# Runlayer

- [Connectors](https://docs.runlayer.com/platform-connectors.md): Browse, add, and manage connectors in Runlayer
- [Native vs. Runlayer Connectors vs. Runlayer Plugin](https://docs.runlayer.com/native-vs-runlayer-connectors.md): What the three ways of connecting AI clients to tools are, when to use each, and how to roll out from ungoverned native connectors to the governed Runlayer Plugin.
- [Local MCPs](https://docs.runlayer.com/local-mcps.md): Run MCP servers on developer machines while keeping Runlayer policy, audit, and security controls in the path.
- [Custom MCP Servers](https://docs.runlayer.com/platform-deploy.md): Deploy custom MCP servers to managed infrastructure
- [Skills](https://docs.runlayer.com/platform-skills.md): Author, publish, and install reusable prompt packages with the Runlayer CLI.
- [Plugins](https://docs.runlayer.com/platform-plugins.md): Bundle multiple MCP connectors into a single, reusable toolset.
- [Agents](https://docs.runlayer.com/platform-agents.md): Create many purpose-built Agents in Runlayer and configure each one with the right model, tools, and triggers.
- [Manage Agents with Terraform](https://docs.runlayer.com/platform-agents-terraform.md): Provision and update Runlayer Agents from Terraform with the runlayer_agent resource: prompt, model, connectors, skills, built-in tools, tags, and environment.
- [Agent Evals](https://docs.runlayer.com/platform-agent-evals.md): Replay past agent runs with a different model or prompt, score the results, and compare against a control — without touching your real tools.
- [Agent Accounts](https://docs.runlayer.com/platform-agent-accounts.md): Give each agent its own identity in Runlayer, with its own policies, delegations, tokens, and audit trail.
- [Artifacts](https://docs.runlayer.com/platform-artifacts.md): Create, find, and share reports, interactive pages, and files in Runlayer.
- [Create and update](https://docs.runlayer.com/artifacts/create.md): Publish artifacts with Runlayer Agents or a connected MCP client, then revise them at the same link.
- [Share and control access](https://docs.runlayer.com/artifacts/sharing.md): Share artifacts within your organization and understand direct and inherited permissions.
- [Find and manage](https://docs.runlayer.com/artifacts/manage.md): Browse artifacts, preview and download files, review version history, and remove old results.
- [Runlayer MCP](https://docs.runlayer.com/runlayer-mcp.md): Use Runlayer's built-in self-MCP to answer audit log + analytics questions and manage your workspace.
- [Runlayer Plugin](https://docs.runlayer.com/runlayer-plugin.md): Runlayer's unified MCP entrypoint for org-approved tools, skills, and connectors.
- [Connecting AI Clients](https://docs.runlayer.com/connecting-clients.md): Choose how AI clients connect to Runlayer: one unified Runlayer Plugin endpoint, or an individual MCP URL per connector.
- [Connector OAuth Clients](https://docs.runlayer.com/connector-oauth-clients.md): Control which OAuth clients can connect to a connector: pre-registered clients with fixed credentials, and per-connector switches for self-registered (DCR and CIMD) clients.
- [Automatic Configuration Provisioning](https://docs.runlayer.com/auto-provisioning/index.md): Automatically deploy MCP server configurations to client applications across your organization
- [SimpleMDM Deployment](https://docs.runlayer.com/auto-provisioning/simplemdm.md): Deploy automatic configuration provisioning to macOS devices managed by SimpleMDM
- [Jamf Pro Deployment](https://docs.runlayer.com/auto-provisioning/jamf-pro.md): Deploy automatic configuration provisioning to macOS devices managed by Jamf Pro
- [Intune Deployment](https://docs.runlayer.com/auto-provisioning/intune.md): Deploy automatic configuration provisioning to Windows devices managed by Microsoft Intune
- [Mosyle Deployment](https://docs.runlayer.com/auto-provisioning/mosyle.md): Deploy automatic configuration provisioning to macOS devices managed by Mosyle Business
- [Iru/Kandji Deployment](https://docs.runlayer.com/auto-provisioning/kandji.md): Deploy automatic configuration provisioning to macOS devices managed by Iru/Kandji
- [Other MDM Deployment](https://docs.runlayer.com/auto-provisioning/other-mdm.md): Deploy automatic configuration provisioning to macOS devices using any MDM solution
- [Teams](https://docs.runlayer.com/platform-teams.md): Create teams, share skills, agents, plugins, and artifacts, and manage access with individual members or groups synced from your identity provider.
- [Runlayer CLI](https://docs.runlayer.com/deploy-cli/index.md): Deploy the Runlayer CLI to your fleet with a signed, self-contained package — no configuration required.
