Linux workspaces your AI agents
can actually ship from.
One throwaway box for one session is not a place to ship from. Here an agent gets a platform: persistent workspaces, each with a public URL, a certificate, a database and a private address, driven through one MCP connection.
- 390+ MCP servers from the store: thousands of tools through one gateway, scoped by role
- 114+ templates in the app store
- 6 managed database and queue engines
- 165 s from click to a serving platform
Why an environment
A chat window writes code. A workspace runs it.
An assistant in a browser tab has no machine. It can hand you text, and then you are the one who installs it, configures it, deploys it and finds out what broke. Connect that same assistant here and it gets a real Linux machine instead. You write the prompt. It does the work, and you look at the result.
It builds, it does not describe
The agent takes a workspace from the store, writes the files, installs what it needs, starts the process and reads its own logs. You watch it run instead of copying a snippet.
A real database, not a diagram
It picks one of six engines, gets credentials only that workspace holds, and applies the schema it just designed. Then it queries it.
A public address, not a localhost
It routes the workspace, takes a certificate and puts the result on a domain that answers from anywhere. Send somebody the link.
Correct it and run it again
Prompt, look, correct, repeat. The machine is still there between turns, so the second prompt starts where the first one finished.
And it does not have to be the biggest model you can buy. What stops ordinary work is usually the environment rather than the size of the model, so a small one with a real machine and the tools its role allows finishes jobs a larger one can only write about.
Tools included
Every tool your agent needs.
One deploy away.
The platform runs the machine, the databases and the routing. The tools are templates in the store: deploy one and it is running, routed and yours. No Docker Compose, no setup.
n8n template
Visual workflow automation in a workspace of its own — connect APIs, trigger an agent, build multi-step pipelines without code.
Node-RED template
Flow-based programming for IoT, data pipelines and real-time events, deployed from the store.
Browser Linux GUI built-in
A terminal and an editor in a browser tab on every workspace, and a desktop when you want one. Run scripts, install packages, run your agent.
Jupyter template
Notebooks on a real machine, with a GPU variant. Install LangChain or LlamaIndex once and it stays installed.
Qdrant template
A vector database for retrieval, deployed beside the agent that queries it, on your own machine.
Six managed engines built-in
MySQL, MariaDB, PostgreSQL, MongoDB, RabbitMQ and Valkey (Redis-compatible), with credentials only that workspace holds.
Four agent stacks
Pick your agent architecture. Start building.
Workflow Agents
Automate multi-step business processes, API orchestration and data transformation pipelines.
n8nNode-REDWebhook endpointsA public URL
What the agent calls
> plan_my_build
→ the order to decide things in, before anything deploys
> deploy_lab n8n
→ uses: n8n, Node-RED
✓ running, routed, and on its own URLConversational AI
Build chat agents with retrieval, memory and tool-calling over your own documents and APIs.
JupyterQdrantPostgreSQLValkey
What the agent calls
> plan_my_build
→ the order to decide things in, before anything deploys
> deploy_lab jupyter
→ uses: Jupyter, Qdrant
✓ running, routed, and on its own URLAutonomous Agents
Long-running agents that plan, call tools and act, with the whole loop visible in a shell.
Browser Linux GUIPython shellRabbitMQPersistent disk
What the agent calls
> plan_my_build
→ the order to decide things in, before anything deploys
> deploy_lab ubuntu
→ uses: Ubuntu, RabbitMQ
✓ running, routed, and on its own URLIoT & Edge AI
Sensor-to-dashboard flows, device builds and firmware, on templates made for hardware.
Node-REDESP-IDFZephyr RTOSBuildroot
What the agent calls
> plan_my_build
→ the order to decide things in, before anything deploys
> deploy_lab node_red
→ uses: Node-RED, Zephyr
✓ running, routed, and on its own URLConnect
One command to connect
claude mcp add --transport http labs https://<your-domain>/mcpWorks with Claude Code, Claude Desktop, Codex and any client that speaks HTTP MCP. OAuth is built in; the platform is its own authorization server.
- Everything on one connectionDeploy, files, processes, routing, TLS, domains, databases, networks, devices, templates and limits — all on the one connection.
- Its own permissionsAn agent holds the role of the person who connected it and nothing more, and every call is audited to them.
- A guide on connectThe model reads what the platform is and how it behaves before its first move.
