The First Trade Secret War in MCP Land: Runlayer v. Rippling Is a Fight for the AI Agent Toll Booth

HOOK Code doesn't lie. But trade secret law makes code hide. The first trade-secret lawsuit in the Model Context Protocol ecosystem has landed, and it is not a dispute over a stolen line of code. It is a dispute over who owns the toll booth between an AI model and a company's most valuable data. Runlayer, an enterprise MCP gateway startup, has accused Rippling, the HR/payroll/IT platform, of terminating a commercial negotiation, building an internal equivalent, and shipping what Runlayer calls a 'near 1-to-1 copy' of Runlayer's proprietary gateway architecture. The complaint is deliberately vague about technical details. That vagueness is not a weakness. It is the first move in a discovery-driven legal war. The market will be tempted to read this as another tech IP soap opera. That would be a mistake. This case is the opening shot in a much larger war over the layer between open protocols and closed enterprise value. The judge's first ruling won't just decide Runlayer's survival. It will decide whether startups can build proprietary moats on top of open standards without getting mugged by their own customers. CONTEXT Let me set the protocol layer. Model Context Protocol is the emerging open standard that lets large language models call tools, read databases, and execute actions inside enterprise software. Think of it as a universal adapter for AI agents. The protocol recently finalized a stateless specification, a move that simplifies how model servers connect to remote tools. But statelessness has a side effect: state management, session governance, authentication, audit logging, and data provenance all moved out of the protocol layer and into the gateway. The gateway is now the control plane for enterprise AI. It authenticates the agent. It enforces policy. It decides what the model can see and what it cannot. That is not a thin proxy. That is infrastructure. And infrastructure attracts competition. Snowflake and AWS have already shipped their own MCP gateways. Rippling, with its existing grip on employee, payroll, and IT systems, decided that a third-party gateway was either too expensive or too strategically dangerous. Runlayer says Rippling copied its 'specific deployment architecture' instead of building a different one. Runlayer's commercial path was textbook: enterprise trial, NDA, price negotiation, long-term contract. When the price talk collapsed, Runlayer walked away. Rippling went internal. Soon after, Runlayer claims the internal product looks like Runlayer's architecture, not Rippling's. This is not a story about two companies. It is a story about the economics of AI infrastructure during a bear cycle. When budgets tighten, enterprises stop paying for gateways and start building them. And when they build, they copy what they saw under NDA. That is exactly the moment when trade secret litigation spikes. Runlayer v. Rippling is the canary in that coal mine. CORE Here is where the technical analysis begins. The complaint's strongest sentence is 'near 1-to-1 copy.' In code, there is a world of difference between functional similarity and architectural copying. I spent six weeks in 2018 auditing ICO smart contracts, and I learned that two contracts can execute the same logic yet look nothing alike in bytecode. But when a plaintiff alleges near 1-to-1 copying, they are not talking about behavior. They are talking about variable names, module boundaries, authentication handshake order, error-handling patterns, cache invalidation logic, and deployment topology. Those are the fingerprints of a specific engineering team. If Runlayer can show that Rippling's gateway has the same unusual module names or the same unforced design decisions, the case moves from 'we both built a gateway' to 'you copied our blueprint.' Let me break down the four hardest technical questions. First, what exactly is a trade secret here? MCP is open, but a gateway's security governance layer is not. Authentication, access control, observability, policy execution, and session tracing are implementer choices. Runlayer's 'specific deployment architecture' could include a custom permission cache, a unique audit-log schema, a data-lineage tracking algorithm, or a policy-decision tree. Those are the sorts of implementation details that can be protected as trade secrets even on top of an open protocol. The fact that the stateless spec was only recently finalized actually helps Runlayer: because the spec is young, best practices are not yet codified into a public reference implementation. If the 'specific deployment architecture' predates the final spec, it is more likely to be non-public knowledge. Second, the reference-implementation problem. If the MCP specification ships a public reference implementation that contains the same authentication or audit patterns, Rippling can argue they merely followed the spec. Every gateway will look similar because every gateway must interoperate with the same protocol. The court will have to separate 'protocol-mandated copying' from 'non-mandated ornamental copying.' That is the forensic crux. In my experience auditing code, this is where lawsuits live or die. If Runlayer's unique decisions are not required by the protocol, and Rippling copied them anyway, the trade-secret claim has real teeth. Third, the watermark question. The source material doesn't say whether Runlayer embedded code watermarks, unique identifiers, honeypot configs, or deliberately nonfunctional branch names. If they did, discovery becomes a slam dunk. If they didn't, they are relying on deposition testimony and code comparison, which is messier. Smart infrastructure teams always plant a few canary