- [macOS Deployment](https://docs.runlayer.com/deploy-cli/macos.md): Deploy the Runlayer CLI to macOS devices with the signed .pkg through any MDM
- [Intune Deployment (Windows)](https://docs.runlayer.com/deploy-cli/intune.md): Deploy the Runlayer CLI to Windows devices as an Intune Win32 app
- [Linux Deployment](https://docs.runlayer.com/deploy-cli/linux.md): Install the Runlayer CLI on Linux devices through your configuration management
- [API](https://docs.runlayer.com/platform-api.md): Programmatically manage your Runlayer platform
- [Shadow AI](https://docs.runlayer.com/shadow-ai/index.md): Discover, monitor, and control shadow AI clients, MCP servers, skills, and plugins across your organization
- [Deploy AI Watch](https://docs.runlayer.com/shadow-ai/deploy/index.md): Deploy AI Watch once, then configure Monitor, Protect, Enforce, and Sessions
- [Jamf Pro](https://docs.runlayer.com/shadow-ai/deploy/jamf-pro.md): Deploy AI Watch to macOS via Jamf Pro using the signed `.pkg` and MDM Configuration Profiles. Detect, endpoint modes, and Sessions ship in one package.
- [Workspace ONE](https://docs.runlayer.com/shadow-ai/deploy/workspace-one.md): Deploy AI Watch to macOS via Workspace ONE using the signed `.pkg` and Custom Attribute–parameterized profile. Detect, endpoint modes, and Sessions ship in one package.
- [Iru / Kandji](https://docs.runlayer.com/shadow-ai/deploy/kandji.md): Deploy AI Watch to macOS via Iru/Kandji using the signed `.pkg` and MDM Configuration Profiles. Detect, endpoint modes, and Sessions ship in one package.
- [JumpCloud (macOS + Windows)](https://docs.runlayer.com/shadow-ai/deploy/jumpcloud.md): Deploy AI Watch to macOS and Windows via JumpCloud using the signed `.pkg` / `.msi` and JumpCloud Private Repo. Detect, endpoint modes, and Sessions ship in one package per OS.
- [SimpleMDM](https://docs.runlayer.com/shadow-ai/deploy/simplemdm.md): Deploy AI Watch to macOS via SimpleMDM using the signed `.pkg` and MDM Configuration Profiles. Detect, endpoint modes, and Sessions ship in one package.
- [Mosyle](https://docs.runlayer.com/shadow-ai/deploy/mosyle.md): Deploy AI Watch to macOS via Mosyle using the signed `.pkg` and MDM Configuration Profiles. Detect, endpoint modes, and Sessions ship in one package.
- [Other MDMs](https://docs.runlayer.com/shadow-ai/deploy/other-mdm.md): Deploy AI Watch to macOS via any MDM that supports Custom Apps and Custom Configuration Profiles. Detect, endpoint modes, and Sessions ship in one package.
- [Intune (Windows)](https://docs.runlayer.com/shadow-ai/deploy/intune.md): Deploy AI Watch to Windows via Microsoft Intune with bootstrap-minimal MSI configuration.
- [Intune (macOS)](https://docs.runlayer.com/shadow-ai/deploy/intune-macos.md): Deploy AI Watch to macOS via Microsoft Intune using the signed `.pkg` and custom Configuration Profiles. Detect, endpoint modes, and Sessions ship in one package.
- [Linux (Detect only)](https://docs.runlayer.com/shadow-ai/deploy/linux.md): Deploy AI Watch to Linux fleets via .deb / .rpm packages with all-user Detect scans and automatic binary updates. Endpoint modes and Sessions are not available on Linux.
- [SaltStack (Detect only)](https://docs.runlayer.com/shadow-ai/deploy/salt.md): Deploy the Detect-only Linux AI Watch scanner with SaltStack — install the .deb / .rpm from your own Salt fileserver and manage the two config files from pillar.
- [Container (Detect only)](https://docs.runlayer.com/shadow-ai/deploy/container.md): Deploy AI Watch as a container that scans bind-mounted host user homes — standalone docker run or a Kubernetes DaemonSet / CronJob. Detect only; endpoint modes and Sessions are not available.
- [Test Device](https://docs.runlayer.com/shadow-ai/deploy/test-device.md): Install AI Watch or Runlayer CLI/desktop on one device without an MDM
- [Remove AI Watch](https://docs.runlayer.com/shadow-ai/deploy/remove.md): Remove AI Watch packages, profiles, scheduled tasks, and legacy script-based installs
- [Legacy macOS Detect Cleanup](https://docs.runlayer.com/shadow-ai/deploy/macos-cleanup-script-deployment.md): Remove the legacy script-based AI Watch Detect artifacts before rolling out the AI Watch .pkg.
