Two weeks before the Model Context Protocol finalized its stateless specification — a technical milestone most of the industry treated as bureaucratic housekeeping — a startup with fewer than a hundred employees filed a complaint in the Northern District of California that could redefine who actually owns the AI agent economy. Runlayer, an enterprise MCP gateway provider, is suing Rippling, the $13 billion HR, IT and payroll platform, for trade secret misappropriation, alleging what the filing calls "nearly one-to-one copying" of its gateway architecture after a commercial negotiation collapsed. This is the first trade secret lawsuit in the MCP ecosystem. It will not be the last.
I have been auditing protocol ecosystems since the 2017 ICO era, when I earned my contributor badges by reading prediction market oracles line by line. I have watched open standards collide with proprietary ambition across crypto, DeFi, and NFTs. This case is different. It is not about tokens or forks. It is about the layer where enterprise AI security gets built — and it is forcing the industry to confront a question we have been avoiding since the first open protocol shipped: how much of the architecture built on top of an open standard can anyone actually own?
Let's level-set for anyone who has not spent the last year inside agent infrastructure. MCP, the Model Context Protocol, is the emerging standard that lets AI models connect to external tools, databases, and enterprise systems. Anthropic released it in late 2024, and within months it absorbed a fragmented universe of proprietary agent tool-calling into a single interoperable spec. By late 2025, it had become the default interface for agent-to-enterprise integration. The stateless specification, finalized just before this lawsuit landed, clarifies how servers announce tools, how clients discover them, and how requests flow without carrying session state across calls.
But here's what the finalization actually did. By pushing session management, authentication, policy enforcement, permission caching, and audit logging out of the protocol and up the stack, the spec transformed the gateway into the most strategically dense component in the entire architecture. The protocol says how messages move. It deliberately does not say how access gets controlled, how policies get evaluated, or how data lineage gets tracked. That is the control plane. And the control plane is proprietary territory.
Runlayer built an enterprise gateway in exactly that territory. Rippling arrived as a customer, signed NDAs, ran a technical trial that reached deep into its internal data systems, and then — after the commercial negotiation hit an impasse — reportedly built its own gateway. Runlayer's complaint alleges the resulting product mirrors its specific architecture. Rippling's inevitable response: it is just a standard implementation of an open protocol. That one-sentence collision is the entire lawsuit.
The definitional drift is itself part of the dispute. Is a gateway a configurable router, a zero-trust enforcement point, an audit vault, or all of the above? Runlayer's trade secret claim implicitly answers "all of the above, in one specific composition." That composition is the asset. Meanwhile, in the same quarter, Snowflake and AWS both launched enterprise gateway products of their own. The gateway layer, once dismissed as a thin proxy between a model and an API, is now a recognized category of cloud infrastructure. The toll booths of the AI economy are being installed. Everyone wants the contract.
The first thing to understand about enterprise MCP gateways is that they are not simple. A simple API proxy forwards requests, validates a token, and logs a line or two. An enterprise gateway sits at the boundary between an AI agent and every internal system that agent can touch, and it has to make real-time decisions about authentication across heterogeneous identity providers, policy evaluation across dozens of permission domains, load-aware routing between model endpoints, audit event generation that satisfies compliance frameworks, and data-lineage tracking that tells you exactly which data assets influenced which model output. This is control-plane engineering, not middleware plumbing.
Runlayer's filing emphasizes "specific gateway deployment architecture," and that phrase is doing seventy percent of the legal work. Not features. Not user interface. Architecture. Trade secret law protects the composition — how authentication models, policy decision points, permission caches, and audit schemas interlock into a reusable security paradigm. In a day in the life of an enterprise agent, that architecture determines whether a compromised model can exfiltrate payroll data, whether a confused deputy can escalate privileges, and whether an auditor can trace a hallucination back to its source. The design choices are consequential, subtle, and — here is the key — not determined by the MCP spec.
