The First Trade Secret Battle of the MCP Economy: Runlayer v. Rippling and the Fight for Control Plane Value

While the crypto world obsesses over the next token narrative, a quiet legal battle in Delaware is about to define who actually owns the value created on top of open protocols. The protagonists are not blockchains, but something arguably more foundational: Model Context Protocol, the open standard that has become the connective tissue of the AI agent economy. Runlayer, a startup that built a security-hardened gateway for MCP, has sued Rippling, a $13 billion HR and IT behemoth, for allegedly copying its gateway architecture “almost 1:1” after commercial negotiations collapsed. This is the first trade secret lawsuit of the MCP ecosystem, and it is not about money. It is about control. The Model Context Protocol has been crowned the USB-C of AI integration. Anthropic released it in late 2024, and within eighteen months it was adopted by OpenAI, Microsoft, Google, and every serious AI infrastructure player. The protocol standardizes how large language models connect to data sources, tools, and applications. Its appeal is the promise of interoperability: write one MCP-compatible server, and any client can use it. No more bespoke integrations. No more vendor lock-in. That promise was powerful enough to unify a fragmented agent ecosystem around a single specification. But the same openness that made MCP ubiquitous also created a chasm. As the protocol matured, the hard engineering problems did not disappear. They migrated upward. The MCP stateless specification was finalized in January. This was a moment of celebration for protocol purists. Statelessness means the server does not store client context between requests. Every interaction is self-contained, which simplifies scaling and makes the network more robust. But there is a catch. If the protocol does not maintain state, then something else must. Session continuity, authentication, granular access control, audit logging, policy enforcement, and data provenance tracking — all of the capabilities that make an AI agent safe, observable, and governable — now have to live in a separate layer. That layer is the gateway. And the gateway has become the most strategically contested real estate in the AI agent stack. Runlayer is a two-year-old startup that recognized this opportunity early. Its enterprise MCP gateway is not a thin proxy; it is a concentrated control plane. It sits between the AI models and a company’s internal systems, enforcing fine-grained permissions, maintaining immutable audit trails, caching authorization decisions, and tracing data lineage so that every token generated by an agent can be traced back to its source. In cybersecurity terms, it is the zero-trust enforcement point for AI. In commercial terms, it is a toll booth on the road to enterprise AI adoption. Rippling, which provides HR, IT, and payroll infrastructure to thousands of companies, was an early customer. The engagement followed a textbook enterprise software playbook. Runlayer offered a trial. Rippling’s engineers tested the gateway against their internal data systems. NDA agreements were signed. Price negotiations began. Then something broke. The two sides could not agree on commercial terms. Runlayer suspended service rather than compromise its pricing expectations — a decision that signals the company believed its gateway was a strategic asset, not a discounted commodity. Rippling, in response, decided to build its own gateway internally. That decision is telling. A platform company with deep engineering resources chose to self-build rather than continue paying a specialist. The lawsuit alleges that Rippling’s self-built gateway replicated Runlayer’s specific deployment architecture almost exactly. If true, this is not a case of a large company independently reimplementing a well-known pattern. It is an allegation of architectural expropriation. Let me be clear about the technical stakes, because this is where the case will be won or lost. MCP is open. The protocol specification is public. No one can claim a trade secret over the basic handshake, message formatting, or tool-calling semantics. But the MCP spec is deliberately silent on how a gateway should handle authentication, request routing, permission caching, or data lineage. That silence is not an oversight; it is a design choice. The protocol’s authors intentionally left the control plane to the market. This is the same pattern we saw in the early internet. HTTP is a simple stateless protocol. The value captured in the web stack — in edge caching, content delivery, analytics, and security — was built in proprietary layers by companies like Akamai, Cloudflare, and Nginx. They did not need to own the protocol. They owned the infrastructure between the client and the server. The legal question in Runlayer v. Rippling is whether that proprietary infrastructure can be protected as a trade secret when it sits on top of an open standard. Runlayer’s complaint reportedly describes a “specific gateway deployment architecture” and alleges “nearly 1:1 replication.” That language is carefully chosen. It suggests code-level or architecture-level copying, not just feature similarity. In trade secret law, the plaintiff must show that the information was secret, that it had independent economic value from not being generally known, and that reasonable efforts were made to maintain its secrecy. Runlayer’s deliberate vagueness about its own secrets — it has not publicly disclosed its authentication policy model, its audit log schema, or its data provenance algorithm — is itself a strategic move. The less that is revealed, the wider the protective umbrella. In my years auditing smart contracts during the 2017 ICO boom, I saw the same principle at work: the value of a security architecture lies not in any single component, but in the non-obvious composition of components. A hash function is public. The way you combine it with a cipher suite, a key derivation scheme, and a revocation mechanism to create a secure whole — that combination can be a trade secret. There is a deeper structural issue embedded in this case. The MCP stateless spec was just finalized. Reference implementations exist, but they are not exhaustive best-practice guides. In a protocol that is still evolving, a vendor’s specific architecture is more likely to be deemed “not generally known” because the industry has not yet converged on a canonical way to build a gateway. Runlayer crafted a particular composition of authentication, routing, policy, and audit capabilities into a reusable security framework. That framework was not published. It was shared only under NDA with selected enterprise partners, including Rippling. If discovery reveals that Rippling copied configuration files, internal design documents, or even the topology of Runlayer’s deployment, the evidence may be overwhelming. But Rippling has two plausible defenses. First, that it built its gateway from the public MCP specification and common enterprise security