How Rippling "Stole" Runlayer's MCP Agent Idea: A Lesson in Protecting AI Innovations

When a Year of Trust Becomes a Weapon

A Rippling insider texted Runlayer's CEO Andrew Berman with a single warning: there had been a project at Rippling to build "essentially a clone" — "almost a 1 to 1 copy" of Runlayer's MCP gateway. Runlayer, a startup backed by Khosla Ventures and Felicis with $42 million in funding, had spent nearly a year handing over its source code, product roadmap, and gateway architecture to a prospective customer. On July 28, 2026, it filed what became the first intellectual property lawsuit inside the Model Context Protocol ecosystem — Runlayer v. Rippling, Southern District of New York.

The case is not just a courtroom drama. It is a live blueprint for how valuable AI innovations get exposed, replicated, and contested — and a direct warning for any business that builds, buys, or depends on AI agents. What made Runlayer vulnerable will be explored below, and what you should do differently is more concrete than you might expect.

The Anatomy of the Dispute

To understand why this case matters far beyond two tech companies, you need to understand what was actually at stake technically.

At the center of the dispute is the MCP gateway — a centralized control plane that sits between AI agents and MCP servers to manage critical enterprise functions like authentication, access control, observability, and policy enforcement. The Model Context Protocol itself is an open standard: Anthropic released it in November 2024 as a foundation for letting AI models and agents securely connect to external data and tools. The protocol layer is free. What companies like Runlayer sell is the hardened wrapper around it — the access controls, the audit trails, the agent management logic.

Runlayer's product was exactly that hardened wrapper. And that wrapper, according to the complaint, was what Rippling allegedly cloned.

How the Trial Became a Transfer

The sequence of events is almost textbook in its clarity. Rippling — an HR and workforce-management software company valued at $16.8 billion — came to Runlayer as a prospective customer. The two parties signed a mutual non-disclosure agreement and a product trial agreement that explicitly prohibited Rippling from copying Runlayer's intellectual property or creating derivative works.

Over approximately 12 months, Runlayer provided Rippling with extensive access to its technology, including source code and future product plans. The evaluation was thorough, hands-on, and technically deep — the kind of collaboration that enterprise software deals require to move forward. Then price negotiations for a long-term commercial deal collapsed. Runlayer suspended its services on June 12, 2026. That same day, the insider's text message arrived.

Rippling confirmed it is launching its own MCP gateway. A company spokesperson denied the allegations outright, calling the lawsuit "Runlayer's panicked effort to avoid competition by fabricating claims." Rippling stated it is building its product using only proprietary information. The case is now before the court, with Runlayer seeking a preliminary injunction and monetary damages, represented by Sullivan & Cromwell LLP.

Every architecture discussion you walk a prospect through, every edge case you solve on a shared call — you are not just selling. You are teaching. And what you teach, someone with hundreds of engineers can turn into a product.

Why This Is the First of Many, Not a One-Off

The timing is not coincidental. MCP gateways are rapidly becoming core enterprise infrastructure. By mid-2026, competition in this segment was already intensifying: Freshworks announced its Freddy AI Agent Studio and an MCP Gateway in May 2026, and AWS launched Bedrock AgentCore Gateway as a managed infrastructure layer for connecting agents through MCP-compatible interfaces.

When a technology category transitions from experimental to mission-critical, the economics of build vs. buy shift. A company like Rippling employs hundreds of engineers. When a vendor quotes a significant annual contract for a product those engineers believe they can rebuild in a few quarters, someone in the room inevitably runs the spreadsheet. That calculation becomes especially tempting when a year-long product trial has already answered most of the hard architectural questions.

This is what makes the Runlayer case structurally different from a typical trade secrets dispute. The alleged theft did not happen through a data breach or corporate espionage in the traditional sense. It allegedly happened through a legitimate business process — a product evaluation — conducted under signed agreements, with full technical cooperation from the vendor.

For any business operating at the intersection of AI development and enterprise sales, that is the uncomfortable truth: the most dangerous moment for your AI innovation may be the demo itself.

And this is also not Rippling's only IP controversy. In 2025, Rippling itself sued competitor Deel, alleging corporate espionage in a separate dispute. That case does not prove anything about the Runlayer allegations, but it illustrates how aggressively the AI-era enterprise software market litigates competitive conduct — and why building robust IP protection into your AI development strategy is no longer optional.

What "Protecting an AI Innovation" Actually Means

Most business leaders think IP protection means filing patents. In the AI agent space, that instinct is incomplete — and often too slow. Here is what the Runlayer case illuminates about the real protection stack.

Legal Instruments Are Not Enough on Their Own

Runlayer did everything right on paper. NDA signed. Trial agreement signed with an explicit anti-copying clause. These are, as TechCrunch noted, "standard boilerplate in enterprise software trials." And yet Runlayer still ended up in federal court.