- [User and Identity Mapping](https://docs.runlayer.com/shadow-ai/identity-mapping.md): How AI Watch maps device usernames to Runlayer users for Shadow AI, endpoint hooks, and Sessions
- [Cursor Cloud Agents](https://docs.runlayer.com/shadow-ai/cursor-cloud-agents.md): Send monitor-only Cursor Cloud Agent sessions to Runlayer with scoped repository or team hooks.
- [Grok Bot](https://docs.runlayer.com/shadow-ai/grok-bot.md): Requirements and limitations for configuring monitor-only Grok Bot cloud hooks.
- [Central Grok Bot setup](https://docs.runlayer.com/shadow-ai/grok-bot-central-setup.md): Deploy Grok Bot monitoring with Enterprise Team Setup, provision credentials, and verify each member's coverage.
- [Detect](https://docs.runlayer.com/shadow-ai/detect/index.md): Discover and inventory AI clients, shadow MCP servers, skills, agent definitions, and plugins via scheduled scans
- [Windows Subsystem for Linux coverage](https://docs.runlayer.com/shadow-ai/wsl-coverage.md): What AI Watch Detect scans inside WSL, when each scan runs, and the current limits
- [Browser extension](https://docs.runlayer.com/shadow-ai/browser-extension.md): Monitor and protect supported AI web chats in Chrome, Edge, and Firefox
- [Protect Policy](https://docs.runlayer.com/shadow-ai/protect/policy.md): Block explicitly denied MCP sources in Protect while allowing unmatched sources
- [Endpoint modes](https://docs.runlayer.com/shadow-ai/enforce/index.md): Choose Monitor, Protect, or Enforce behavior for real-time AI client tool calls
- [Enforce Policy](https://docs.runlayer.com/shadow-ai/enforce/policy.md): Configure the Enforce allowlists and built-in tool blocks that decide which unmanaged tool sources are permitted
- [Re-analyzing Classifications](https://docs.runlayer.com/shadow-ai/re-analyzing.md): Refresh server and skill classifications without waiting for new device scans
- [Troubleshooting](https://docs.runlayer.com/shadow-ai/troubleshooting.md): Common issues and solutions for AI Watch package, endpoint modes, and Sessions deployments
- [Responding to Discoveries](https://docs.runlayer.com/shadow-ai/responding-to-discoveries.md): Security team framework for handling discovered shadow MCP servers and skills
- [AI Watch FAQ](https://docs.runlayer.com/shadow-ai/faq.md): Pre-deployment, security-review, and operational questions about AI Watch (Detect, endpoint modes, and Sessions)
- [Policies](https://docs.runlayer.com/platform-policies.md): Manage access control policies for MCP servers
- [Regular Expression Syntax](https://docs.runlayer.com/policy-regex-syntax.md): The regex features Runlayer supports (RE2) for policy conditions and custom PII rules
- [Incidents](https://docs.runlayer.com/platform-incidents.md): Triage and remediate grouped security signals from one inbox
- [Sessions](https://docs.runlayer.com/platform-sessions.md): Monitor, detect, and enforce security across the full agentic lifecycle
- [ToolGuard Models](https://docs.runlayer.com/runlayer-toolguard.md): Industry-leading AI security suite for MCP ecosystems
- [ToolGuard Model Versions](https://docs.runlayer.com/toolguard-model-versions.md): Changelog of deployed Runlayer security model versions (tool, topic, and skill scanning)
- [AgentGuard](https://docs.runlayer.com/agentguard.md): Session-level behavior monitoring that detects manipulation across an agent's full trajectory
- [Recent Security Threats](https://docs.runlayer.com/security-threats.md): Recent AI agent vulnerabilities that Runlayer ToolGuard protects against
- [Audit Logs](https://docs.runlayer.com/platform-audit-logs.md): Track all MCP activity and access history
- [Analytics](https://docs.runlayer.com/platform-analytics.md): View organization-wide usage and adoption metrics
- [Approvals](https://docs.runlayer.com/platform-approvals.md): Review and approve MCP requests
- [Roles & Permissions](https://docs.runlayer.com/platform-roles.md): Manage admin roles and platform capabilities
- [Slack Notifications](https://docs.runlayer.com/platform-slack-notifications.md): Get real-time Slack alerts for security events, access requests, approvals, and disconnected connectors
- [Microsoft Teams](https://docs.runlayer.com/platform-microsoft-teams.md): Connect an agent to Microsoft Teams for @mentions, DMs, channel monitoring, and proactive channel updates
- [Terraform Provider](https://docs.runlayer.com/terraform-provider.md): Set up the Runlayer Terraform provider and manage Runlayer resources from Terraform.
