Runlayer MCP. Govern every agent, server, and policy in your AI stack.

Runlayer isn't an AI itself; it’s your enterprise control plane. It governs every piece of infrastructure that talks to your models—the security guard for all your model endpoints. When you use this, you manage your entire MCP ecosystem from one place. You never have to touch a dashboard to get a full picture.

To start, you can check the whole setup with get_organization, or see who's on the payroll by calling list_members. If you need an inventory of connected servers, use list_mcp_servers; for details on any specific endpoint, just run get_mcp_server using its UUID. You can also get a rundown of every registered AI agent with list_agents, or check the detailed status of one particular agent by running get_agent.

When you need to add capacity, you use create_mcp_server to onboard a new endpoint, or you call update_mcp_server to change credentials without taking the service offline. If an endpoint is dead weight, you decommission it using delete_mcp_server. Similarly, when you build out your workforce, you register agents with create_agent, and you can adjust their rights later by calling update_agent; if an agent leaves or gets compromised, you use delete_agent to sever all its connections.

Security is where this thing shines. You define rules using create_policy and apply them across groups of resources; you can refine those access controls later with update_policy. If a policy needs to go, delete_policy takes it out, but the governed resources keep running under whatever rule set they're currently on.

For credential control, you generate unique keys using create_api_key, which you must save right away. You track all existing credentials with list_api_keys, and if there’s an incident, you immediately cut off access with revoke_api_key. The system also handles capabilities: you define reusable functions as Skills via create_skill, letting multiple agents use the same approved logic without duplicating code.

To manage these standardized pieces, you can get details using get_skill or list available skills with list_skills; if a skill is deprecated, you delete it using delete_skill. You update its definition using update_skill when necessary.

The auditing mechanisms are airtight. You track every damn thing that happens by calling get_audit_logs, giving you a chronological log of exactly who did what and when across the organization. For proactive security, you run a full system audit scan with run_mcp_sweep_scan to detect unauthorized endpoints or 'shadow AI,' then review all findings using get_scan_results.

You can also view a summary of all defined policies and how many violations they've seen by running list_policies. To maintain governance, you use the centralized tools: you add new standardized code blocks with create_skill, update them with update_skill, or delete them with delete_skill.

This system gives you total control over your whole stack. You can get a full overview of all registered skills using list_skills. If you need to remove an agent from the governance record, you use delete_agent. You manage every component—agents, policies, servers, and capabilities—through structured API calls. This lets your AI client perform these actions directly without ever needing to click through a dashboard.