The short version
Pipelock is an open-source agent firewall. It scans HTTP, MCP, and WebSocket traffic routed through it for credential leaks, injection, SSRF, and tool poisoning, can emit signed action receipts for mediated decisions when a signing key is configured, and runs as a single self-hosted binary.
Runlayer describes an AI control plane with MCP access governance and configurable inspection of tool definitions, arguments, and outputs. Its site lists a catalog of more than 18,000 MCPs, shadow AI discovery across unmanaged agents and client configs, and SOC 2, HIPAA, and GDPR badges. Its Natoma comparison post says it sits between more than 300 MCP clients and their servers. Its deployment docs describe Runlayer-hosted and self-hosted deployment.
Pipelock is a self-hosted proxy for supported HTTP, WebSocket, and MCP paths, with content scanning on traffic routed through it. Inspecting inner HTTPS requests and responses carried through CONNECT tunnels requires TLS interception. Fetch mode can inspect content fetched from HTTPS origins.
Runlayer pricing
Runlayer describes a platform fee based on deployment size, with no per-seat charges. Its public pricing description doesn’t include a dollar amount, so you’ll need a quote for the deployment you’re evaluating. Pipelock’s Apache-2.0 core is free. Pro adds named security profiles with separate policies and budgets. Enterprise adds central fleet governance. See current Pipelock plans and pricing.
Feature comparison
| Feature | Pipelock | Runlayer |
|---|---|---|
| Architecture | Self-hosted proxy, single binary | Runlayer-hosted or self-hosted control plane with MCP governance and content inspection |
| Primary scope | Content scanning on HTTP, HTTPS CONNECT (payloads only with TLS interception on), WebSocket, and MCP | MCP access governance, catalog, identity, discovery, and scanning of MCP and local tool traffic |
| Credential scanning (DLP) | 65 built-in patterns, encoding-aware, environment leak detection | Credential and PII detection on tool inputs and outputs, with block, mask, or alert actions, per its ToolGuard docs |
| Prompt injection detection | Deterministic patterns with multi-pass normalization | ToolGuard classifiers on tool definitions, tool outputs, and input-output intent, per its docs |
| Tool poisoning | Description scanning and rug-pull drift detection | Tool definitions scanned at registration or re-scan, per its docs; its Natoma comparison post also claims rug-pull detection |
| SSRF protection | Private IP, metadata, and DNS rebinding checks | Not documented on the pages checked |
| Identity-based access | Not in scope at the proxy | Yes |
| MCP catalog | No | Yes, 18,000+ per the site |
| Shadow AI discovery | No | Yes |
| Signed receipts | With an enabled flight recorder, recorder directory and signing key, Pipelock can emit signed receipts for covered mediated decisions. Emission is best-effort by default; receipts can be verified offline against a trusted operator public key. | Audit logs and exports; its audit-log page says “All logs are tamper-proof.” An offline signed-receipt format wasn’t found on the audit-log and ToolGuard pages checked on 2026-10-14. |
| Compliance | Assess report: OWASP MCP Top 10, OWASP Agentic Top 10, MITRE ATLAS, EU AI Act, NIST AI RMF, HIPAA Security Rule, SOC 2; published documentation mappings: OWASP Agentic AI Threats and Mitigations, OWASP LLM Top 10, NIST 800-53 | SOC 2, HIPAA, GDPR advertised |
| Source availability | Apache-2.0 core; Enterprise under ELv2 | Closed source |
| Pricing | Free core; paid tiers published | Platform fee based on deployment size; no per-seat charges or dollar amount in the cited description |
Where Runlayer is stronger
Access governance at company scale. Which users and teams may reach which MCP servers, with permissions and approval built in. Pipelock doesn’t manage identity.
The catalog. A curated registry of approved servers that teams can browse and request. Pipelock has no catalog.
Shadow AI discovery. Visibility into unmanaged agents, MCPs, skills, and client configs across an organization. Pipelock sees only the traffic routed through it.
Deployment choice. Runlayer runs as a single-tenant deployment it operates, or self-hosted in your own AWS account or Kubernetes cluster, and its docs describe continuous audit-log export to S3 for a SIEM.
Compliance posture for procurement. SOC 2, HIPAA, and GDPR badges and named enterprise customers matter to buyers who purchase through procurement.
Where Pipelock is stronger
Coverage outside MCP. Pipelock inspects HTTP and WebSocket traffic routed through it alongside MCP, so agent activity outside the MCP tool layer is visible when the proxy is in the path. HTTPS through a CONNECT tunnel shows only the destination unless TLS interception is on.
Inspection depth. Encoding-aware DLP, injection normalization passes, tool fingerprinting and drift detection, entropy and environment-leak checks.
Open, readable rules. Every Pipelock pattern is in the public repository. Runlayer’s ToolGuard docs describe custom-trained classifiers, and their detection rules aren’t published on the pages checked.
Evidence. With a recorder directory and signing key configured, Pipelock can emit signed receipts for mediated decisions that the shipped verifier checks offline against your public key. Emission is best-effort by default. Turning on require_receipts blocks an allowed action when its receipt can’t be written; receipts for blocked actions stay best-effort.
Published pricing. The free core and the paid tiers are on the pricing page. Runlayer’s deployment docs say to ask its account team for commercial terms.
Where the two overlap
Access governance and content inspection overlap here. Runlayer decides who may reach which tools, and its ToolGuard docs describe checks on the tool definitions, arguments, and outputs that pass through its gateway. Pipelock inspects the same kinds of content on MCP paths it wraps, plus HTTP and WebSocket traffic routed through its proxy, and can sign a receipt for what it decided.
Agents don’t only act through governed tool calls. They fetch URLs and call APIs. A governed MCP path doesn’t by itself cover that traffic, and a proxy only sees what’s routed through it, so check where each agent’s traffic goes before relying on either.
Further reading
- What is an agent firewall?: definition and evaluation checklist
- Agent firewall vs guardrails: where enforcement happens
- Pipelock vs Backslash Security: another governance-platform comparison
- Agent firewall vs AI security platform: the shape question, across the platform vendors
- MCP security: the full scope of MCP threats
- Pipelock on GitHub
Sources checked
Third-party descriptions on this page come from the public materials below, read on the dates shown. Features and pricing change; check the current documentation before you decide.
- Runlayer homepage
- Runlayer site index
- Runlayer blog: why production AI systems need MCP gateways
- Runlayer docs: deployment overview
- Runlayer docs: ToolGuard
- Runlayer docs: audit logs
- Runlayer blog: Runlayer vs. Natoma
Third-party product names and marks belong to their owners. PipeLab is not affiliated with, sponsored by, or endorsed by the makers of any product compared on this page. Descriptions of other products come from their own public materials on the dates listed above and reflect PipeLab's reading of them. If something here is wrong or out of date, tell us and it will be corrected.