Every call claims a slot in Redis (SET NX) before it is forwarded, so a retry or a parallel duplicate gets the first result back instead of a second charge. Policies, spend caps and human approval decide whether a call runs at all. Every decision is written to Postgres and exported to Prometheus and OpenTelemetry. Self-hosted and open source; about 2 ms added per call.
$ pip install agentraas $ agentraas-chaos --mock -- python agent.py agentraas-chaos: 6 write requests, 3 responses dropped after execution DUPLICATES: 1 action(s) executed more than once 2x POST /v1/charges (body sha256 623f14d1b00d) Fix: ... Protected by an idempotency key: 2 retries $ echo $? 1
Real output (fix suggestion shortened): the chaos tester run against a small sample agent that retries on network errors.
Teams run n8n, Flowise, Langflow, Dify, Ollama and LocalAI on their own Docker infrastructure to cut SaaS fees and stay inside GDPR / EU AI Act data-residency rules. AgentRaaS sits inside that stack: one more Docker Compose service, zero data leaving infrastructure you control.
Retries, timeouts and parallel duplicates get the first result back instead of a second charge, email or record.
Refunds over a limit, bulk emails, anything you choose is held for approval in Slack, with budget and loop limits on every agent.
Which agent called what, when, and with what result, across Stripe, your CRM and your own endpoints, in one log.
npm test), the latency from infra/scripts/bench-overhead.py. Clone the repo and run both to reproduce.Three free tools in one package. Find the calls your agent would run twice, fix them with a decorator backed by your own SQLite or Redis, and wrap any MCP server so its write tools run once. Add the server later, when your team wants the dashboard, audit trail and approvals.
# drops the response to each write after it executes, # then reports what your code ran twice $ pip install agentraas $ agentraas-chaos --mock -- python my_agent.py DUPLICATES: 1 action(s) executed more than once 2x POST /v1/charges Protected by an idempotency key: 2 retries
Exits non-zero on a duplicate, so it fails CI (how it works). GitHub Action: sumedhchatse/agentraas/src/chaos-action@main
from agentraas.local import exactly_once @exactly_once() # SQLite by default, or RedisStore def charge(customer, amount, idempotency_key=None): return stripe.Charge.create( customer=customer, amount=amount, idempotency_key=idempotency_key, # same on every retry ).id charge("cus_1", 4200) # runs charge("cus_1", 4200) # cached, no second charge
Retries, concurrent duplicates and lost responses covered. Python and TypeScript (npm install agentraas, exactlyOnce).
Put it in front of any MCP server in Claude Desktop, Cursor or any MCP client. An identical call to a write tool inside a 10-minute window returns the first result instead of running again, so a looping agent can't open the same issue or send the same email twice. Read-only tools always run. Every tool call lands in a local audit log.
Not sure which tools to worry about? agentraas scan reads your MCP config and lists the tools that can move money, delete data, run code or message people, without calling any of them. MCP safety scan
Listed in the official MCP Registry as io.github.sumedhchatse/agentraas.
{
"mcpServers": {
"github": {
"command": "uvx",
"args": ["agentraas", "wrap", "--",
"npx", "-y", "@modelcontextprotocol/server-github"]
}
}
}
The customer is charged twice, and you find out from a support ticket, not a log.
Two duplicate contacts, a messier pipeline, and a sales team that stops trusting the data.
The client gets the same update twice, and starts wondering what else is off.
Your team approves the same request twice, or gets paged twice for one incident.
Your agent sends the request to AgentRaaS instead of the API directly.
AgentRaaS atomically claims a dedup slot for that exact request in Redis.
First call: forwarded to the real API, and the result is cached.
Retry or duplicate: the cached result comes back. Never a second real execution.
Idempotency-Key header is enough.The case for AgentRaaS is narrower: not every provider has native idempotency (Twilio, Slack, most CRMs and your own endpoints don't), no-code tools can't set the header at all, and none of them give you one audit trail across services.
| DIY idempotency keys | AgentRaaS | |
|---|---|---|
| Code changes | Modify every API call, only where the provider supports it | Change the URL |
| No-code support | Not possible: no-code tools can't set custom headers | Paste a webhook URL (n8n, Make, Zapier) |
| Providers without native idempotency | Build your own dedup logic, per provider | One layer, same guarantee, every service |
| Multiple services | Different logic per API | All services, plus any custom endpoint |
| Credential management | Build yourself | Self-serve, encrypted at rest |
| Validation, circuit breaker, rate limiting | Build yourself | Built in |
| Audit trail, dashboard | Per-provider at best | One trail across every service you call |
A stalled MCP tool call gets retried just like a stalled HTTP request: same double-execution risk, different protocol. The MCP gateway applies the same atomic dedup guarantee to every tool call from Claude Desktop, Cursor, LangChain, AutoGen or CrewAI.
n8n, Make, Zapier or raw curl: change the target URL, nothing else.
POST /proxy/:service/:actionA clean per-service REST shape for scripts and internal tools.
POST /v1/sdk/:service/:actionJSON-RPC tool calls from any MCP client.
POST /mcp# agent calls a tool via MCP POST /mcp {"jsonrpc":"2.0","id":"call_82f1","method":"tools/call", "params":{"name":"stripe.createCharge", "arguments":{"amount":4200,"customer":"cus_9f2k"}}} → 200 OK // first call: forwarded, result cached {"result":{"status":"success","charge_id":"ch_1N..."}} # network stalls, agent retries the identical call 400ms later → 200 OK // slot already claimed: cached result, zero re-execution {"result":{"status":"success","charge_id":"ch_1N...", "deduplicated":true}}
AgentRaaS sits in the request path. If it's unreachable, your call fails; it never silently succeeds un-deduped. There is no fallback anywhere in the SDK, the n8n node or the MCP gateway that quietly calls Stripe or Twilio directly. Routing around an outage would mean the exact retry-storm double charge this product exists to prevent, at the moment you'd least want it. Treat it like any other dependency on your critical path.
