Key Takeaways

• The First MCP Ecosystem Lawsuit: The legal battle between Rippling and Runlayer marks the first major intellectual property lawsuit over Model Context Protocol (MCP) gateway architecture, escalating from trade secret claims to counter-lawsuits over data patents.
• The Danger of Extended Vendor Trials: Sharing source code, deployment blueprints, and system roadmaps during extended enterprise pilots creates severe IP risks if trial contracts lack strict anti-derivative protections.
• Protecting AI Infrastructure: Startup founders must combine tight legal contracts with operational safeguards like zero-trust evaluation sandboxes, obfuscated builds, and complete audit logging to safeguard their technology.
  

Executive Overview

Imagine spending nearly a year working closely with a $16.8 billion workforce software giant. You share your application source code, product roadmaps, and gateway architecture under a non-disclosure agreement to prove your software works. Then, right after price talks collapse, an insider texts you that the client built a near-identical clone of your system.

That exact nightmare scenario unfolded on July 28, 2026, when AI security startup Runlayer sued Rippling in Manhattan federal court for trade secret theft. Two weeks later, on August 10, 2026, Rippling struck back by suing Runlayer for infringing three data management patents.

As the first major legal fight in the Model Context Protocol (MCP) space, this battle gives every startup founder, developer, and B2B tech lead a vital blueprint for protecting intellectual property.

1. What Happened in the Rippling v. Runlayer Lawsuit?

The Initial Trade Secret Complaint in Federal Court

On July 28, 2026, AI infrastructure startup Runlayer (legally known as Anysource, Inc.) filed a lawsuit against workforce management firm Rippling (People Center, Inc.) in the U.S. District Court for the Southern District of New York. Runlayer, an AI startup backed by Khosla Ventures and Felicis with $42 million in venture funding, accused Rippling of trade secret misappropriation, breach of contract, and unfair competition.

During this extended pilot, Runlayer shared full application source code, deployment topology, authorization designs, and customer-specific product roadmaps. When commercial licensing talks broke down over price, Runlayer shut off Rippling’s access on June 12, 2026. That same day, a Rippling insider reportedly sent a text message to Runlayer CEO Andrew Berman warning that Rippling had built an internal project that was “almost a 1 to 1 copy of Runlayer.”

The Counter-Attack: Rippling Sues Over Data Patents

Rippling quickly denied the allegations, maintaining that its AI products were built independently using its own proprietary software. On August 10, 2026, Rippling escalated the legal fight by filing a patent infringement lawsuit against Runlayer in federal court.

Rippling claims that Runlayer’s AI data governance platform infringes three distinct data patents owned by Rippling. These patents cover specialized methods for managing enterprise data access, security permissions, and structured data flows across organizational applications.

This counter-lawsuit transformed a straightforward trade secret dispute into a complex two-front battle. It highlights how fast enterprise technology fights can turn into defensive patent litigation when big software companies face legal pressure from early-stage partners.

2. What Is the Model Context Protocol (MCP) and Why Is It So Valuable?

Demystifying the MCP Control Plane

To understand why both companies are fighting so hard, you first need to understand the technology at the heart of the dispute. The Model Context Protocol (MCP) is an open-source standard designed to connect artificial intelligence agents to external enterprise tools, databases, and software applications.

An MCP Gateway acts as an intelligent control plane and security guard between AI agents and company data sources. It checks user permissions, enforces corporate security policies, logs actions for compliance audits, and prevents unauthorized data leaks.

Why AI Gateways Are the New Enterprise Battleground

As companies deploy autonomous AI agents across payroll, HR, engineering, and finance, the control plane becomes the most critical layer of the tech stack. Whoever controls the gateway controls how AI interacts with enterprise data.

This infrastructure represents a massive business market for software vendors. Controlling the gateway layer allows companies to set standard security protocols, charge per-agent authorization fees, and manage enterprise AI workflows at scale.

