Arcjet vs Runlayer

How do Arcjet and Runlayer differ?

Runlayer is an AI enablement and control platform built around a governed MCP gateway, an endpoint agent for shadow AI discovery, and hooks that scan tool calls. Arcjet is an AI agent runtime security platform that enforces one policy in the path of each action: inside your code for custom agents, and in the hooks that Claude Code, GitHub Copilot, Cursor, and OpenAI Codex already fire. The key difference is the enforcement point. Runlayer routes MCP traffic through its gateway and installs hooks with an agent on each device, and Arcjet has no gateway or endpoint agent to deploy. Choose Runlayer if your main project is rolling out a sanctioned MCP catalog and agent access to a whole workforce. Choose Arcjet if your main project is deciding, before it runs, whether a coding agent's or custom agent's tool call is allowed, with policies your engineers can test and ship like code.

Arcjet publishes this comparison. Competitor details come from Runlayer's public documentation, reviewed on September 25, 2026. Products change, so check the linked sources before you decide.

Arcjet and Runlayer at a glance

Arcjet enforces in the agent's hook and in your code, and Runlayer enforces at an MCP gateway and through hooks that its endpoint agent installs. The following table compares the two products across 13 areas.

What is Runlayer?

Runlayer is an AI enablement and control platform that governs how a workforce uses AI clients, MCP servers, and agents. Runlayer describes itself as "AI enablement, security, and control in one platform," and its homepage lists shadow AI discovery, agent access governance, secure runtime execution, spend management, an MCP gateway that serves over 18,000 prebuilt MCP servers, and a way for employees to create governed agents.

Runlayer was founded in 2025 in New York, and Andrew Berman is its CEO. The company raised an $11 million seed round in November 2025 and a $30 million Series A led by Felicis, with Khosla Ventures, in June 2026, for $42 million in total.

The MCP gateway is the center of Runlayer's product. Runlayer's policy documentation describes server-level allow and deny policies, organization-wide deny-only global policies, and approval rules in beta. The proxy evaluates access policies on every invocation.

Runlayer policy conditions can read tool arguments, request metadata, subject identity, OAuth scope, tool annotations, and session history. Policies can also be managed as runlayer_policy resources through the Runlayer Terraform provider.

On developer machines, Runlayer's AI Watch agent deploys through MDM. AI Watch discovers AI clients, MCP servers, skills, and plugins from configuration files, processes, and containers, and a browser extension monitors supported AI web chats.

AI Watch installs hooks in three modes: Monitor reports activity, Protect applies scanner block and mask decisions with fail-open MCP governance, and Enforce applies scanner and local policy decisions to non-MCP tools with deny-by-default MCP governance. Hooks are available on macOS and Windows; Linux is detection only. The Sessions page lists hook support for 11 coding clients: Cursor, VS Code, Claude Code, GitHub Copilot CLI, Gemini CLI, Cline CLI, Codex, Qwen Code, Hermes, Goose, and Windsurf. Runlayer was a launch partner for Cursor Hooks on December 18, 2025.

Runlayer's security scanners include ToolGuard, a set of ML models that scan tool definitions, tool outputs, and the match between a call's intent and its result, plus AgentGuard for session-level behavior, PII detection, credential detection, and invisible-character stripping. For custom agents, the Hooks SDK wraps tool execution in TypeScript and Python, with adapters for five frameworks: the Claude Agent SDK, Vercel Eve, Vercel AI SDK, OpenAI Agents SDK, and Google ADK. Hooks SDK enforcement calls Runlayer's API and fails closed by default when the API is unreachable.

Runlayer offers single-tenant hosting or self-hosting in your own AWS or GCP account. Runlayer's website doesn't publish pricing and offers a demo instead.

What is Arcjet?

Arcjet is an AI agent runtime security platform. Arcjet discovers the agents running in your organization, enforces policy across every action, prompt, and tool call, and keeps the evidence to prove what happened. Arcjet enforces in the path of the action, in code or in the agent's hook, not on the network.

For coding agents, Arcjet uses the hooks that Claude Code, GitHub Copilot, Cursor, and OpenAI Codex already fire, with no SDK and no code change. You install the hook configuration through managed settings, MDM, or an organization lock, so developers can't remove it without administrator access. One policy applies across all four agents and decides before the action runs, on a tool call, a prompt, or a model switch.

Arcjet ships 12 starter policies for coding agents, covering destructive commands, history rewrites, protected paths, credential access, piped installers, MCP allowlists, egress allowlists, destination threats, model allowlists, sensitive information, prompt injection, and npm publishing. Evaluation runs at the edge in over 300 data centers, and a hook adds one request of latency, typically a few tens of milliseconds.

For custom agents and applications, the JavaScript, TypeScript, Python, and Go SDKs provide guard() for tool calls, queues, MCP handlers, and any action that has no HTTP request, and protect() for HTTP routes. Integrations cover 15 frameworks: the Claude Agent SDK, Claude Managed Agents, Cloudflare Think, CrewAI, Genkit, Google ADK, LangChain, LangGraph, Mastra, OpenAI Agents, Strands Agents, TanStack AI, Vercel AI SDK, Vercel Eve, and Microsoft Agent Framework for Go.

