Offerings
A runtime for your code, a database for its state, a safe place for its keys, logs you can search, and a team that can work on it. Here is what each piece does today.
Runtimes
Every runtime is driven the same way: mb agent create --runtime …, then git push mb main. The platform writes the Dockerfile from its base-image catalog, so builds are reproducible and patched by us. Your app listens for HTTP on $PORT.
Push an agent.py that exports your LangGraph graph (graph, app, chain, agent or runnable). The built-in harness wraps it in an HTTP server.
/invoke, /stream (server-sent events), /chat, /healthzAny HTTP app: FastAPI, Flask, a webhook receiver, an MCP or tool server.
main.py, app.py or server.py; or a Procfile web: line; or --start-command.requirements.txt.python-version or runtime.txt; 3.12 by default.A go.mod module with a main package, compiled and copied onto a minimal image.
go line in go.mod.Custom Dockerfiles are not supported: the runtime always builds the image. If you need a system package or an extra build step, tell us and we'll consider adding it as a runtime option.
Compute and scaling
Each agent runs at one of three sizes. CPU is burstable, because an LLM agent idles while it waits for the model and then needs a burst to parse and stream the answer. Memory is reserved in full.
| Size | CPU reserved | CPU burst up to | Memory |
|---|---|---|---|
| small | 0.1 vCPU | 0.5 vCPU | 256 MiB |
| medium | 0.5 vCPU | 1 vCPU | 1 GiB |
| large | 1 vCPU | 2 vCPU | 2 GiB |
Run a fixed number of copies with --replicas, up to your plan's limit per agent. With more than one, updates roll out one copy at a time, so the agent stays up while it deploys.
mb agent update --autoscale 1-5 lets CPU load move the agent between a minimum and a maximum. Scale-down waits five minutes, so a long conversation isn't cut off. Scaling on in-flight requests, a better signal for LLM agents, is planned.
Databases
Create a database in your workspace and bind it to any agent that needs it. The agent restarts with the connection string in the environment variable you choose. Unbind it and the variable is gone.
$ mb agent db create --name orders
$ mb agent db bind --slug support-bot --db orders --env-var DATABASE_URLCustomer databases live on their own database cluster on AWS, apart from the database that runs the platform itself.
An agent sees only the databases bound to it. Where direct SQL access is enabled, it uses short-lived, per-person logins that require a reason, and every grant is recorded.
Secrets
Model API keys, tokens and passwords are set per agent and arrive as environment variables. Values are piped in on stdin, so they never show up in your shell history or process list.
$ mb agent secret set --slug support-bot --key OPENAI_API_KEY --stdinAES-256-GCM envelope encryption under an AWS KMS key, bound to the agent and the key name. The platform refuses to start without the key.
mb agent secret copy moves a value between agents on the server side. Reading a value back needs the owner or a workspace admin, a reason, and lands in the agent's audit trail.
Domains and networking
Every agent is served at https://<agent>.<workspace>.mesangebleue.io with a certificate managed for you.
mb agent alias add prints a TXT record that proves you own the domain. Point a CNAME at the agent, run alias verify, and a Let's Encrypt certificate is issued.
A private agent has no public URL. Other agents in the same workspace call it at an internal address; nothing outside the workspace can reach it.
Agent pods accept traffic only from the ingress and the platform, and traffic between nodes is encrypted with WireGuard.
Observability
Application and build logs are collected for every agent and kept in object storage on AWS. Your queries only ever see your own agents.
The Logs tab opens on a live view that follows the newest pod and re-attaches after restarts, with filter, pause and auto-scroll. From the terminal: mb agent logs -f.
Search app and build logs by text over a time range: mb agent logs --grep timeout --since 2h, or the dashboard's archive search. Lines arrive in the archive within a few minutes.
Security and supply chain
Workspaces and teams
A workspace holds your agents, databases and people. Each workspace gets its own subdomain.
| Access | Who has it | What it allows |
|---|---|---|
| Read | Every workspace member | See every agent, its status and logs |
| Ship | The agent's contributors | Push, rebuild, change settings and secrets |
| Manage | The agent's owner, workspace owners and admins | Delete, transfer, contributors, custom domains, database bindings, scan opt-out |
Invite people by link; an invite can only be accepted by the email address it was sent to. When someone leaves, their agents pass to the workspace owner instead of being orphaned.
Workspace API clients sign in headlessly with mb service-login, so a pipeline can deploy without a person's credentials.
Plans
Every workspace starts on Free. Plans set how many agents you run, which sizes and runtimes they use, and how far they scale.
| Feature | Free | Basic | Starter | Pro | Enterprise |
|---|---|---|---|---|---|
| Price per month | Free | Contact us | Contact us | Contact us | Contact us |
| Agents included | 1 | 1 | 3 | 10 | Custom |
| Most agents | 1 | 10 | 5 | 25 | No cap |
| Databases included | 0 | 1 | 2 | 5 | Custom |
| Runtimes | Python, Go | Python, Go | Python, Go, LangChain | Python, Go, LangChain | Python, Go, LangChain |
| Sizes | small | small, medium | small, medium | small to large | small to large |
| Replicas per agent | 1 | 1 | 2 | 5 | 10 |
| Custom domains | None | 1 | 3 | Unlimited | Unlimited |
| Support | Community | Priority | By agreement |
Every plan includes the security scanning, encrypted secrets, logs and team features described above. Prices are not published yet: ask us.
Install the CLI, create a workspace, and push. Most Python and Go apps run without changes as long as they listen on $PORT.