses — over an enterprise MCP gateway. The alleged offense is not patent infringement, not copyright piracy, and not a breach of an open-source license. It is trade secret misappropriation, the quietest and often the most lethal weapon a startup can pull when it believes its crown-jewel architecture was lifted after a sales cycle. The phrase that jumps out of the complaint is "almost a 1:1 copy." That is not the language of feature parity. That is the language of file-level or architecture-level replication. Filtering signal from the ICO noise, I have learned to be suspicious when lawyers reach for adjectives instead of exhibits. But this particular adjective is precise enough to define the entire battle. The suit is the first trade secret case in the MCP ecosystem, and it could not have arrived at a more volatile moment. The Model Context Protocol has just finalized its stateless spec. Snowflake and AWS have both rolled out their own gateway products. Every AI infrastructure builder on the market is positioning for enterprise procurement, and enterprises are starting to notice that the most important connector between an AI agent and corporate data is not the model, not the RAG pipeline, not the fine-tuned LoRA — it is the gateway that sits between them and decides what the agent is allowed to see, do, and remember. Runlayer and Rippling are now fighting over a layer of the stack that barely existed eighteen months ago. The resolution of that fight will shape who gets to own the toll booth of AI agent economics for the next three to five years. That is why this case deserves a technical autopsy, not a single paragraph in the trade press. For anyone who has not spent the last year inside an AI integration warehouse, the Model Context Protocol is Anthropic's open standard for letting agents connect to external tools, databases, and APIs. Think of it as the HTTP of agentic AI: a uniform way for a model to request a file, query a database, or trigger a workflow, without hardwiring the model to every vendor's proprietary API. The standard has spread with a speed that would make an evangelist blush. But HTTP was only a transportation protocol. The moment you place a corporate network between a web client and a mainframe, you discover that the real product is not the protocol at all. It is the proxy, the firewall, the identity provider, the audit log, and the policy engine. MCP is walking the same path. The spec defines how messages move; it does not define who gets to pass, what they can read, or how their actions are traced. That gap between transportation and governance is where Runlayer built its moat. Its gateway is not a thin API proxy. It is a centralized control plane covering authentication, fine-grained access control, observability, and policy execution. In enterprise agent architecture, these are the control points that separate a demo from a production deployment. A raw model pointed at a database will happily exfiltrate everything it can reach. The gateway is the bouncer, the biographer, and the rules engine in one box. The engineering complexity of doing that correctly is an order of magnitude greater than building a simple reverse proxy. And because MCP's stateless spec was only recently finalized, the standard's example code and best practices are still immature. Runlayer's specific deployment architecture — the way it sequences authentication, routes requests, caches permissions, and traces data lineage — is exactly the kind of intangible asset that trade secret law was designed to protect. Chasing alpha through the 2017 hallucination taught me that when a standard is young, the people who move fastest get to define what "default" means. Runlayer was moving fast enough to believe that its defaults were worth protecting. The commercial sequence matters. Runlayer followed the classic enterprise playbook: trial access, NDA, then price negotiation. When the price talks broke down, it paused service rather than cut its rate. Rippling then announced it would build its own gateway in-house. Whether that decision was born of frustration, ambition, or both is unclear. What is clear is that a company with access to a deep well of enterprise HR and payroll data decided that the gateway was too strategically important to keep renting. That decision is a reverse proof of the gateway's value. If the layer were trivial, Rippling would have bought the software and moved on. Building an enterprise-grade gateway from scratch is a meaningful engineering commitment. You only make that commitment when you believe the asset is a future profit center, not a vendor line item. The speed of this transition is easy to underestimate. Two years ago, MCP was a GitHub repository with a handful of reference clients. Now it appears in procurement checklists. CIOs are being asked to review "AI agent security baselines," and MCP compliance is becoming a checkbox in enterprise security questionnaires. The gateway is the entity that earns a certification of that compliance. That raises the strategic value of the component beyond its engineering function. A gateway that can prove — through audit logs, policy enforcement, and data lineage reports — that it meets enterprise compliance requirements is no longer a piece of software. It is an insurance policy. The result is that the literal code matters less than the trust framework around it. And trust frameworks are precisely the kind of thing that trade secret law can either protect or suffocate. Layered standards have a law of their own. Every