- [Deployment Overview](https://docs.runlayer.com/deployment/overview.md): Choose the right deployment method for your infrastructure needs
- [Kubernetes Prerequisites](https://docs.runlayer.com/deployment/kubernetes-prerequisites.md): Cluster requirements for self-hosting Runlayer on EKS or GKE — you provision the cluster
- [External Dependencies](https://docs.runlayer.com/deployment/external-dependencies.md): Postgres, Redis, buckets, streams, and sample Terraform for EKS (AWS) and GKE (GCP)
- [Runlayer-Provided Inputs](https://docs.runlayer.com/deployment/runlayer-provided-inputs.md): Credentials, image pins, and registry access you must obtain from Runlayer before installing the operator
- [Workload Identity](https://docs.runlayer.com/deployment/workload-identity.md): Map operator ServiceAccounts to IRSA (EKS) or Workload Identity (GKE) with a per-feature permission matrix
- [Runlayer Operator (Kubernetes)](https://docs.runlayer.com/deployment/runlayer-operator.md): Deploy Runlayer on EKS or GKE with the unified runlayer-operator — dependencies, cluster requirements, Helm install, secrets, and RunlayerInstance CR
- [ECS + Terraform](https://docs.runlayer.com/deployment/terraform.md): Deploy production-ready infrastructure on AWS ECS using Terraform
- [ECS Terraform inputs](https://docs.runlayer.com/deployment/terraform-ecs-inputs.md): Complete inputs reference for the Runlayer ECS Terraform module (generated from variables.tf)
- [EKS + Terraform (deprecated)](https://docs.runlayer.com/deployment/eks-terraform.md): Deprecated — use the Runlayer Operator on a cluster you manage
- [Self-Hosted Egress Requirements](https://docs.runlayer.com/deployment/egress-requirements.md): Outbound HTTPS hosts that self-hosted Runlayer (ECS/EKS) must reach when corporate egress filters or SWGs deny by default.
- [Sentry Relay Credentials from WorkOS Vault](https://docs.runlayer.com/deployment/sentry-relay-vault.md): Provision Sentry Relay credentials for ECS and Runlayer Operator deployments
- [Shared Responsibility Model](https://docs.runlayer.com/operations/shared-responsibility.md): Who operates and supports what across Runlayer-hosted and self-hosted deployments
- [Updates](https://docs.runlayer.com/operations/updates.md): System updates and version management for Runlayer
- [Backup & Restore](https://docs.runlayer.com/operations/backup-restore.md): Data backup and disaster recovery procedures for Runlayer
- [Maintenance](https://docs.runlayer.com/operations/maintenance.md): System maintenance and operational procedures for Runlayer
- [Troubleshooting](https://docs.runlayer.com/operations/troubleshooting.md): Common issues and troubleshooting procedures for Runlayer
- [Agent Account Authentication Recipes](https://docs.runlayer.com/cookbook-agent-accounts.md): Copy-paste recipes for authenticating agent accounts, mapping external users, and managing session grants for OAuth-protected MCP servers.
- [Agent Accounts: Sender-Constrained Tokens (DPoP)](https://docs.runlayer.com/cookbook-agent-accounts-dpop.md): Bind agent account tokens to a client-held ES256 key with RFC 9449 DPoP so a leaked token cannot be replayed.
- [Build Custom MCPs with MCP Builder](https://docs.runlayer.com/mcp-custom-servers.md): Use Runlayer MCP plus MCP Builder prompt to scaffold custom MCP servers fast.
- [Tool Output Offloading](https://docs.runlayer.com/tool-output-offloading.md): Prevent context window bloat from large tool responses
- [Skip Tool Input Validation](https://docs.runlayer.com/skip-tool-input-validation.md): Bypass strict MCP input schema validation for malformed upstream servers
- [Anthropic MCP Tunnels](https://docs.runlayer.com/anthropic-mcp-tunnels.md): Use Anthropic MCP Tunnels to connect Claude to Runlayer connectors in private customer tenants.
- [Network & Firewall Requirements](https://docs.runlayer.com/network-firewall-requirements.md): Outbound allowlists for managed devices and Runlayer-hosted connectors — plus TLS inspection, VPN/SASE, and pointers to self-hosted platform egress.
