Runlayer drew the line itself. On its own comparison page against Portkey, the sentence reads: "Portkey secures the model layer. Runlayer secures the tool layer." A few paragraphs earlier, the same page puts it more sharply — Runlayer is "infrastructure for everything that happens after the model decides to use a tool."

That is an unusually clean statement of a competitive perimeter, and it is worth taking at face value, because the engineering behind it is serious. Runlayer scans tool definitions before they reach an agent, watches an agent's trajectory across a session for drift, enforces the intersection of user and agent policy on every delegated call, and finds shadow MCP servers on laptops through MDM. Anyone still describing Runlayer as a logging proxy has not read its documentation.

The question this comparison actually turns on is the one Runlayer answered for itself: where does the perimeter start? Runlayer starts it at the moment the model decides to call a tool. Waxell starts it earlier and ends it later.

Runlayer is an enterprise AI control plane for the tool layer, operated by Anysource Inc. It connects agents to a catalog of 18,000+ MCP servers across 300+ AI clients and governs those connections with identity-scoped access policy, runtime threat scanning, a skills and plugins registry, an agent builder, and endpoint discovery of unmanaged MCP configurations. Waxell is an AI control plane whose unit of governance is the policy category rather than the access grant: Observe instruments an agent in two lines and evaluates each run against 50+ policy categories before the next step executes, the MCP Gateway governs tool calls across 160+ upstream connectors, Runtime gates each step of high-stakes workflows, and Endpoints governs AI on employee machines. Runlayer governs what an agent may reach. Waxell governs what an agent may do.

What is Runlayer built for?

Runlayer's framing is enablement first and control second, and its own materials lead with that ordering. The platform pairs "getting everyone delegating work to agents" with an AI control plane, and the recurring phrase across its site is the golden path — a curated, approved route that employees take because it is easier than the alternative, not because it is mandatory.

The company is well funded and moving quickly. Runlayer announced a $30 million Series A from Felicis and Khosla Ventures in June 2026, bringing total funding to $42 million, roughly six months after leaving stealth. Its own announcement names Instacart, Gusto, Decagon, Opendoor, dbt Labs, AngelList and Lemonade as customers. Its trust center publishes SOC 2 Type 2, HIPAA and GDPR.

The product surface is broader than the "MCP gateway" label suggests:

Runlayer MCP Gateway makes approved MCP access the default across Claude, Cursor, ChatGPT, Codex and other clients, with policy, OAuth, runtime security and an audit trail on each request. Runlayer distinguishes it from a plain proxy in its own FAQ: "A standalone proxy routes traffic. Runlayer adds catalog, approvals, identity-aware policy, real-time security scans, audit logs, analytics, agent accounts, Runlayer Plugin, and Watch."

Agent IAM & Governance is a real policy engine, and its shape matters for this comparison. A policy binds a Principal — user, group, role, agent account, identity attribute, or an Everyone wildcard — to an Access Scope, either an entire MCP server or specific tools and resources, with optional runtime conditions on tool arguments, network range and OAuth state. For delegated calls, Runlayer documents that it enforces the intersection of the agent account's policies, the user's policies and server-level policies. The product page states that evaluation happens "before each action." Agent Accounts, the machine identity primitive underneath this, is documented as a beta feature requiring access approval.

Runlayer Guard is threat detection built for MCP specifically. Tool List Guard scans tool definitions at registration for hidden instructions and injection attempts; Tool Call Guard and Tool Intent Guard inspect runtime activity; AgentGuard watches the session trajectory for output-steering injection, sudden reasoning pivots and slow-chain drift. Runlayer's docs cite 50–100ms inference and describe three specialised classification models with more in development. Its marketing pages add benchmark figures — 99% ROC-AUC on the IO Guard Model, 95.6% accuracy, an 80% reduction in false-positive blocks — and describe a semantic alignment detector that Runlayer says is patented, citing US Provisional 63/984,897. These are vendor-reported numbers against an undisclosed evaluation set.