layer that gets standardized and commoditized shifts value to the layer directly above it that remains unstandardized and proprietary. TCP/IP standardized transport; value moved to application protocols, then to browsers, then to search, then to identity. In the MCP stack, the wire format is now open and free. The result is not the democratization of agent infrastructure. It is the creation of a new chokepoint. The gateway sits at that chokepoint because the protocol made it that way. Consider the stateless spec, which most coverage treats as a boring footnote. A stateless protocol does not carry session information between messages. Each request from an agent is independent, which is wonderful for horizontal scaling and terrible for security auditing. With no state in the protocol, state must live somewhere else. The obvious place is the gateway. Session management moves there. Context retention moves there. Permission caching moves there. Data provenance tracking moves there. And the careful construction of audit trails that tell a compliance officer exactly which agent accessed which record on which day moves there too. In other words, the standards body, by choosing statelessness, relocated the meat of enterprise governance from the protocol into the gateway. That is not an accident. It is not a conspiracy. It is the oscillation that happens whenever an open standard's authors try to keep the spec minimal. Minimal specs are beautiful and flexible. They also create enormous surface area for proprietary implementations. Runlayer's entire business is the exploitation of that surface area. Snowflake and AWS are doing the same thing. The market has noticed that the gateway is not an accessory to the agent; it is the gatekeeper of the agent. The gateway's economic posture is best understood as a toll gate. Every inbound agent request that touches an enterprise system becomes a toll event. If the gateway also owns the policy engine, the audit trail, and the data lineage graph, it can charge not just for the call but for the proof that the call was legitimate. That dual-hatted position — both the door and the ledger — is what separates a commodity middleware product from a strategic infrastructure franchise. It is also the reason Rippling, a data platform rather than an AI company, decided that the toll booth needed to be its own. That is why the "almost 1:1 copy" allegation is so potent. If Runlayer can prove that Rippling's gateway code mirrors its own architecture in places that the MCP spec does not dictate, the case stops being about two companies making similar products and becomes about one company taking a competitor's secret sauce. The smart contract never lies; in the enterprise world, the source control history is the closest thing to a smart contract. Every commit is a signed testimony. Every architectural decision leaves fossil traces. If Runlayer embedded watermark code, unique configuration files, or deliberately odd naming conventions, discovery will unmask Rippling's build in a brutal way. But there is an equally powerful defense available to Rippling. If the MCP reference implementation is public — and for most open standards it is — any implementer can argue that its gateway is a faithful implementation of the standard's expected behavior. A court will have to separate the functional requirements of protocol interoperability from the non-required, stylistic, and architectural choices that exceed what the standard mandates. That is the hardest technical question in the case. It is also the most important. If a court cannot articulate that boundary, every enterprise gateway on the market becomes simultaneously a potential plaintiff and a potential defendant. The first depositions of expert witnesses in this case will read less like legal testimony and more like a pulled-apart architecture review. I have spent years parsing Ethereum smart contracts and later examining the rebasing mechanics of Terra's LUNA to understand why the algorithmic stablecoin collapsed. The lesson that carried over: when chaos erupts, look for the invariant that was assumed but never enforced. In Terra, everyone assumed arbitrage would always pull the algorithmic market cap back into balance. It did not. Surviving the Terra algorithmic trap taught me that the tell is almost never in the headline metric; it is in the mechanism that people stopped inspecting. In this case, the invariant is the assumption that an NDA, signed in good faith during a trial, cleanly separates evaluating a product from wanting to build a better one. That invariant is breaking. A trial is a strange institution. A vendor shows you the keys to the kingdom, then hopes you pay for ongoing access. The vendor's hope is that the value of continuous updates and support outweighs the cost of internal reproduction. Runlayer's price expectations were high enough that Rippling chose reproduction. The question is whether the reproduction crossed from inspiration into misappropriation. Before digital forensics, someone with a good memory could leave a meeting and reconstruct a product's essence. Trade secret law has never protected against memory alone; it protects against unauthorized disclosure and use. The thing that makes digital misappropriation different from memory is traceability. Source code, commit logs, package manifests, dependency lock files, architecture diagrams — these are the fossils that an examiner can extract from two repositories and compare, layer by layer. In my audit experience, the most