patterns. Second, that any functional similarities are necessary to interoperate with MCP clients. The court will have to distinguish between “protocol-required copying” and “non-essential architectural copying.” That is the same line that has confounded software copyright and trade secret cases for three decades. It will not be easy to draw. Now let me step back and look at the commercial battlefield, because the lawsuit is a symptom of a broader shift. MCP gateways have become the highest-value layer of the AI agent economy. They are the choke point through which all enterprise AI traffic must flow. Snowflake and AWS have both introduced their own MCP gateways within the past six months. That is not a coincidence. It is a land grab. These cloud giants can bundle gateway functionality into existing data platforms and charge for it as part of a subscription, effectively commoditizing the independent gateway market. The independent startup now faces a pincer movement: on one side, cloud providers offering gateways as a loss-leading feature; on the other side, large platform companies with internal engineering capacity deciding to build rather than buy. Runlayer’s decision to litigate is a refusal to be squeezed out of the market without a fight. But even a successful lawsuit may not win the long-term commercial war. The market may simply move around the lawsuit, with enterprises choosing to avoid any gateway that could be marred by legal chaos. Let me offer a contrarian perspective that few observers will raise. The common narrative will frame this as “David versus Goliath” or “big company steals startup IP.” But the more uncomfortable truth is that open protocols create a fundamental ambiguity about what can be owned. If Runlayer wins, it will send a signal to every AI startup that the winning strategy is to build as much proprietary architecture as possible on top of MCP, then use litigation to defend it. That could chill the ecosystem, because enterprises will hesitate to adopt any gateway for fear of stepping on a trade secret claim. Scale and distribution will be the only moats that matter. Neither outcome is good for the community that believes open standards should foster innovation without legal warfare. The solution is not more lawsuits. It is clearer protocol governance. The MCP specification needs an explicit statement about what parts of a gateway implementation are essential to interoperability and what parts remain proprietary. This is analogous to the way the Rust programming language defines its safety guarantees, or the way the Linux kernel distinguishes between the kernel interface and device drivers. When the protocol authors publish a reference architecture with clear boundaries, they give both commercial developers and courts a framework to determine where the open standard ends and private innovation begins. Without that, every enterprise deployment of an MCP gateway becomes a potential legal minefield. There is also an ethical dimension that gets ignored. The MCP ecosystem is built on trust — trust that a gateway will not exfiltrate data, trust that audit logs are truthful, trust that the code does what it says. A trade secret lawsuit is a crack in that trust. It forces companies to choose sides, to worry about discovery requests, to hold back from exchanging technical details with partners. In the long run, this could be more damaging than any single verdict. The code doesn’t lie. But the codes, the legal filings, and the contracts — those are written by humans with agendas. As someone who has spent two decades analyzing protocol wars, I believe the central question of this case is not whether Rippling copied Runlayer’s code. The central question is whether an open protocol can support a proprietary control plane without devouring its own ecosystem. The next three to five years of AI infrastructure innovation will be shaped by the answer. If the court decides that trade secrets can protect a specific gateway architecture, we will see a wave of “frenemy” litigation as every layer of the stack becomes contested intellectual property. If the court decides that open protocols immunize anyone who independently reimplements a standard, we will see rapid commoditization of the AI gateway market, with innovation shifting to other layers. In either case, the people who lose are the enterprises that just want AI systems to work securely and reliably. As the crypto world has learned, open protocols without protocols for legal trust are just empty pixels. Soulless finance is just empty pixels. The same applies to AI infrastructure. The promise of MCP is that interoperability creates abundance. But abundance requires more than a spec. It requires a shared understanding of where public capability ends and private contribution begins. Runlayer v. Rippling is the first test of whether the AI agent economy can build that understanding, or whether it will devolve into a contest of subpoenas and NDAs. The suit will illuminate not only copy-and-paste allegations, but also the psychology of the AI gold rush. Every company wants to be the toll keeper. Runlayer wants to be the Cloudflare of the MCP protocol. Rippling wants to be the Oracle of HR data with an AI moat. Snowflake and AWS want to own the data center layer. In that scramble, the trade secret law is a weapon, not a guide. The discovery phase will reveal whether Rippling’s engineers genuinely used their own judgment or simply mirrored a valuable architecture. But the industry will not wait for the verdict. Engineering teams are already rethinking how much they reveal to partners, which NDAs they sign, and whether they need a separate legal review before adopting any MCP gateway. My takeaway after twenty years of watching protocols rise and fall is that the winners in any ecosystem are those who build defensible layers while keeping the core protocol open. That is true in TCP/IP, true in HTTP, and true in blockchain. MCP is no different. The only question is whether defense comes from innovation or from litigation. Runlayer has chosen litigation. The next generation of AI infrastructure will be designed with the outcome of this case in mind. The code doesn’t lie, but the courts will have the final say. And the deeper narrative? It is about the soul of technology. We wanted AI to be pervasive, to be connected to all our data, to think and act on our behalf. We built the protocol to make that possible. But we forgot that every protocol is a social contract. When companies break that contract, they do not just violate a trade secret. They violate the trust that underpins the entire system. The MCP ecosystem is still young. It can learn to protect its contributors without throttling its growth. Or it can repeat the mistakes of the patent wars, where armies of lawyers turned innovation into a battleground. The lawsuit in Delaware is not just about a gateway. It is about whether the AI agent economy will be a community or a battlefield. Trust, after all, is the ultimate proprietary protocol — and it cannot be copied.