Guard policies are centrally managed and written in Rego (OPA) or with a builder. You publish them from the Arcjet Console or the MCP server, run them in dry run before they go live, and changes take effect in real time. Detectors cover prompt injection, sensitive information, destination threats, token and spend budgets, and rate limits. The same SDK covers bot detection, rate limiting, Shield WAF, and email validation.

The Arcjet Console records every decision and session. You can export decisions to Datadog, Splunk, SentinelOne, Panther, and Amazon S3 on the Enterprise plan. Arcjet holds a SOC 2 Type 2 report, available at trust.arcjet.com.

Arcjet publishes its pricing: Individual at $25 per month, Startup at $299 per month, and custom Enterprise pricing, with a 15-day trial. Usage costs $50 per million agent requests and $5 per million web requests.

Key differences between Arcjet and Runlayer

Arcjet differs from Runlayer in four ways: where each product enforces, how policies are written, whether the product also covers the application around the agent, and which capabilities Runlayer adds that Arcjet doesn't offer. The following sections cover each one.

Enforcement point: the agent's hook, not a gateway plus an endpoint agent

Runlayer governs MCP traffic by serving it through its gateway, and Runlayer reaches local tools through hooks that its AI Watch endpoint agent installs. The design gives Runlayer a device-level view, and it means that you deploy and maintain two components: the gateway that MCP traffic routes through, and an agent on every managed device.

Arcjet has no proxy and no endpoint agent. For coding agents, the Arcjet policy runs in the hook that the vendor already built for this purpose, delivered as managed configuration. For custom agents, guard() runs in your code, next to the tool it protects. Your MCP servers keep their existing endpoints, and a tool call that never touches MCP, such as a shell command or a file write, is decided the same way as one that does.

Policies as reviewable code

Runlayer's access policies are structured rules over runtime context, managed in its platform or through Terraform. Arcjet policies are Rego, the language of Open Policy Agent, or builder rules that compile to it. Each Arcjet policy carries its own tests, runs in dry run before it goes live, and can be generated from an English description and then reviewed. Engineers can read a policy the way they read code, and a security team can publish a change without waiting for an application deploy.

One platform for agents and the application around them

Runlayer focuses on AI clients, MCP servers, and agents. Arcjet's SDK also protects the HTTP routes of the application that the agent is part of, with bot detection, rate limiting, Shield WAF, email validation, and signup protection. If your agent runs behind a public endpoint, one SDK and one console cover both the request that starts a run and the tool calls the run makes.

Where Runlayer goes further

Runlayer documents capabilities that Arcjet doesn't offer. Runlayer's gateway and Hooks SDK scan tool outputs before they reach the model. Arcjet can't do that on coding agents, because a coding-agent hook can't withhold a tool result.

Runlayer also ships an endpoint scanner and browser extension for shadow AI, an MCP catalog, identity-scoped access with OAuth, spend management, and self-hosting. Runlayer lists hook support for 11 coding clients, including Gemini CLI and Windsurf, and Arcjet supports four.

When to choose Runlayer

Choose Runlayer when your project is workforce-wide AI enablement through a governed MCP gateway and an endpoint agent. Runlayer fits when any of the following apply:

• You want to give a whole workforce a sanctioned catalog of MCP servers, skills, and agents through one gateway.
• Discovering shadow AI clients and MCP servers on managed devices is your first requirement.
• You need identity-scoped MCP access, approval rules, and spend tracking for each team.
• You need tool outputs scanned before they reach the model.
• You need to self-host the control plane in your own cloud account.

When to choose Arcjet

Choose Arcjet when your project is runtime enforcement on coding agents and custom agents, decided in the path of each action. Arcjet fits when any of the following apply:

• You want to enforce one policy on Claude Code, GitHub Copilot, Cursor, and OpenAI Codex before each tool call runs, with no gateway or endpoint agent to deploy.
• You build custom agents in JavaScript, TypeScript, Python, or Go and want the decision in your code, next to the tool.
• You want policies in Rego with tests and dry run, published without an application deploy.
• You want to check the destination an agent is about to contact against threat intelligence.
• You also need bot detection, rate limiting, and WAF rules for the application that hosts the agent.
• You want published, self-serve pricing and a trial.

For more information about the coding-agent threat model, see coding agent security.

Can you use Runlayer and Arcjet together?

Yes, Runlayer and Arcjet can run side by side. Runlayer can serve and govern your sanctioned MCP catalog and scan tool outputs at its gateway. Arcjet can decide the actions around it: shell commands, file writes, credential reads, and network destinations in coding agents, and the tool calls inside your own agents.

If both products install hooks on the same coding agent, test the combined hook configuration before you roll it out, because Runlayer and Arcjet answer the same hook events. For more information about how gateways and in-code enforcement divide the MCP problem, see MCP server security platforms.

What are the alternatives to Runlayer?

Runlayer alternatives fall into two groups: MCP gateways that host and govern MCP servers, and platforms that enforce policy on agent actions directly. The following products are common alternatives to Runlayer, depending on which part of Runlayer you need:

• Arcjet enforces one policy on coding agents through their native hooks and on custom agents through SDKs, with no gateway or endpoint agent.
• MintMCP is an MCP gateway that hosts MCP servers, manages their credentials, and keeps an audit trail of tool interactions.
• Kong offers an enterprise MCP gateway as part of its AI Gateway, which suits teams that already run Kong.
• Onyx Security positions itself as a secure AI control plane with discovery, inline inspection, and an AI gateway.

For a map of the wider category, see AI agent security platforms.