One connection, every family
Labs lifecycle14
deploy_lab · pause_lab · wait_for_deploy
Files and processes19
write_lab_files · grep_lab_files · start_lab_process
Routing, domains and TLS14
configure_lab_routing · add_domain · ssl_troubleshoot
Databases and queues7
create_database · service_credentials · add_service_user
Networks, devices and keys14
create_network · add_device · add_ssh_key
Templates and the store34
fork_template · build_template · publish_template
Organizations and admin31
create_department · org_add_member · admin_find_user
Workspace sessions5
open_workspace · list_projects · close_workspace
Identity, history, planning5
whoami · my_history · plan_my_build
How it reaches the machine
The agent needs no key and no network
The agent works over MCP, so it never holds an SSH key and never joins your network. You do, when you want the machine in your own hands.
The agent: one connection
Deploy, files, processes, routing, databases and templates all go over MCP, authorized as the person who connected it. Nothing to install, nothing to hand it.
You: SSH and WireGuard
Working by hand instead? Add your SSH key and bring up the WireGuard tunnel. The workspace has its own private address on your network.
Either way, the same rules
Same roles, same quotas, same audit trail. The machine is never open to the internet except on the routes you publish.
Five gates before a call runs
Hiding a tool is usability. Refusing it is the boundary. Every call goes through all five, and every call, allowed or refused, is logged against the account and client that made it.
- DenylistQuizzes, code arena, CTF, discussion AI and the leaderboard are refused before any role is checked.
- TierYour account tier (free, user or admin) decides which tools exist for you, and a hidden tool cannot be called.
- RoleOwner, admin or member of the organization or department the call touches.
- Module and authoringA tool for a module the platform switched off is hidden. Template authoring needs authoring rights.
- Ownership and quotaOnly the caller's own labs, devices and domains, and a quota is checked at the moment of the call, so two agents cannot both take the last slot.
n8n + Node-RED · Workflow automation from the store
AI pipelines without writing a backend.
n8n and Node-RED are templates in the store. Deploy one and it runs in its own workspace on its own URL — wire APIs, AI models, databases and webhooks together on a visual canvas, then trigger the pipeline with a link.
n8n
Visual workflow canvas for multi-step AI automations. Connect OpenAI, Slack, databases, webhooks, and custom HTTP nodes. Build complex agent pipelines that run on a schedule or trigger.
- 400+ integrations
- AI model nodes
- Webhook triggers
- Error handling
- Scheduled workflows
- Custom HTTP nodes
node-red
Flow-based programming for IoT, real-time data, and edge AI pipelines. Ideal for sensor-to-dashboard flows, MQTT event streams, and embedding inference nodes into hardware workflows.
- MQTT nodes
- Real-time streams
- Custom function nodes
- Dashboard UI builder
- IoT device flows
- Webhook endpoints
Example Pipeline — AI Customer Support Agent
- Webhook triggern8n node
- Fetch contextHTTP node
- RAG lookupQdrant
- Model calln8n AI node
- Send replySlack / Email
From prompt to URL
From a prompt to a live URL, on one platform.
Every step happens on the same platform, under one sign-in — no context switching, no separate accounts.
-
Connect your agent once
Add the platform to Claude Code, Codex or any MCP client with one command. It signs in as you and gets your role, nothing more.
-
It plans before it builds
plan_my_build gives the agent the order the decisions happen in — template, database, routing — before it deploys anything.
-
It deploys a real workspace
The agent picks a template from the store, deploys it, writes the files and starts the process, then reads its own logs.
-
It wires in data and a URL
A database from one of six engines, a route, a certificate and a domain — the result answers from anywhere.
-
You look, correct, repeat
The workspace is still there between prompts. Open it in the browser, say what to change, and the agent carries on from where it stopped.
Value vs. separate tools
What you’d put together yourself. What is here already.
| Capability | Usually means | Here |
|---|---|---|
| Workflow automation (n8n, Node-RED) | A separate hosted subscription | ✓ Included |
| A persistent Linux workspace | A cloud VM you build and patch | ✓ Included |
| Managed databases, six engines | A database service per engine | ✓ Included |
| Routing, domains and TLS | A reverse proxy and certificates to run | ✓ Included |
| A vector store | Another hosted service | ✓ Included |
| An MCP connection for agents | Glue code you write yourself | ✓ Included |
| An audit of every agent call | Usually nothing at all | ✓ Included |
No per-seat fee. You pay for the machine the agents run on, by the hour, and every tool above runs on it.
Stop configuring.
Start shipping agents.
The machine, the databases, the routing and the connection are ready. Connect an agent and give it its first job today.