Because the market for AI governance is expanding so quickly, establishing early dominance in MCP gateway technology is worth billions. That high financial stake is why both Rippling and Runlayer are using aggressive legal strategies to defend their technical territory.

3. The Enterprise Pilot Trap: How Vendor Evaluations Go Wrong

The Vulnerability of Year-Long Software Trials

Selling software to large enterprise buyers usually requires proving that your product can handle complex workflows. Prospective buyers often demand trial periods to test security standards, performance, and system compatibility.

However, when an evaluation trial drags on for nearly a year without a signed contract, the risk profile changes completely. What starts as a short trial can slowly turn into a deep engineering collaboration where the buyer gains complete visibility into your system architecture.

If you want to build scalable products quickly without getting bogged down by slow enterprise cycles, review our guide on AI-driven software prototyping to see how fast development teams can iterate and launch.

4. How Founders and Tech Leads Can Protect Their IP During Enterprise Trials

Implement Zero-Trust Evaluation Sandboxes

Never hand over uncompiled source code or raw deployment scripts during an initial enterprise evaluation trial unless it is absolutely necessary. Instead, grant prospective customers access through a vendor-hosted zero-trust sandbox environment.

Keep the core application logic, security algorithms, and database structures isolated inside your own cloud infrastructure. Provide API access or restricted demonstration environments so the client can test performance without seeing your underlying code.

If a client insists on evaluating software on their own private servers, use obfuscated binary builds and feature-flagging. This approach allows the buyer to verify functionality while keeping your core intellectual property protected.

Tighten Non-Disclosure and Non-Derivative Contract Clauses

Standard NDAs protect confidential information, but enterprise trial agreements must include explicit non-derivative work provisions. Your contract should explicitly state that the buyer cannot use pilot access to design, build, test, or commercialize any competing product or feature.

Include strict time limits on evaluation periods, capping pilots at 30 to 60 days. If the customer needs more time, require a formal written extension along with a non-refundable pilot fee to ensure commercial commitment.

For additional legal resources, contract templates, and fundraising playbooks designed for early-stage teams, check out our collection of Tepi AI founder resources.

Maintain Comprehensive Audit Logs and Access Limits

Treat enterprise evaluations as monitored environments. Implement detailed logging that records every user login, API call, database query, and documentation download made by the prospective customer during the pilot.

Limit access to a specific list of named trial users rather than opening access to an entire organization. If thousands of client employees begin using your software daily during a trial, pause access until a commercial license agreement is signed.

Detailed audit logs provide crucial evidence if a legal dispute ever arises. Having immutable records of who accessed what data and when makes it far easier to enforce trade secret claims in court.

5. The Build-vs-Buy Dilemma in Enterprise AI Infrastructure

Why Enterprise Incumbents Struggle to Build In-House

When large enterprise software firms see a fast-growing startup solving a major technical problem, their first instinct is often to consider building a solution in-house. They have massive engineering budgets, millions of existing users, and established enterprise sales channels.

However, building complex AI security and governance tools requires specialized technical expertise. Startups that focus deeply on a single problem usually innovate much faster than internal corporate teams trying to manage dozens of competing internal priorities.

This speed gap creates an awkward dynamic. Enterprise buyers need the startup’s cutting-edge technology today, but they also want to own the underlying infrastructure long-term.

Finding the Right Path for Enterprise AI Partnerships

Despite the legal risks highlighted by the Rippling and Runlayer case, enterprise partnerships remain essential for growing B2B SaaS companies. Large enterprise pilots provide valuable feedback, market validation, and revenue scale that early-stage startups cannot get anywhere else.

The key is entering these partnerships with clear legal boundaries and realistic expectations. When you protect your core architecture, set firm trial deadlines, and monitor system usage, you can safely partner with major tech companies without risking your core business.

To learn more about founder strategy, enterprise software trends, and practical AI guides, visit the Tepi AI platform.

Written by Arnav Bhardwaj