damning evidence rarely looks like copied lines. It looks like the same error-handling idiom, the same library constellation, the same module boundaries, the same peculiar comment style. Architecture leaves fingerprints. The court will need to decide which fingerprints were left by the open standard and which were left by Runlayer. The commercial dynamics are just as fascinating. Runlayer's business model is explicit: trial, NDA, then a negotiated contract. The decision to pause service after failed negotiations, rather than offer a discount, signals confident pricing. In a rational market that posture might have worked. But this market is two-sided and asymmetric. On one side, cloud giants like Snowflake and AWS ship gateway products bundled into data warehouse and cloud contracts. Competing with that means accepting that your product is a loss leader for someone else's platform. On the other side, platform companies like Rippling hold the customer data itself. They can internalize the gateway and create a closed loop: an AI tool requests data, the gateway enforces policy, and the entire experience lives inside the platform's existing subscription. In that world, an independent gateway vendor is a middleman without a moat. Rippling's apparent claim that Runlayer was a "commercial failure" makes the damages puzzle even stranger. A trade secret plaintiff that was not yet profitable cannot claim large lost profits absent strong evidence. The lawsuit then looks less like compensation and more like prevention. But prevention is a dangerous remedy. If a court grants an injunction against Rippling's own internal gateway, it effectively creates a court-ordered monopoly inside an ecosystem that calls itself open. Fiat illusions break under pressure; so do pricing illusions. Runlayer's belief that its gateway architecture, in isolation, could command sustained enterprise margins was the first casualty of this negotiation. The hidden profit pool in this story is not the license fee. It is the compliance tail. Once a gateway becomes the designated enforcement point for MCP governance, it can sell certification audits, compliance reports, and forensics tools to the same enterprise that bought the gateway. Runlayer's pricing expectations were likely built not on a simple per-seat or per-call model, but on a layered revenue stack. That is reminiscent of DeFi's lending market, where Aave and Compound's interest rate curves are essentially arbitrary parameters tuned by governance votes, not by anything you could call real market supply and demand. Gateway pricing is similarly detached from marginal cost; it is a function of how much pain the enterprise feels at the control point. The harder the control point is to replace, the higher the price discovery will be — which is exactly why Rippling decided the pain of building in-house was smaller than the pain of paying. Runlayer's "specific gateway deployment architecture" language also hints at a deeper ambition: not just selling features, but locking customers into an architectural paradigm that makes future replacement a security migration, not a swap. The industry-level questions are already being spoken in quiet rooms. First: can open protocols and trade secrets coexist? MCP is open, but implementations built on it are becoming paranoid. Runlayer's business depends on keeping its gateway architecture confidential, while enterprise security teams demand the opposite: transparency about how access is controlled and audited. Every step of this litigation will push infrastructure teams to share less, document less, and demonstrate less during trials. Second: where is the boundary of protectable architecture? Software patents are a contested swamp; trade secret doctrine adds another swamp. A deployment architecture — how authentication, authorization, observability, and policy engines compose into a coherent system — is not a discrete invention. It is a set of choices. Courts are decent at determining whether a source file was literally copied. They are less good at determining whether a conceptual pattern of composition was misappropriated. The longer the case runs, the deeper the court has to wade into architectural comparison. Third: will the MCP ecosystem's trust foundation crack? The community has been built on the rhetoric of openness and interoperability. The first major lawsuit inside the community involves a vendor's control plane. The message to other vendors is alarmingly clear: do not open your door too far, do not let trial customers observe too deeply, and treat every NDA as a potential future exhibit. That is not paranoia; it is the rational response to a new risk surface. But it will slow the spread of MCP, because a standard that is easy to evaluate attracts adoption, and a standard that suspects evaluation will decline into an enterprise niche. Now let me push against the easy narrative. The standard telling will be: a plucky startup was recruited into a trial by an incumbent, showed off its crown jewels, got priced out, and then got cloned. David versus Goliath, with the future of the open ecosystem at stake. That frame is wrong. Runlayer v. Rippling is not a story about theft. It is a story about the hidden centralization that open standards create. The protocol being open is precisely what made the gateway so valuable. In a closed-protocol world, Runlayer's secret would have been the protocol itself, and the market would have negotiated over the entire stack. With MCP open, the secret had nowhere to go but the