The lesson is not that NDAs are useless — they are essential, and Runlayer's legal position is precisely grounded in those agreements. The lesson is that legal instruments create liability, not prevention. An NDA does not stop a well-resourced company from making a strategic decision; it creates consequences for that decision after the fact.

Under trade secret law, protection depends on maintaining reasonable safeguards — not just contractual ones, but operational and technical ones. Courts assessing trade secret allegations examine what, precisely, is "secret," why it derives independent economic value from secrecy, and how the defendant improperly acquired or used it. If you cannot demonstrate that you treated the information as genuinely confidential — beyond a signature on a document — your legal position weakens.

The Technical Side of Protection

There is a concrete operational difference between "we signed an NDA" and "we designed what we disclosed." For AI infrastructure companies running enterprise trials, that difference looks like this:

• Staged disclosure: share functional capabilities first, architectural details only after commercial intent is confirmed. A prospect does not need your source code to evaluate whether your product solves their problem.
• Sandboxed environments: instead of deploying your production stack, build a trial environment that demonstrates output without exposing implementation. Think of it as a showroom model rather than the factory floor.
• Technical watermarking: embed traceable markers in shared code, documentation, or model outputs that allow you to demonstrate provenance in a dispute. This exists, and serious AI infrastructure companies are starting to use it.
• Scope-limited API access: rather than exposing the full gateway logic, offer a scoped API that proxies functionality without revealing the control-plane architecture underneath.

The key insight here is architectural: you can demonstrate that your product works without explaining exactly how it works. That distinction is not just IP protection — it is better sales engineering.

The Organizational Layer

Beyond legal and technical controls, there is a people layer that companies consistently underestimate. Runlayer's complaint was triggered by a Rippling insider who voluntarily warned the startup. This means someone inside Rippling was uncomfortable enough with what was happening to break ranks. That is an organizational signal, not just a legal one.

For companies on the buying side of AI innovation — those evaluating vendors, running pilots, building internal tools — this case is also a governance question. Do you have clear internal policies about what engineers can and cannot use from vendor trials? Are those policies enforced, not just written? Is there a defined line between "learning from a vendor" and "building from what a vendor showed you"? As AI agents become embedded in procurement, compliance, and approval workflows, these questions have direct operational consequences. You can read more about how threats to AI agent businesses are evolving in 2026, and what governance frameworks are emerging in response.

The MCP Ecosystem's Maturity Problem

The Runlayer v. Rippling case is, as one analysis put it, a signal that MCP "has moved beyond its origins as a collaborative protocol experiment into a contested commercial category." That transition has specific implications for how businesses should think about their AI agent infrastructure.

Open-source protocols create a shared foundation — everyone builds on the same substrate. But the value is always in the layer above the protocol: the enterprise hardening, the access controls, the integration logic that makes agents safe enough to touch payroll data or compliance records. That layer is proprietary. And that layer is what competitors want.

When a technology shifts from experimental to foundational, the IP battles begin. The MCP ecosystem just had its first lawsuit. It will not be its last.

For businesses that are building their own AI agent workflows on top of MCP — whether procuring a gateway from a vendor or building one internally — the Runlayer dispute is a clarifying event. It tells you that this infrastructure is valuable enough to fight over, regulated enough to generate serious litigation, and complex enough that the distinction between "inspired by" and "copied from" will be adjudicated in federal court.

If your company is deploying AI agents that interact with HR, finance, or operations data, you are operating in exactly this contested space. Understanding how AI agents are being used across business operations today gives context for why the underlying infrastructure — the gateway that controls what agents can and cannot access — has become the new competitive battleground.

A Protection Framework for AI Innovators

Drawing from the facts of the Runlayer case and the broader pattern of AI trade secret litigation, here is a working framework for any company building proprietary AI agent systems:

Document Early and Continuously

The most common failure in AI IP disputes is not a lack of protection at the time of breach — it is a lack of evidence of what existed before. Keep timestamped records of your architecture decisions, development logs, and design documents. Version control systems like Git provide natural audit trails, but they need to be supplemented with explicit documentation of what constitutes your proprietary contribution versus what is built on open-source components.

This documentation serves two purposes: it strengthens your position in court, and it forces your own team to think precisely about where your competitive advantage actually lives. Many teams, pressed to articulate their secret sauce, discover that it is more specific — and more protectable — than they assumed.

Structure Commercial Relationships with IP Explicitly in Mind

Standard NDAs, as the Runlayer case shows, are necessary but not sufficient. Trial agreements should go further: specify exactly what materials are being shared, what they can be used for, and what technical access controls will be in place. Include audit rights. Define what happens to shared materials if a commercial deal does not close.