Runlayer Watch deploys a signed package through existing MDM and scans macOS, Windows and Linux for AI clients, shadow MCP servers, skills and plugins. It has graduated modes: Monitor, Protect (allow-unless-denied against a fail-open denylist) and Enforce (deny-by-default with fail-closed allowlists). Runlayer's own FAQ scopes the blocking precisely — shadow MCP activity can be blocked in Cursor, Claude Code and Codex on macOS today, with Windows and additional clients in development.

Runlayer Agents and Catalog are the enablement half: an agent builder with Slack, schedule and webhook triggers, and a registry that distributes approved connectors, skills and plugins with ownership, dependencies and usage signals. Waxell does not compete here and does not try to.

There is also a Hooks SDK for TypeScript and Python that streams an agent's prompts, reasoning, tool calls and responses into Runlayer Sessions and can observe, rewrite or block tool calls the agent executes directly. It is the piece most third-party write-ups miss, and it means Runlayer's reach is not confined to traffic crossing its proxy.

Where does Runlayer's perimeter sit?

With one exception, taken up below, the controls above attach to a tool call, a tool definition, an MCP configuration, or an identity's right to reach one of those. That is a coherent architecture, and Runlayer describes it in exactly those terms.

The policy language is an access grant. Principal, scope, condition. It answers who may reach what, under which circumstances with real precision — down to restricting SQL queries to specific tables through argument conditions. What it does not express is a category of behaviour independent of a target: a spend ceiling that halts a run, a quality threshold on an output, a reasoning-depth bound, a scheduling window. Those are different axes from access, and Runlayer's published policy primitives are organised around access.

The model call sits outside the default perimeter — by design, and by Runlayer's own account. Its comparison pages describe the platform as model-neutral and, in the Portkey feature table, mark LLM routing, cost tracking and prompt management as "Not provided." Runlayer does ship an LLM Gateway with virtual keys, model substitution rules, per-key USD budgets and cost metering — but its own documentation labels it "in early access as a self-hosted service" and advises talking to a Runlayer contact before rolling it out broadly. Credit where it is due: the "degrade, don't deny" behaviour, which downgrades to a cheaper model when a key's budget is spent rather than failing the request, is a genuinely thoughtful design. It is also not where Runlayer points buyers today.

Guard is a threat model, not a policy library. ToolGuard and AgentGuard target tool poisoning, injection, exfiltration, privilege escalation and intent drift. That is the right threat model for MCP and it is well executed. It is narrower than a compliance-mapped policy set: it catches attacks, not policy violations that are perfectly benign in security terms and unacceptable in operational ones.

Endpoint discovery reads the configuration layer. Runlayer states this itself: "Watch focuses on the MCP, skill, plugin, and client configuration layer that agents use to reach tools." That is the correct substrate for finding shadow MCP servers, and Runlayer's comparison pages claim no other platform offers it. It is a different substrate from network attribution — an employee pasting a customer list into a browser assistant never writes an MCP config file.

There is no published pricing. Runlayer's site has no pricing page — /pricing returns a 404 — and no pricing entry in its navigation. The conversion path is Book A Demo.

What Waxell adds

Waxell starts from the policy rather than the grant.

Observe installs with pip install waxell-observe, instruments an agent in two lines with no rebuilds, auto-instruments 200+ libraries across frameworks, LLMs and vector databases, and evaluates each run against 50+ policy categories at 0.045ms p95 across 1000+ policies. Those categories ship with the platform across families including Audit, Content, Control, Cost, Kill, LLM, Operations, Quality, Rate-Limit, Safety, Scheduling, Compliance, Delegation, Identity, Privacy and Reasoning, and they map to OWASP LLM Top 10, NIST AI RMF, ISO 42001, EU AI Act, GDPR and HIPAA, so the enforcement that stops an action also produces the attestation an auditor asks for. Identity is one category among them rather than the organising principle.

The MCP Gateway covers the same surface Runlayer's gateway does, with a different emphasis: one URL per tenant in front of 160+ upstream connectors, prompt-injection scanning of tool descriptions at fingerprint time, and a five-state trust model — Pending, Drift, Trusted, Blocked, Removed — so a server that quietly rewrites its own definitions surfaces as drift rather than coasting on prior approval. PII is redacted and secrets are blocked in flight. Destructive actions park for a human by policy with the MCP connection held open, and offboarding revokes upstream OAuth grants in one transaction. Policy propagates in 30 seconds.