That is what gives Runlayer a plausible claim. The stateless spec is brand new. Community best practices are still forming. There is no canonical reference implementation that any competent engineer would naturally converge upon. If MCP had been stable for a decade, Rippling could argue that identical architecture is simply what engineering gravity produces. But in a protocol barely a year old, with the design space still wide open, two teams independently producing "nearly one-to-one" architectural patterns — including, allegedly, identical audit mechanisms and permission caching strategies — strains credibility.
This is also where Rippling's defense gets interesting. The line between what the protocol requires and what the implementation adds is genuinely fuzzy. Some duplication is necessary for interoperability: to function at all, you must match the specification exactly. If the alleged copying is confined to spec-mandated behavior, the trade secret claim evaporates. If it extends into non-necessary choices — the eviction policy for a permission cache, the schema for observability events, the structure of a data-lineage tracker — Runlayer has a case. Courts will have to determine whether the implementation of a deliberately under-specified standard can itself be a trade secret. I do not envy the judge.
This is what I call layered standardization, and it is the dominant architectural pattern of every protocol economy I have analyzed. Layer one, the wire protocol, becomes commoditized and open. Layer two, the control plane, remains proprietary because the spec deliberately declines to define it. Layer three, the application layer, fragments into vertical competition. The pattern plays out in crypto with settlement layers versus custody, in identity with DID standards versus wallet infrastructure, and now in AI with MCP versus the gateway. The interesting engineering question is always the same: how much of layer two can you protect before layer one stops being open? Runlayer's case will answer that question for MCP specifically.
There is an overlooked parallel here to the open-source world, and I say this as someone who spent years auditing smart contracts. Open source isn't a license file. It's a philosophy of transparency. But transparency about the protocol says nothing about who owns the architecture that operationalizes it. The MCP ecosystem is about to learn that boundary the hard way.
Now follow the money, because that is where this case gets sharpest. Runlayer's commercial playbook is straight out of enterprise security: trial access to get inside the customer's infrastructure, NDAs to lock down implementation details, then a commercial agreement with real pricing. The detail that matters most is what happened when the price conversation went sideways. Runlayer did not cave. It did not offer a survival discount to keep a marquee customer. It terminated service and walked away. That is the behavior of a company that knows it is selling security infrastructure, not API calls. Gateway pricing is not volumetric. It is infrastructural. You do not discount the choke point through which every AI agent in the enterprise must flow.
But here is the reading most coverage is missing: Rippling did not simply fail to agree on price. Rippling had a strategic epiphany. As the trial unfolded and Runlayer's gateway connected to Rippling's internal data systems, Rippling watched its own products transform into AI-native platforms. Rippling sits on a mountain of employee, payroll, and IT device data across thousands of customer companies. If you're selling AI agents to HR and IT departments, the gateway between those agents and that data is not a cost. It is the moat around your entire SaaS business. Buying the tool was always a temporary arrangement. Owning the capability was the endgame.
This is the pattern I have watched for six years in crypto: the most monetizable layer of any open-protocol economy is the access and compliance layer, because that is where trust gets priced. Rippling's self-build decision is the enterprise SaaS equivalent of an exchange deciding to build proprietary custody rather than trust a counterparty — except here, the counterparty is a startup that just showed them exactly how the architecture works.
There is also an institutional angle that mirrors what I saw after the Bitcoin ETF approval. When large platforms start treating the gateway as foundational infrastructure rather than a vendor tool, they stop doing cost-benefit analysis on procurement and start doing M&A-style capability assessments. Rippling's pivot from buyer to builder is exactly the behavior I documented in institutional investors who moved from buying exposure to building internal custody teams. The strategic logic is identical: the interface layer is too important to outsource.
And now the market context. Snowflake and AWS launched gateways in the same quarter. That is not coincidence. The gateway has been validated as a product category with enough commercial thickness to anchor cloud revenue. But it also means independent gateway startups are about to face the classic platform squeeze: hyperscalers can bundle gateway capabilities into cloud commitments at near-zero marginal cost. A standalone gateway company charging a premium for what a $50,000-a-month cloud contract includes for free is fighting a structural battle that no trade secret verdict can resolve. The lawsuit may establish who copied whom, but it will not stop the absorption of the gateway layer into the cloud bundle.
