This spotlight is part of our MCP company spotlights, within The MCP Guide. Building an MCP company? See SEO and GEO for MCP companies.
Runlayer is an enterprise platform that sits between the AI tools employees use and company systems. Its MCP gateway checks identity and policy on every tool call, runs security scans, and keeps an audit trail. It also finds unmanaged MCP servers on company devices.
Checked against: Runlayer's MCP Gateway page on 28 October 2026. eSEOspace did not test Runlayer's products.
Key Takeaways
- Runlayer's gateway runs "OAuth/session validation, identity-aware policy, real-time security scans, analytics, and audit logging on every call."
- Policies can apply to whole servers, single tools or resources, and to users, groups, roles and agent accounts.
- Runlayer says it supports 20+ AI clients, including Cursor, Claude Code, ChatGPT, VS Code and Codex.
- Runlayer says it is SOC 2 certified and HIPAA and GDPR compliant.
- There is no public pricing; the only option is to book a demo.
At a glance
| Item | Detail |
|---|---|
| Company | Runlayer (operated by Anysource Inc., per its site) |
| What it offers for MCP | MCP gateway, MCP catalog, runtime security, agent identity, shadow AI discovery |
| Who it's for | Companies rolling out AI agents across many teams |
| Open source? | No |
| Pricing | Not published; book a demo |
| Founded / HQ | New York, NY address in site data; founding year not stated |
What Runlayer offers for MCP
MCP Gateway
The MCP Gateway page says Runlayer checks OAuth state, identity and policy before a tool call runs. "Runlayer policies can apply to whole servers, specific tools, specific resources." They can also depend on the client in use and runtime conditions. Admins can "deploy custom MCPs to managed infrastructure."
Catalog and clients
Runlayer's llms.txt summary lists 200+ MCP servers in its catalog. Its integrations page, as summarized there, counts 212 active servers and 27 publicly supported clients. Client guides cover Claude, Claude Code, ChatGPT, Cursor, VS Code, GitHub Copilot, Codex, Windsurf (now Devin Desktop), Goose, Raycast, Warp and others.
Runtime security and shadow AI
Runlayer's homepage says "built-in scanners catch agent intent drift, PII, data exfiltration, and other risky behavior." Its Runtime Security product inspects tools, outputs and agent behavior before risky actions run. A Shadow AI feature uses your existing device management (MDM) to find unmanaged MCP servers, skills and clients, then approve, migrate or block them.
The homepage also says you can "require human approval for anything risky."
Who it's for
Runlayer says it "is for companies rolling out AI agents across engineering, security, IT, operations, and business teams." It names customers including Gusto, Lemonade, PagerDuty and Opendoor on its site. It suits security teams that need to see and control AI tool use across many clients at once. Small teams with a few trusted servers may not need this level of control yet; see MCP gateways explained.
Pricing
Runlayer does not publish prices. The pricing URL returned a "not found" page when we checked, and the gateway page's only call to action is "Book a demo." Plan for a sales conversation and ask for pricing at your user count.
Security and trust
Runlayer's llms.txt summary says it is "SOC 2 Certified, HIPAA Compliant, and GDPR Compliant." The homepage does not repeat these, but it links a Trust Center. The gateway provides "an audit trail for every request," and the homepage promises "accurate user and agent attribution."
The llms.txt also says Runlayer is backed by Khosla Ventures, Felicis and SVCI. Those are Runlayer's own statements. Ask for the SOC 2 report and BAA terms directly. Our MCP security tools list covers other products that scan and guard MCP traffic.
Alternatives
- Mintive (formerly MintMCP) is another managed enterprise gateway with SOC 2 Type II and BAA claims.
- TrueFoundry publishes per-user prices and supports VPC and on-prem deployment.
- Obot is open source, self-hostable, and also monitors AI tools on devices.
Compare more in our list of MCP gateways or browse all MCP company spotlights.
Next step
Before a demo, list the AI clients your staff use and the MCP servers they have already connected. That inventory makes vendor calls faster. Our MCP readiness audit can build it with you.
Frequently asked questions
What does Runlayer do?
Runlayer is a governed layer between AI clients and company systems. Its MCP gateway checks identity and policy on each tool call, runs security scans, and logs every request.
How much does Runlayer cost?
Runlayer does not publish pricing. You book a demo to get a quote.
Which AI clients work with Runlayer?
Runlayer says it supports 20+ clients, including Cursor, Claude Code, ChatGPT, VS Code, GitHub Copilot, Codex and Windsurf.
Can Runlayer find MCP servers employees installed themselves?
Yes, per Runlayer. Its Shadow AI feature uses your device management tool to discover unmanaged MCP servers, skills and clients, so you can approve, migrate or block them.