Past the request path, Runtime gates each step of financial, clinical and infrastructure workflows with isolated execution, kill switches at every level, durable checkpoint-and-resume, and US or EU data residency. Endpoints discovers AI across employee machines by reading the TLS handshake hostname rather than decrypting traffic — 60+ AI provider domains, signed macOS and Windows agents, MDM-deployable through Jamf, Intune, Kandji, Hexnode and Mosyle, with capture off by default. Connect governs third-party agents working as a team, with shared context, hand-offs and an audit trail, and requires no SDK.

Feature comparison

Two estates, two right answers

Your problem is MCP sprawl: hundreds of engineers wiring Cursor and Claude Code to whatever server they found on GitHub.

Runlayer is built precisely for this and has the catalogue depth to back it. A pre-vetted registry of 18,000+ servers, one-click install, approval workflows through your IdP, Guard scanning each server before it enters the org, and Watch finding the ones that never asked. That is a strong answer to a real and urgent problem, and Waxell's 160+ upstream connectors are not in the same range.

Your problem is that agents are doing expensive, wrong or unauditable things, and only some of that involves an MCP tool.

Waxell. A runaway loop burning through model credits, an agent whose output quality degrades silently, a clinical workflow that must checkpoint and resume, a contractor's asyncio script nobody registered, ChatGPT in a browser tab — none of those are tool-call events. The 50+ policy categories evaluate in-process regardless of framework, Runtime gates high-stakes workflows step by step, and Endpoints attributes AI traffic at the network layer rather than the config file.

They are also more complementary than competitive. An organisation can run Runlayer as its MCP catalogue and enablement layer while Waxell governs the model calls, execution steps and devices that sit outside the tool layer by Runlayer's own definition.

When to use Runlayer

• MCP server sprawl is your acute problem and a curated, continuously scanned catalogue is the fastest route out of it.

• You want enablement bundled with governance — an agent builder, a skills registry and adoption analytics in the same platform.

• MCP-specific threat detection is a priority and you value purpose-built classifiers over general-purpose guardrails.

• Enterprise procurement with custom pricing and a demo-led sales cycle is a comfortable fit.

When to use Waxell

• Governance has to apply the same way across frameworks, and much of what you need to control is not a tool call.

• You want policy categories that ship with the platform and map to the frameworks auditors ask for, rather than access grants you compose yourself.

• Cost ceilings, quality thresholds and kill switches need to be policy, enforced now, not early-access infrastructure.

• Your perimeter includes browser assistants and AI apps that never write an MCP configuration file.

• Transparent pricing and a free tier matter for getting started without a sales conversation.

How Waxell handles this: Waxell is an AI control plane where enforcement is the primitive and observability is what enforcement produces. Observe instruments an agent in two lines, auto-instruments 200+ libraries, and evaluates each run against 50+ policy categories at 0.045ms p95 across 1000+ policies — cost ceilings that halt execution, PII redaction, content and safety gates, kill switches — mapped to OWASP LLM Top 10, NIST AI RMF, ISO 42001, EU AI Act, GDPR and HIPAA, so the same enforcement yields an audit you can hand over. The MCP Gateway governs tool calls across 160+ upstream connectors, scanning tool descriptions for prompt injection at fingerprint time and tracking each tool through a five-state trust model that catches a server silently changing its definitions. Runtime gates each step of workflows where being wrong is expensive, and Endpoints finds the AI running on employee machines by reading the TLS handshake rather than decrypting traffic. A dashboard after the fact is not governance. It's an autopsy.

FAQ

Is Waxell a Runlayer alternative?

For governing agent behaviour, yes — both are control planes and both enforce before an action runs. For MCP catalogue depth and enablement they are not equivalent: Runlayer ships a registry of 18,000+ MCP servers, an agent builder and a skills marketplace, and Waxell ships none of those. The honest framing is that they overlap heavily at the MCP gateway and diverge on either side of it.

Does Runlayer actually block requests, or only detect and log them?