Added latency, self-hosted single node (Intel Core i3-12100, 8 GB RAM): 500 sequential calls per run, three runs, real Postgres and Redis.
That's auth, the dedup claim, spend caps and the audit write, before the request leaves for the real API. A duplicate is answered from cache and never reaches it. Concurrent multi-client throughput numbers aren't published yet.
AgentRaaS doesn't care what your agent is for, only that when it acts, it acts exactly once. If it can call an API, AgentRaaS can protect it.
Resolve tickets, send replies, trigger refunds without a retry turning into two replies or two refunds.
Log leads, update deals, enrich contacts in HubSpot or Salesforce once per real event, not once per retry.
Book meetings, send confirmations, post status updates exactly the number of times you meant to.
Post to Slack directly, or Microsoft Teams via Custom Actions: trigger approvals and hand off work between systems, SSRF-guarded.
Update inventory, create orders, notify shipping, protected the same way on Shopify or your own warehouse API.
Put AgentRaaS in front of every client's Stripe, CRM or messaging API. Each client gets its own tenant with a white-label dashboard.
Run the AgentRaaS server (free to self-host) when a library isn't enough: approvals, agent identity, and one audit trail across every service.
Short-lived, scope-restricted credentials for each agent. Identity and the reliability guarantees applied to it are issued together and enforced before any action reaches an integration.
Add your own Stripe, Twilio or any provider's keys, encrypted at rest.
Register any endpoint, SSRF-guarded, and agents can call it too.
A JSON-RPC gateway for Claude Desktop, Cursor and any MCP client.
Stops hammering a broken upstream. Trips open, recovers automatically.
Who, what, when, status, duration. Searchable dashboard, CSV export.
Caps call count per agent, per service, for agents burning through a paid API faster than expected.
Test real inbound webhooks against your machine. One command, live inspector.
Alerts the moment a response shape changes, before your agent misreads it.
* via Custom Actions: not a pre-built connector, but reachable the same way as any endpoint. Register it once, agents call it by name.
For production, run AgentRaaS on your own servers: your API keys and your agents' data never leave them. The Community edition is free there with no action limit, and Team and Enterprise add approvals, SSO and agent identity as a license key. AgentRaaS Cloud is the quickest way to try it: a free trial of 1,000 actions with every feature, best with test keys.
Install: clone, then ./install.sh. One command.
Cloud trial: 1,000 actions once, every feature, no card. On Cloud, duplicates caught, blocked calls and approval waits are never billed, and calls stop at the monthly cap you set. Refunds and cancellation. Need a contract, invoicing or SLA-backed support? Talk to us.
The core server is AGPL-3.0. Team and Enterprise features are source-available: free to try, a license key for production use. Full terms in LICENSE.md.
The short answers. Full detail is in the docs and LICENSE.md.
Not for the core. The Community edition is free to self-host with no action limit, and the free tools (library mode, chaos tester, MCP wrap) need no account at all. Human approvals, SSO, agent identity and the other Team and Enterprise features cost $19 or $29 a month, as a license key for your own server or on AgentRaaS Cloud. Cloud starts with a free trial of 1,000 actions with every feature.
Yes, for actions. On your own infrastructure there is no cap, no metering and no phone-home check, on any edition. A license key only unlocks the Team or Enterprise features; it is checked offline, inside your server. Only AgentRaaS Cloud is metered, because it runs on our servers.
A new Cloud account gets 1,000 actions once, with every feature. After that, pick Team ($19 a month, 10,000 actions a month included) or Enterprise ($29, 20,000). Above what the plan includes, you pay $1 per 500 actions that ran, billed monthly in whole blocks of 500 with the rest carried to next month. Duplicates AgentRaaS caught, calls blocked by a policy or limit, and calls waiting for approval are never counted. You set a monthly cap, and calls stop at it instead of running up a bill. A plan also includes a self-hosted license key for the same tier. For a contract or SLA-backed support, email hello@agentraas.io.
Self-hosted means your audit log, credentials, and traffic never leave infrastructure you control. We don't see any of it. Stored credentials are encrypted at rest (AES-256-GCM), PII/DLP redaction can run before anything touches the audit log, and the log is tamper-evident and SIEM-exportable for compliance-sensitive teams.
Yes. No-code tools work the same way code does: point the HTTP Request node at your AgentRaaS URL instead of the API directly. No custom node install required for any of them.
AgentRaaS claims an atomic dedup slot in Redis before anything real happens. The first call gets forwarded and its result cached; any retry or duplicate, even a concurrent one, gets the cached result back instead of a second real execution. This is tested under real concurrent load, not just claimed (see src/api-gateway-rs/test/dedup.test.js).
The core is. The server is AGPL-3.0 and the SDKs are MIT/Apache-2.0. The Team and Enterprise features (approvals, SSO, agent identity, inbound webhooks) are source-available: you can read and try the code, and production use needs a license key. Releases up to 0.15.1 keep the Functional Source License they shipped under. See LICENSE.md for the exact terms.
agentgateway (a Linux Foundation project) is an edge proxy for AI traffic: auth, RBAC, rate limiting, and observability across all your MCP/tool servers, not just AgentRaaS. If you already run it (or want to), AgentRaaS drops in as a backend behind it with zero code changes on either side. See Getting started for the one-command setup. Most self-hosters don't need this; it matters once you're managing more than one MCP server behind a shared gateway.
Free, runs on your machine, nothing to sign up for.