control plane above it. I saw this pattern in 2020, during DeFi Summer. Uniswap's code was not just available; it was intentionally forkable. Hundreds of clones appeared within months, and Uniswap did not sue a single one. Why? Because Uniswap understood that in crypto, liquidity is truth. The clone with the deepest liquidity pool wins, regardless of whose source code it started from. Uniswap taught me liquidity is truth, and I have been warning startups ever since that if your only moat is code, it is not actually a moat. Runlayer's gateway has no network effect comparable to a deep liquidity pool. Its moat is its specific architecture and the operational experience of deploying it. That kind of moat is thin. When a powerful platform refuses to pay, the only defense mechanism left is litigation. That is not a criticism of Runlayer. It is a structural observation. The enterprise data-access world has no liquidity pool; it has a data owner. And the data owner always has the option to vertically integrate. Here is the contrarian kicker nobody wants to hear. If Runlayer wins, the clearest beneficiaries are the largest incumbents, not the startups. A precedent that proprietary control-plane architecture is protectable trade secret gives cloud giants a new enforcement weapon. They already control the most valuable control planes in the industry. They can use trade secret claims to police their partner ecosystems and to block employees who depart with architectural insight. The startup that seeks protection from Goliath may end up arming Goliath's lawyers. The smart play for Runlayer, if it truly believed in open MCP, would have been to release its gateway architecture as open source and compete on service, support, and compliance. The fact that it chose secrecy over openness tells you everything about the real balance of value in the agent stack. Entropy in the blockchain is real, and the same entropy applies to reputation: every open ecosystem that reaches the enterprise stage begins to stratify into a few thick layers of incumbency and a long tail of fragile specialists. There is another layer of irony. Rippling is not a classic AI company. It sells HR, payroll, and IT infrastructure. The gateway is not its product; the data is. By building in-house, Rippling wants to become the surface through which an AI agent accesses employee records, payroll data, and device fleets. It wants to be the API for company operations. This lawsuit may dent Runlayer's pride, but it will not stop Rippling from building that asset. The only thing the case can do is raise the cost and time of Rippling's build. That is a spoiling strategy, not a recovery strategy. A successful trade secret claim rarely gives a startup its market back. It gives it a check and a slightly reduced threat from one competitor, while the rest of the ecosystem moves on to the next layer of abstraction. So where does that leave an observer? I will be watching discovery like a hawk. Three signals will separate the real claim from the theatrical one. First: can Runlayer produce watermark code, unique identifiers, or configuration fingerprints hidden inside its gateway that also appear in Rippling's build? Second: can a court quickly dispose of the interoperability defense, or does the case descend into expert-hired mud-wrestling? Third: does Rippling's codebase contain modules the MCP spec does not require but Runlayer's architecture famously uses? Each signal will reveal whether the "1:1 copy" language was negotiation theater or technical fact. The larger lesson is independent of the verdict. Open standards and proprietary value capture are not enemies; they are partners. MCP's openness did not prevent Runlayer from building a proprietary business. It made the proprietary layer downstream — the gateway — the only place where value could coalesce. The same pattern is visible across blockchain infrastructure. Post-Dencun, blob space is the open substrate, but value and fees are converging on the proprietary sequencing, proving, and risk-management layers built above it. I have argued for a while that blob data will hit saturation within two years and rollup gas fees will double again. The quiet reason is not a shortage of blockspace; it is the reintroduction of gatekeeper economics at the layer above. The Runlayer case is that principle in legal form. Curating chaos for clarity was always easier when the chaos lived in code. Now it lives in the courtroom. The first trade secret war in the MCP ecosystem will be won by lawyers, but it is being fought by engineers, and the collateral damage is the trust every builder places in the next sales call, the next NDA, and the next gateway they try before they build. I leave you with a question that will outlast the discovery calendar. If the open protocol is free and the gatekeeper's architecture is secret, what kind of innovation does the next three to five years reward? It rewards the company that owns the most data, the deepest compliance infrastructure, and the most aggressive legal team. It does not reward the open-source idealist. Unless Runlayer can prove, in code, that its architecture was lifted line by line, this case will be remembered not as the moment the little guy won, but as the moment the open standard grew up — and the gates around it grew thicker. The courtroom, not the GitHub repo, is where the next generation of MCP builders will learn what openness actually means. When the protocol is free and the gate is locked, exactly what is left to build in the open?