variables—variables that mean nothing but are named with a distinctive pattern. A 1-to-1 copy cannot hide those. Fourth, the architectural lock-in argument. Runlayer's real value is not a single feature. It is a reusable security architecture that combines routing, authentication, policy, and audit into one coherent system. That kind of architecture is hard to protect with patents and easy to protect with trade secrets—until the secret walks out the door with a business development partner. This lawsuit is a warning to every AI infrastructure company that opens its deployment architecture to enterprise prospects under an NDA. Once the prospect's engineers see the design, the knowledge is gone. The only remaining asset is a legal claim. Adoption volume precedes price. Always. That is why the market's immediate shrug matters less than the docket's trajectory. The next six months will be decided by three forensic signals: whether Runlayer's complaint references code watermarks, whether Rippling produces a public reference implementation as its shield, and whether the court grants early discovery. That docket is the real price action. Now let me address the commercialization angle that most legal coverage misses. Runlayer's business model is clear: enterprise trial, NDA, price negotiation, and a long-term contract. That is not a side project. That is a product with a sales motion and a pricing strategy. But the pricing collapse with Rippling reveals the deeper strategic problem. A gateway sits between the AI model and the customer's core data. For a platform company like Rippling, that position is not a cost center. It is a strategic asset. Rippling did not build an internal gateway because Runlayer's price was too high. It built one because gateways control access to employee data, payroll systems, and IT controls. A platform company looking to build a closed loop from AI tools to its own data needs that gateway under its own roof. Runlayer was in the way. The 'price negotiation breakdown' is just the polite cover story. Snowflake and AWS make that strategic calculus even harsher. They can bundle a gateway into a cloud contract, effectively giving it away to capture agent data flows. An independent gateway startup is now competing against the world's largest cloud balance sheets. Runlayer's litigation is an expensive signal that its board believes the architecture is worth more than its revenue run rate. If the case fails, Runlayer's valuation drops to feature-level multiples. If it succeeds, Runlayer may reinvent itself as a licensing company rather than a SaaS company. There is also a security angle that the source material underplays. A gateway that is a trade secret cannot be independently audited. Runlayer will argue that its security architecture is secret because disclosing it helps attackers. That is a classic security-through-obscurity argument, and it is dangerous in a protocol ecosystem built on interoperability. The same secrecy that protects Runlayer's commercial position also prevents the public from verifying the gateway's privilege separation, session isolation, and policy enforcement. The judge may end up ruling that a vendor's duty to protect trade secrets outweighs an enterprise's right to inspect the control plane of its own agent infrastructure. That would be a regulatory nightmare. CONTRARIAN Here is the contrarian take that nobody in the legal twitter threads wants to touch. If Runlayer wins a strong verdict, the MCP ecosystem loses more than it wins. An open protocol is valuable precisely because it creates a commodity layer: any gateway can talk to any model, any tool, any data source. But if every non-protocol implementation detail becomes a trade secret, then every enterprise integration begins with a legal review. Startups will refuse to share architecture under NDA. Interoperability will be replaced by litigation risk. The protocol might remain open, but the value layer above it will turn into a walled garden made of nondisclosure agreements. The same dynamic applies to the big platforms. Snowflake and AWS are not neutral cloud providers in this story; they are gateways in their own right. If Runlayer's position is accepted, any cloud provider that launches a gateway using engineering patterns similar to a startup's could face the same complaint. That risk will push the giants to rely on stronger patents and defensive contracts, further concentrating power in legal teams rather than engineering teams. The deepest blind spot is the open-source hypocrisy. The MCP ecosystem sells itself as open, collaborative, and standard-driven. But the moment enterprise money arrives, everyone starts drawing property lines. Runlayer was happy to share its architecture under an NDA when the deal was alive. Rippling was happy to use that NDA as a free design review. Neither side is the good guy. The real victim is the norm of shared infrastructure that made MCP interesting in the first place. TAKEAWAY Make no mistake: this case is not a temporary dip in MCP sentiment. Not a dip. A liquidity trap. For founders building on open protocols, the message is brutally clear: your gateway is your property, but your property is only as safe as the legal attorney who drafted your NDA. For enterprises, the message is equally clear: do not let a vendor's engineering team inside your architecture without clean-room procedures and defensible boundaries. The question isn't whether Rippling copied. The question is whether enough MCP innovators will still be willing to show their blueprints to a prospect in 2026. Runlayer v. Rippling is not the end of the story. It is the first page of a new rulebook. Code doesn't lie, but only if you know where to look. The market just learned where to look.