- [SSL Certificate Management](https://docs.runlayer.com/ssl-certificate-management.md): Complete guide to SSL/TLS certificate management: cert-manager vs AWS Certificate Manager (ACM)
- [SMTP Configuration](https://docs.runlayer.com/smtp-configuration.md): Configure custom SMTP settings for email delivery in Runlayer
- [OAuth Broker](https://docs.runlayer.com/oauth-broker.md): Centralized OAuth 2.0/OIDC broker with PKCE and DCR for simplifying third-party integrations.
- [OAuth for Deployed MCP Servers](https://docs.runlayer.com/deploy-oauth.md): Build custom MCP servers with OAuth that authenticate users against third-party services like Slack or Google.
- [Integrations](https://docs.runlayer.com/integrations.md): Connect your agents and AI tools to Runlayer
- [Agent Frameworks](https://docs.runlayer.com/agent-frameworks.md): Use Runlayer-hosted MCP servers with your agent framework
- [Runlayer Hooks SDK](https://docs.runlayer.com/runlayer-hooks-sdk.md): Hook enforcement and telemetry for TypeScript and Python agent runtimes
- [Anthropic Inference hooks](https://docs.runlayer.com/anthropic-inference-hooks.md): Inspect Claude prompts with Runlayer before Anthropic runs inference
- [Claude Cowork monitoring](https://docs.runlayer.com/claude-cowork-monitoring.md): Send Claude Cowork OpenTelemetry session events to Runlayer
- [Claude Code OTLP monitoring](https://docs.runlayer.com/claude-code-otlp-monitoring.md): Send Claude Code OpenTelemetry logs to Runlayer without installing hooks
- [Agent Platforms](https://docs.runlayer.com/agent-platforms.md): Connect agents on third-party platforms with shared identity, policy, audit, and session monitoring where supported
- [Adaptive](https://docs.runlayer.com/servers/adaptive.md): MCP server for Adaptive integration
- [Gong](https://docs.runlayer.com/servers/gong.md): MCP server for Gong integration
- [Google Workspace](https://docs.runlayer.com/servers/google-workspace.md): MCP servers for Google Calendar, Gmail, Drive, Docs, Sheets, Slides, and Forms
- [Metabase](https://docs.runlayer.com/servers/metabase.md): MCP server for Metabase integration
- [Microsoft 365](https://docs.runlayer.com/servers/microsoft-365.md): MCP servers for Outlook, Outlook Calendar, OneDrive, SharePoint, and Teams via Microsoft Graph
- [Salesforce](https://docs.runlayer.com/servers/salesforce.md): MCP server for Salesforce integration
- [Slack](https://docs.runlayer.com/servers/slack.md): MCP server for Slack integration
- [Snowflake](https://docs.runlayer.com/servers/snowflake.md): MCP server for Snowflake integration
- [Workday](https://docs.runlayer.com/servers/workday.md): MCP server for Workday HCM: workers, time off, time tracking, and business process actions
- [Figma](https://docs.runlayer.com/servers/figma.md): Connect Figma's remote MCP server through Runlayer with a customer-registered OAuth app
- [Glean](https://docs.runlayer.com/servers/glean.md): Remote MCP server for Glean enterprise search and knowledge management
- [NetSuite](https://docs.runlayer.com/servers/netsuite.md): Remote MCP server for NetSuite (Oracle) ERP, CRM, and business operations via the NetSuite AI Connector Service
- [Slack (Official)](https://docs.runlayer.com/servers/slack-official.md): Connect agents to Slack easily and securely through Slack's official MCP server.
- [Adding GitHub MCP server](https://docs.runlayer.com/github-mcp-oauth-setup.md): Add the GitHub MCP server via the OAuth Broker (hosted) or a pre-registered OAuth app (self-hosted)
- [Adding Microsoft Agent 365 (Work IQ) MCP servers](https://docs.runlayer.com/agent365-setup.md): Connect Microsoft 365 services (Teams, Outlook, SharePoint, etc.) through Agent 365 Work IQ MCP servers
- [Architecture](https://docs.runlayer.com/infrastructure/architecture.md): System architecture and design principles for Runlayer
- [MCP Troubleshooting](https://docs.runlayer.com/mcp-troubleshooting.md): Diagnose MCP issues, understand common errors, and try self-service fixes before escalating to your admin.
- [MCP Security Best Practices](https://docs.runlayer.com/mcp-security-best-practices.md): Comprehensive security guidelines for safely deploying and managing MCP servers in your organization
- [MCP vs. CLI for Agents](https://docs.runlayer.com/mcp-vs-cli.md): Why route agent tool access through MCP instead of giving agents raw CLI access, and how Runlayer governs both
- [Status Page](https://docs.runlayer.com/status-page.md): Access your tenant's real-time uptime monitoring status page


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.