Strip away the legalese, and this case forces three industry-level questions into the open. First: can open protocols and trade secrets coexist? The standard narrative says they are complementary — the protocol commoditizes the bottom, the architecture monetizes the top. Runlayer's complaint argues the opposite, claiming proprietary architecture was lifted precisely because the protocol was open enough to make everything around it portable. Second: where does protectable intellectual property begin when a standard deliberately leaves the control plane under-specified? That is not merely a legal question. It is an engineering question the court must answer through expert testimony, and the technical illiteracy risk in that room is high. Third: can the MCP ecosystem sustain both collaboration and competition without collapsing into defensive litigation? Every independent infrastructure startup that courts enterprise customers will now weigh each pilot as potential legal exposure. The chilling effect starts before any verdict is reached.
Red flag: trade secret litigation in protocol ecosystems cuts both ways. The complaint is deliberately vague about the actual secrets — authentication policy models, audit log mechanisms, permission cache designs, data lineage algorithms. That vagueness is strategic: the narrower the public disclosure, the broader the claim. But it also means discovery will be brutal. To prove your secrets were stolen, you must disclose them to opposing counsel, expert witnesses, and potentially the public record. Many trade secret plaintiffs win the motion and lose the secret. If Rippling can show that implementation decisions happened while Runlayer's NDA was already in force — or that the architecture tracks the protocol's own reference examples — the claim shifts quickly. Watch the inevitable motion to dismiss and the discovery calendar. The path from "allegedly" to "proven" is where most trade secret cases die.
Here is where I dissent from the consensus that will inevitably frame this as another brave startup versus big incumbent epic. A decisive Runlayer victory may actually be the worst outcome for the MCP ecosystem. Consider the chilling effect. Every AI startup currently shares implementation details with enterprise prospects under NDA during trials; that is how the ecosystem sells itself. If Runlayer wins, every legal team in the space will re-engineer pilot processes behind layers of protective orders and split-room agreements. The open exchange of architectural ideas that makes young protocol ecosystems productive will freeze. Enterprise software already moves slower than founders want. A precedent that treats "seeing how a gateway works" as legally dangerous will make the sales cycle glacial.
The deeper problem is that trade secret law is a fundamentally awkward fit for protocol ecosystems. It was designed for formulas and customer lists — discrete assets with clear boundaries. Architecture on top of an open standard is not a discrete asset. MCP deliberately under-specifies the control plane. That openness is a feature. The court will have to draw a line between interoperability-required duplication and non-necessary architecture copying. Whatever line it draws becomes the boundary every AI infrastructure company must navigate for the next half-decade — and it will be drawn by judges who may not understand the difference between a permission cache and a session store.
And now the question no one wants to say out loud: does Runlayer even want to win? A verdict would require full disclosure of the architecture that constitutes their livelihood. A settlement — with a confidentiality agreement, a licensing fee, and a "we are pleased to have resolved this" joint statement — would let them claim vindication while keeping the secrets intact. The public appetite for precedent is inversely proportional to the plaintiff's actual commercial interest.
And let us be honest about the discovery asymmetry. Runlayer is a small company with finite legal resources, facing a defendant that can fund motions practice until the heat death of the universe. Even a strong claim can be delayed into irrelevance in enterprise AI, where the product lifecycle is measured in quarters, not years. If Rippling's strategy is to outlast rather than outargue, Runlayer's window of commercial relevance may close before the court rules. That is not justice. That is just how litigation works.
We didn't need a federal complaint to know that open standards and proprietary value would eventually collide. We needed one to find out where the boundary gets drawn. The MCP gateway is the first true battleground of the agent economy — the intersection of transparency and monetization, of public protocols and private architecture. How the court maps that terrain will define innovation incentives across the AI stack for the next three to five years, for better or worse. Decentralization is not a tech stack; it is a promise about who gets to capture value on top of shared infrastructure. This case is the first time that promise gets tested in front of a judge. Read the discovery filings. That is where the future of the MCP economy gets written.