And consider the asymmetry of the relationship. When a large enterprise with significant engineering resources enters a trial with a startup, the power dynamic is inherently uneven. That asymmetry should be reflected in the contractual protections — not because every enterprise is acting in bad faith, but because the consequences of a dispute are existential for a startup and manageable for a $16.8 billion company.

Build a "Moat Audit" into Your Product Roadmap

Every quarter, someone on your team should be asking: if a competitor saw everything we showed in last month's demos, what could they build? That question is uncomfortable. It is also clarifying. It forces you to distinguish between features that demonstrate value and architecture that creates defensible competitive advantage.

The goal is not paranoia — it is precision. You need to know what you are protecting before you can protect it. And you need that knowledge before you are sitting across the table from a company that has decided to run the build-vs-buy calculation.

What This Means If You're a Buyer, Not a Seller

Most readers of this article are not building MCP gateways. They are running companies that need AI agent infrastructure — or that are considering building it internally. The Runlayer case speaks to you too.

If you are evaluating AI agent vendors, recognize that what you learn during a trial has limits that are not just ethical but legal. The NDA and trial agreement you sign are not formalities. They create real obligations for your engineers and product teams about what they can use from what they see. Governance policies that address this explicitly — and that are enforced at the engineering manager level, not just signed by legal — are increasingly necessary risk management.

If you are building AI agent infrastructure internally, the case highlights a different risk: the risk of building something that is inadvertently derivative. If your team has evaluated external vendors deeply, document the independence of your internal development path. Courts examining trade secret claims ask whether the development was independent — and the ability to demonstrate that independence depends on records that exist before a dispute, not after.

There is a quieter risk here too, one that compound over time: without a clear IP protection framework, executives end up reactive — dealing with disputes, not driving strategy. The leaders who earn confidence from their board and investors are those who treat AI governance as a proactive discipline, not a legal afterthought. When your AI strategy is visibly systematic — documented, governed, and defensible — it reads as leadership rather than luck.

FAQ

What is an MCP gateway, and why is it valuable? An MCP gateway is a control layer that sits between AI agents and enterprise data systems, managing authentication, access control, and policy enforcement. Its value comes from the "hardened wrapper" it provides around the open-source MCP protocol — the enterprise-specific security and compliance logic that makes it safe to let AI agents interact with sensitive business data.

What exactly is Runlayer alleging against Rippling? Runlayer alleges that after a nearly year-long product trial — during which it shared source code, product roadmap, and gateway architecture under a mutual NDA and a trial agreement explicitly prohibiting copying — Rippling used that information to build a competing MCP gateway that is "almost a 1 to 1 copy" of Runlayer's product. The lawsuit claims trade secret misappropriation, unfair competition, and breach of contract.

How has Rippling responded? Rippling has confirmed it is launching its own MCP gateway but categorically denies the allegations. The company stated it is building the product using only its own proprietary information and has called the lawsuit a "panicked effort to avoid competition."

Does an NDA actually protect you in these situations? An NDA creates legal liability for breach — it does not prevent someone from misusing information. To actually protect your AI innovations, NDAs must be combined with staged disclosure practices, sandboxed trial environments, and clear documentation of what was shared, when, and under what conditions. The legal agreement is the floor of your protection, not the ceiling.

What should businesses do before sharing AI architecture with a prospective partner or customer? Conduct a "moat audit" — identify precisely what constitutes your proprietary contribution versus what is built on open frameworks. Share functional capabilities before architectural details. Use scoped APIs or sandboxed environments for trials. Ensure your internal documentation creates a clear, timestamped record of your independent development. And make sure your trial agreements go beyond standard boilerplate to address AI-specific IP risks explicitly.

Is this kind of dispute likely to become more common? Yes. As AI agent infrastructure moves from experimental to mission-critical, the economic stakes of controlling it rise sharply. The Runlayer case is the first formal IP dispute in the MCP ecosystem, but the underlying dynamic — open protocols with proprietary value layers, evaluated by well-resourced potential competitors — is structural. Expect more cases in this category as the agent economy matures.

---

The Runlayer v. Rippling lawsuit is already doing something useful: it is making the risk visible before most companies have experienced it directly. A year of engineering collaboration, a collapsed commercial negotiation, a text message from an insider — that sequence is specific to this case, but the underlying vulnerability is universal. Any AI innovation that requires deep technical exposure to prove its value is an innovation that can be understood, reproduced, and competed against.

The question for your business is not whether you are at risk. If you build, sell, or significantly depend on proprietary AI systems, you already are. The question is whether you have designed your commercial relationships, your trial processes, and your internal governance with that risk explicitly in mind — or whether you are operating on the assumption that a signature on a boilerplate NDA is sufficient.

It worked for Runlayer the way a smoke detector works: it told them the fire had started. The goal is to build something that keeps the fire from starting at all.

What does your current process for protecting AI innovations look like — and where do you think the gaps are? Ask our AI agent to help you map the vulnerabilities in your specific setup.