Open Protocol, Closed Gates: Reading the First MCP Trade Secret Lawsuit as a Value Capture Signal

Ignore the trade secret allegations. Look at the vector. The first commercial-litigation event in the Model Context Protocol ecosystem is not a copyright dispute. It is a pricing dispute escalated into a property-rights question: when an open protocol standardizes the rails, who owns the switches? Rippling — the $13 billion HR, payroll, and IT platform — never sued its former vendor. Runlayer sued Rippling, alleging that the enterprise platform replaced its MCP gateway with an in-house replica, copying the startup's proprietary architecture almost 1-to-1. The complaint landed as MCP's stateless specification was being finalized, and as Snowflake and AWS shipped their own gateway products. The timing is the story. Illusions dissolve under stress testing, and this is the MCP ecosystem's first stress test of where value actually concentrates. MCP is consolidating as the plumbing layer for AI-agent traffic. The protocol itself is open, but the gateway — the control plane managing authentication, access control, observability, and policy execution — is where the commercial weight settles. This is a familiar architecture: protocol standardized below, control plane proprietary above. The protocol's move to a stateless specification is the detail most observers will miss. Statelessness lowers the barrier for servers to join the network, but it pushes session management, governance, and data lineage upward into the gateway. That is not a technical footnote. It is a statement about where economic value migrates in a standardized stack. During my work modeling AI-agent economies in 2025, I ran simulations of autonomous agents interacting with blockchain networks. The choke points were never the base protocols. They were the infrastructure layers governing access, identity, and policy. The enterprise MCP gateway is the same pattern: the protocol defines the language; the gateway controls who speaks, with what authority, and with what audit trail. Runlayer's commercial behavior confirms the strategic stakes. The startup engaged Rippling through enterprise trials, signed NDAs, and entered price negotiations. When negotiation collapsed, it suspended service rather than discount. That is not the behavior of a thin proxy vendor. It is the behavior of a company that believes its control-plane architecture is a defensible, premium asset. Rippling's response — building the gateway in-house rather than re-engaging a vendor — is a $13 billion platform's admission that data-access control is a strategic capability, not a commodity purchase. Snowflake and AWS are not entering this market for marginal API revenue. They are entering because the gateway is the interception point for enterprise data flows. Whoever controls the gateway controls the routing of AI-agent queries to corporate data. That is why the category gained density: the open protocol removed switching costs at the message layer, moving the battleground to the governance layer. This is layered-market economics — value concentrates where the architecture refuses to standardize. The technical core of the case is the almost 1-to-1 copy allegation. If Runlayer can substantiate code-level or architecture-level replication, its trade secret claim is strong. Courts look for fingerprints in these cases: identical decision trees, unusual naming conventions, matching fault-handling logic. There is a deliberate opacity here. The complaint withholds the specific trade secrets at issue — the authentication policy model, audit log mechanics, permission caching scheme, data lineage algorithms, or some combination. That vagueness is itself a protection strategy. Every detail disclosed in litigation narrows the claimed secret. Runlayer is playing the long game, defining the secret's boundary only as discovery forces it to. The unanswered questions will determine the outcome. Has Runlayer deployed watermarking or configuration fingerprints that can identify copying? Is MCP's reference implementation public — if it is, Rippling can argue its implementation tracks the spec, not the competitor? And most critically: how will the court separate replication functionally required for interoperability from architecturally gratuitous copying? That distinction is the technical heart of the case. Discovery will also test the secrecy element. Trade secret claims require reasonable efforts to maintain confidentiality — the NDA is the visible part. The harder question is whether Runlayer's specific gateway deployment architecture qualifies as non-public knowledge while the protocol's reference examples are still settling. If MCP's reference implementation is public, Rippling's defense writes itself: its gateway merely implements the spec. If it is not, or if Runlayer can show design choices beyond any reasonable reading of the spec, the claim gains real force. My read, from auditing proof-of-reserves and tokenomics claims in earlier cycles: the copying claim will hinge on evidence of non-obvious implementation choices, not surface-level feature similarity. In my 2017 ICO audits, I found projects with less than 5% of claimed reserves in cold storage — the narratives said one thing, the data said another. Here, the evidentiary floor is similar. The complaint's wording suggests Runlayer believes it can show structural copying. Whether it can prove it is a discovery-phase question. Confidence sits at B-minus, medium-high: the industry dynamics are clear, but the secret's specific content is not public. Commercially, the deeper story is the strategic shift inside Rippling. The price negotiation likely failed not over decimals but over a category change. Runlayer's gateway needed deep integration into Rippling's internal data systems. During the trial, Rippling's team could see the gateway's role in its own product ecosystem. It stopped buying a tool and started seeing a capability. That is why the negotiation broke, why the in-house build began, and why the lawsuit exists. Rippling's deeper motive is not gateway replacement. It is data architecture. Rippling sits on massive employee and business data across HR, payroll, and IT. An in-house gateway lets it build a closed data-access foundation — AI tools connecting to Rippling data through Rippling's own control plane. That strengthens the moat around its SaaS business. The litigation is the byproduct of a strategic decision that had already been made. There is also a compliance revenue angle the case documents ignore. MCP compliance is becoming part of enterprise security baselines. A gateway with audit-ready reporting and policy templates carries quasi-certification value. That creates derivative revenue streams — compliance reports, security audits, integration certifications — that compound the core license. Runlayer's suspension of service rather than price concession reads differently in that light: it was protecting the pricing anchor of a broader product family. Competitive pressure runs in both directions. Snowflake and AWS entering the gateway market validates the category's commercial size, but it also compresses the pricing power of standalone gateway startups. Cloud bundling will erode independent margins the way hyperscalers eroded standalone middleware. The independent gateway company is now sandwiched between hyperscaler bundling below and platform incumbents building internally above. The conventional framing is that open protocols should defeat proprietary chokepoints — that standardization commoditizes the stack and distributes value to the edges. That framing is wrong. This lawsuit is evidence that the proprietary control plane is the only durable value-capture point in an increasingly commoditized protocol layer. Interoperability at the message level coexists perfectly with lock-in at the governance level. They are not contradictions; they are complementary. The protocol's openness invites everyone to the network. The gateway's proprietary architecture decides who has authority inside it. The closest analogue is the layer-2 stack. The consensus layer is open; the sequencer is proprietary. The real difference between competing stacks is not cryptographic elegance — it is which side convinces more teams to deploy. The MCP gateway is the sequencer of the agent economy. The same commercial logic applies: standardization at the base creates the chokepoint above it. The decoupling thesis: even a complete legal defeat for Runlayer would not defeat the gateway market. It would signal that the strongest protection is not trade secret law but architectural velocity — the ability to outrun imitators as AWS and Snowflake set the pace. For Rippling, a legal victory still leaves it owning a gateway it must maintain forever, with no vendor accountability. Litigation outcomes and market outcomes are different vectors. For capital allocators, the floor is a trap for the impatient. Do not position on the verdict. Position on the boundary conditions the case reveals: enterprise AI procurement is now a security-gated market, compliance is a feature, and the gateway is the toll booth. Volume without conviction is just noise — and the early commentary around this case is mostly noise. The next three to five years will bring more cases like this. Courts, not just markets, will define property rights in the AI-agent economy. The Runlayer suit is the first data point. Follow the vector, not the hype. Value flows to where control meets standards — to the layer that upholds the open protocol while owning the governance above it. The winner of this case matters less than the architecture it affirms. The gateway is infrastructure now. Treat it accordingly.