It blocks. Runlayer's Agent IAM page states that the delegation chain, OAuth scope, agent account, policy and runtime context are evaluated before each action, and its policy documentation describes enforcing the intersection of agent, user and server policies on delegated calls. Guard adds runtime scanning with 50–100ms inference, and Watch's Enforce mode applies fail-closed allowlists on managed devices. Any characterisation of Runlayer as detection-only is out of date.

What does Runlayer cost?

Runlayer does not publish pricing. There is no pricing page on its site and no pricing entry in its navigation; /pricing returns a 404 and the site's conversion path is Book A Demo. Expect a custom enterprise quote scoped to deployment size and capabilities.

How do Runlayer Watch and Waxell Endpoints differ?

Both deploy through existing MDM and both find AI that IT never approved, but they read different substrates. Watch scans the MCP, skill, plugin and client configuration layer — Runlayer's own words — which is the right place to find a shadow MCP server wired into Cursor. Endpoints reads the plaintext hostname in the TLS handshake to attribute traffic to 60+ AI provider domains, which catches usage that never involves an MCP config, such as a browser assistant. Runlayer documents blocking in Cursor, Claude Code and Codex on macOS today with Windows in development; Waxell ships signed macOS and Windows agents.

Can Runlayer govern an agent I wrote myself, outside its gateway?

Yes. The Runlayer Hooks SDK for TypeScript and Python streams an agent's prompts, reasoning, tool calls and responses into Runlayer Sessions, and supports pre-tool enforcement with argument rewriting plus post-tool output scanning and blocking. It is a real in-process control path and is frequently overlooked in third-party comparisons. Waxell's equivalent is Observe, which auto-instruments 200+ libraries in two lines rather than requiring hooks to be wired per runtime.

Does Runlayer govern model calls and spend?

Partly, and it is candid about the boundary. Runlayer's own comparison material describes the platform as model-neutral and marks LLM routing, cost tracking and prompt management as not provided. Separately, its documentation describes an LLM Gateway with virtual keys, model substitution rules and per-key USD budgets — labelled early access and available as a self-hosted service. Waxell enforces cost policy as a shipped category with budget limits per agent, per user and per session.

Sources

• Runlayer, Platform — accessed August 4, 2026.

• Runlayer, MCP Gateway — accessed August 4, 2026.

• Runlayer, Agent IAM & Governance — accessed August 4, 2026.

• Runlayer, Runlayer Guard — accessed August 4, 2026.

• Runlayer, Runlayer Watch — accessed August 4, 2026.

• Runlayer, ROI & Observability — accessed August 4, 2026.

• Runlayer, Runlayer Agents — accessed August 4, 2026.

• Runlayer, Runlayer Catalog — accessed August 4, 2026.

• Runlayer, "Runlayer raises $30M Series A to go all in on AI" — June 2026.

• Runlayer, llms-full.txt — accessed August 4, 2026.

• Runlayer Docs, Policies — accessed August 4, 2026.

• Runlayer Docs, Agent Accounts — accessed August 4, 2026.

• Runlayer Docs, ToolGuard Models — accessed August 4, 2026.

• Runlayer Docs, AgentGuard — accessed August 4, 2026.

• Runlayer Docs, Hooks SDK — accessed August 4, 2026.

• Runlayer Docs, Agent Frameworks — accessed August 4, 2026.

• Runlayer Docs, LLM Gateway — accessed August 4, 2026.

• Runlayer Docs, Shadow AI — accessed August 4, 2026.

• Runlayer Docs, Endpoint modes — accessed August 4, 2026.

• Runlayer, "Runlayer vs. Portkey" — accessed August 4, 2026.

• Runlayer, "Runlayer vs. AWS AgentCore" — accessed August 4, 2026.

• Runlayer, Trust Center — accessed August 4, 2026.

• Fortune (Allie Garfinkle), "Vinod Khosla wanted 'every available dollar' of Runlayer's funding round" — June 24, 2026.

• Waxell, waxell/competitor-intel/runlayer.md research brief — researched July 13, 2026.

Runlayer told you where its perimeter ends. Check whether yours ends there too. Get started with Waxell.