Rayrun Credential Blast Radius

Rayrun collapses credential exposure to a single hosted endpoint: upstream keys live in its vault, and each client receives only a token. The framework asks one question per engagement: how many environments would hold that secret without Rayrun? A salon with one OpenAPI integration has a blast radius of one, so the $1,800 Starter MCP Deploy at 16 hours is a clean fit. A five-client agency running separate MCP servers across Claude, Cursor, VS Code, and Windsurf has a blast radius of five or more, and the Team plan at $25 monthly, with its shared credential vault and client-specific access roles, pays for itself the first time a client rotates a key. Model the radius before quoting: the wider it is, the more of the retainer Rayrun's per-tool-call pricing at USD 0.2 per 1,000 calls can absorb without eroding delivery margin.