Runlayer vs Arcade.dev
Both sit between agents and the systems they act on, and both handle OAuth so agents don't run on shared service accounts. Arcade is an actions runtime aimed at engineers building agents. Runlayer is a company-wide control plane that also governs the AI clients employees already use and finds the ones nobody approved.
Choose Runlayer if you are governing AI use across the company, including employees' own clients, shadow AI and agent rollout. Choose Arcade.dev if you are an engineering team building your own agents and want delegated auth and a large tool catalog in an SDK-first runtime, including air-gapped installs.
Side by side
Same criteria as the main comparison. Each cell links to the vendor page it comes from.
| Criterion | Runlayer | Arcade.dev |
|---|---|---|
| Agent tool access | One MCP gateway across 20+ AI clients (Claude, Cursor, ChatGPT, Codex and agents), with an internal catalog of approved connectors, skills and agents.Source: runlayer.com/llms.txt | Actions runtime with a catalog of pre-built MCP tools and an open-source framework for custom tools; framework-agnostic SDKs.Source: arcade.dev |
| Auth and credential handling | Access scoped by user, group, role, agent, client, connector, tool and OAuth state; agents can have their own accounts; OAuth broker for connectors.Source: Runlayer for IT & Security · Runlayer docs: Agent Accounts · Runlayer deployment overview | Authentication against your IdP; delegated authorization so the agent acts as its user and never past its scope; no broad service accounts.Source: arcade.dev |
| Governance scope | Company-wide: shadow AI discovery via MDM, runtime security scanners, human approvals, audit and ROI reporting.Source: runlayer.com | The agents and tools routed through the runtime: pre- and post-call hooks, SSO, RBAC and audit logs. Shadow AI discovery isn't described.Source: arcade.dev |
| Coverage of agents and MCP | DocumentedOne gateway for every MCP and LLM call, across Claude, Cursor, ChatGPT, Codex and internal agents.Source: runlayer.com | DocumentedRuntime for agent tool calls across clients and frameworks; large pre-built MCP tool catalog.Source: arcade.dev |
| Identity and permissions | DocumentedScopes access by user, group, role, agent, AI client, connector, tool, OAuth state and runtime context.Source: Runlayer for IT & Security | DocumentedIdP-based authentication; delegated authorization so agents act as their user within scope.Source: arcade.dev |
| Audit logs | DocumentedFull audit trail with user and agent attribution, plus session traces.Source: runlayer.com | DocumentedFull audit logs out of the box, per the vendor.Source: arcade.dev |
| Policy enforcement | DocumentedPolicies for users, agents and tool calls; human approval; runtime scanners from alert-only to blocking.Source: runlayer.com | DocumentedPre- and post-tool-call hooks to block, redact PII and stop data movement.Source: arcade.dev |
| Shadow AI discovery | DocumentedAI Watch finds unmanaged MCPs, skills, plugins and client configs via MDM; Linux is detect-only.Source: Runlayer docs: Shadow AI | Not documentedNot described on public pages. Ask Arcade.Source: arcade.dev |
| Compliance mapping | PartialVendor states SOC 2, HIPAA and GDPR compliance; AI framework mapping isn't described publicly.Source: runlayer.com/llms.txt | PartialSOC 2 compliant; AI framework mapping not described.Source: arcade.dev |
| Deployment | DocumentedSingle-tenant hosted, or self-hosted on AWS ECS, EKS or GKE.Source: Runlayer deployment overview | DocumentedCloud, on-prem, air-gapped or hybrid.Source: arcade.dev |
| Pricing | Not published. Ask Runlayer's account team. Source: Runlayer deployment overview | Free to start, priced by usage, per Arcade. Check the pricing page for current terms. Source: Arcade pricing |
Where Runlayer is stronger
- Governs the AI clients employees already use, not only agents your engineers build.
- Shadow AI discovery and a path to move unmanaged setups onto the approved gateway.
- Runtime scanners for intent drift, PII and exfiltration, in alert-only or blocking mode, plus human approval.
- Gives non-engineers a way to use and create governed agents.
Where Arcade.dev is stronger
- Developer-first: SDKs for LangChain, LlamaIndex, Mastra, CrewAI, OpenAI Agents and others.
- Delegated authorization model built for multi-user agents in your own product.
- Cloud, on-prem, air-gapped or hybrid deployment.
- Free to start, priced by usage.
Where Runlayer is weaker
- Air-gapped deployment isn't described; self-hosting is documented for AWS ECS, EKS and GKE.
- AI framework mapping isn't described publicly.
- Pricing isn't published.
Where Arcade.dev is weaker
- No shadow AI discovery described, so unmanaged use stays out of view.
- Less focus on governing employees' own AI clients across the company.
- AI framework mapping isn't described.
Runlayer or Arcade.dev?
Choose Runlayer if you are
Security, IT and platform leaders responsible for all AI use in the company: employees in Claude, Cursor and ChatGPT, internal agents, and the setups nobody approved. Runlayer is the stronger fit when governance has to cover people as well as code.
Choose Arcade.dev if you are
Engineering teams shipping agents inside their own products or internal tools who want delegated auth, credential handling and tool execution handled by a runtime they call from code, including in air-gapped environments.
Bottom line: If the question is how to govern AI across the organization, Runlayer answers more of it: discovery, gateway, runtime security, audit and rollout. Arcade.dev is the stronger choice for a developer team that mainly needs authenticated tool execution for the agents it builds.