Runlayer v. Rippling: The MCP Gateway Lawsuit That Will Decide Who Owns the Control Plane

The Model Context Protocol ecosystem now has its first commercial dispute, and it is not a licensing quarrel. It is a trade secret suit that asks a question no one in the AI infrastructure world has been willing to answer cleanly: if the protocol is open, what exactly does a gateway vendor own? Runlayer v. Rippling looks like two companies fighting over a broken business relationship. In substance, it is a boundary dispute over the one layer of the stack where money is actually made — the enterprise control plane that sits between a user, an AI model, and every sensitive internal system. Runlayer built an enterprise-grade MCP gateway. Rippling, a workforce management platform valued in the tens of billions, evaluated that gateway, signed NDAs, entered trial negotiations, and then, according to the complaint, produced something suspiciously similar. Runlayer suspended service after commercial terms collapsed. Rippling built its own implementation. The complaint alleges near 1-to-1 copying. Trade secret claims are rarely this clean in public filings. They are usually buried under pages of generic allegations. Here, the specificity about deployment architecture suggests code-level or architecture-level replication, not just functional similarity. If you have ever audited a production gateway, you know why this matters. The MCP protocol recently finalized a stateless specification. Statelessness is elegant for interoperability. It also means that every piece of meaningful state management — authentication, authorization, session continuity, audit logging, data lineage, policy enforcement — has nowhere to live except the gateway. The protocol deliberately pushes intelligence upward. That upward push is exactly where Runlayer's trade secret lives, and it is exactly why Snowflake and AWS have both launched their own gateway products. The control plane is no longer a thin proxy. It is the most valuable layer in the AI enterprise stack. I spent a year before the lawsuit auditing similar infrastructure for institutional clients. The pattern is consistent. Roughly seventy percent of the code in a production-grade gateway has nothing to do with protocol parsing. It is stateful governance logic: who is allowed to call which tool, under what conditions, with what audit trail, and through which caching boundary. That ratio is not incidental. It is structural. Any startup claiming a clean-room implementation must explain why its internal routing patterns, permission cache invalidation sequences, and observability event schemas align so closely with a vendor it previously reverse-engineered under NDA. The complaint's emphasis on a specific deployment architecture suggests Runlayer may have embedded fingerprints in these exact layers. But trade secret law is a fragile instrument. Ownership is an illusion without immutable proof. The proof here has not been presented to a court yet. It exists somewhere in repositories, merge requests, deployment logs, and perhaps in Runlayer's own forensic watermarks. The absence of publicly disclosed technical specifics in the complaint is itself a strategic choice. Every detail Runlayer releases narrows the scope of its secret. The more precise the claim, the easier it is for Rippling to argue that those features were dictated by the protocol, by interoperability, or by industry standard practice. This is where the case gets genuinely difficult. Courts are not going to understand MCP gateways intuitively. They will need to separate three categories: functionality required for protocol compliance, functionality that is a natural consequence of solving the same engineering problem, and functionality that is arbitrary enough to be called original and secret. The line between the second and third categories is the entire case. Rippling will argue that any competent team would independently arrive at the same architecture. Runlayer will argue that the specific combination of authentication policy models, audit mechanisms, and routing constraints is not obvious — and was protected by NDAs precisely because it was not obvious. The MCP standard's reference implementation becomes central here. If Meta and other contributors published a reference implementation that covers common gateway behavior, Rippling has a powerful defense: our implementation follows the reference. If no reference implementation defines these governance layers, Runlayer's argument becomes stronger. The fact that MCP had not yet crystallized a set of best practices when the parties met means Runlayer's particular architecture was more likely to be non-public knowledge. A protocol in active evolution creates more room for trade secret protection, not less. Commercial signals in the complaint are equally instructive. Runlayer followed a textbook enterprise sales process: trial access under NDA, price negotiation, and suspension when the deal failed. That process is also a trade secret protection program. The decision to suspend service rather than discount the product tells you Runlayer believed its gateway had standalone structural value — not just utility as an integration layer. Rippling's decision to build in-house tells you something else: the gateway is strategic enough that a platform company with massive employee and payroll data cannot afford to leave it in the hand of a small vendor. This is not a dispute about a lost deal. It is a dispute about architectural lock-in. Any serious due diligence analyst should look at the underlying economics. The gateway market is being crushed from two directions. Cloud platforms are bundling gateway functionality into their enterprise AI offerings, effectively pricing it at zero. Platform companies like Rippling have enough internal engineering capacity to reimplement a point solution once they understand its value. That leaves a narrow lane for independent gateway startups: sell into enterprises that need multi-cloud neutrality, or sell a higher tier of compliance and audit capability that internal teams cannot reproduce quickly. The lawsuit is a symptom of that pressure. A vendor that loses a strategic account has two options: accept the loss and move to the next customer, or sue and put the entire industry on notice. Runlayer chose notice. The wider MCP ecosystem should pay attention. This case will determine whether the open protocol model can coexist with proprietary value capture. The common narrative is that open standards kill proprietary layers. The reality is more nuanced. Open standards lower integration costs, but they do not waive all rights over implementation architecture. The question is where the boundary between standard and implementation sits. If Runlayer wins, enterprise gateway vendors will gain enforceable trade secret rights over their internal architecture — but collaboration in the ecosystem will contract. NDAs will multiply. Trial programs will become adversarial. Open reference implementations will be scrutinized for accidental disclosure. If Rippling wins, the opposite danger appears: no independent vendor can ever trust a potential client with its architecture, because the client can simply replicate the core and claim independent development. Here is the contrarian angle that most commentators will miss. Runlayer may have a stronger case than the market expects. The conventional wisdom is that trade secret suits against deep-pocketed defendants are expensive and futile. But this case has two structural advantages. First, the disputed technology is young. MCP's stateless spec is recent enough that there is no established body of standard practice for gateway internals. A secret is easier to protect when everyone admits the industry has not converged yet. Second, the complaint describes not a product feature but a deployment architecture. Architecture-level trade secrets are harder to defend against but easier to corroborate with technical evidence. If Runlayer placed unique hooks in config validation, permission caching, or data lineage tracking, discovery will be brutal. I have seen this before. In 2020, I simulated a stablecoin depeg on Curve Finance and found failure modes the team had dismissed as theoretical. The market ignored the math until the math stopped being theoretical. The same pattern repeats in trade secret litigation: everyone treats the secrecy as the weak point until the technical evidence starts showing structural fingerprints. In intellectual property, ownership is an illusion without immutable proof — and immutable proof does not exist until enough experts have examined the repositories. The deeper question is not whether Rippling copied Runlayer. It is whether the MCP ecosystem can handle its own commercial success. The protocol was designed to make AI agents interoperable. Its gateway layer was never specified in enough detail to make it a commodity. Now that Snowflake, AWS, and enterprise platforms are fighting for that layer, the law is being forced to play catch-up. Do not expect a quick settlement. This is not a nuisance suit. It is an attempt to draw a legal boundary around the most valuable piece of open-source infrastructure in the AI agent stack. Ownership is an illusion without immutable proof. The next twelve months will show whether Runlayer has that proof. The rest of the industry will behave accordingly. If the evidence is weak, expect more vendor lock-in, more NDAs around basic gateway design, and a chill on independent experimentation. If the evidence is strong, expect every gateway startup to begin embedding forensic watermarks in configuration schemas and audit log formats — a hidden arms race that will make the next lawsuit easier and the ecosystem more distrustful. Either way, the era of innocent collaboration on MCP infrastructure is over. The protocol remains open. The control plane just became controlled.