{ "slug": "railway", "name": "Railway", "url": "https://railway.com", "domain": "railway.com", "category": "hosting", "category_name": "Hosting and deploys", "tested_at": "2026-10-06", "run": "20261006T032848Z", "draft": false, "reviewed": true, "owner_verified": null, "origin": "editorial", "history": [ { "run": "20261006T032848Z", "date": "2026-10-06", "level": 3, "engine": { "runner": "omp", "model": "claude-opus-5-5", "driver": 2, "signed": true, "inbox": null, "robots": "start" } } ], "level": 3, "level_name": "Does the work", "level_selfhost": null, "entry": "self-start", "door": { "passed": 1, "tries": 1, "self_start": true }, "badges": [ "agent-can-leave" ], "stages": [ { "key": "in", "label": "Access", "state": "yes", "text": "Gets in on its own: try first, claim later", "how": "no-account" }, { "key": "work", "label": "Use", "state": "part", "text": "Work done: 60% of the core" }, { "key": "pay", "label": "Pay", "state": "unreached", "text": "Payment not reached", "value": "unreached", "route": "card_checkout" }, { "key": "leave", "label": "Leave", "state": "yes", "text": "Leaves on its own: nothing to cancel, what it made goes after 24 hours", "how": "no-account", "left": "expires", "after_hours": 24 } ], "outcomes": [ { "key": "find", "label": "Find", "state": "yes", "text": "Docs agents can read: llms.txt, an OpenAPI and an MCP server", "have": [ "llms_txt", "openapi", "mcp" ] }, { "key": "access", "label": "Access", "state": "yes", "text": "Gets in on its own: try first, claim later", "how": "no-account", "stage": "in" }, { "key": "use", "label": "Use", "state": "part", "text": "Work done: 60% of the core", "stage": "work" }, { "key": "pay", "label": "Pay", "state": "unreached", "text": "Payment not reached", "value": "unreached", "route": "card_checkout", "stage": "pay" }, { "key": "leave", "label": "Leave", "state": "yes", "text": "Leaves on its own: nothing to cancel, what it made goes after 24 hours", "how": "no-account", "left": "expires", "after_hours": 24, "stage": "leave" } ], "access": [ { "key": "try_first", "label": "Try first, claim later", "routes": [ "claimable" ], "minutes": 11.6, "core": "6/10" } ], "minutes": 11.6, "next": { "to": 4, "text": "Next: do 80% of the core work (now 60%)" }, "stop": "delete", "core": "6/10", "scores": { "coverage": 45, "reliability": 92, "resilience": null, "setup": 100, "surface_coverage": null, "docs_accuracy": null, "docs_completeness": null }, "parts": { "holds_up": null, "docs_match": null, "setup": 100, "security": null, "standards": [ { "standard": "MCP client registration", "state": "current", "behind": null, "value": "cimd" }, { "standard": "OpenAPI", "state": "behind", "behind": 1, "value": "3.1.0" } ] }, "reliability_method": "first-try", "resilience": null, "stress": [], "surface_audit": null, "coverage_core": 60, "after_wall": null, "coverage_source": "computed", "driver": { "version": 2, "model": "claude-opus-5-5", "profile": "full", "assisted": false, "handoff": null, "prompt_sha": "f3d0adeeb256", "kb_version": "2+overlay-9e43028a2c", "identity": null }, "methodology": 15, "rules_date": "2026-10-15", "engine": { "runner": "omp", "model": "claude-opus-5-5", "driver": 2, "signed": true, "inbox": null, "robots": "start" }, "same_level_drives": 1, "drives": 1, "works_assisted": null, "freshness": "fresh", "nothing_to_pay": false, "core_gated": false, "profiles": {}, "agent_check": null, "agent_pass": null, "who_gets_in": { "server": { "state": "in" }, "signed": { "state": "page", "kind": "signup", "at": "2026-10-12" }, "browser": { "state": "in", "measured": false }, "our_key": "pending", "robots": null, "tip": false }, "ladder": { "docs": { "status": "headless", "note": "docs.railway.com/llms.txt + llms-full.txt, every page as .md, Accept: text/markdown negotiated; railway.com/auth.md, /.well-known/api-catalog, openapi.json 3.1.0" }, "signup": { "status": "n/a", "note": "Not needed: a documented route works without an account.", "no_account": true, "note_driver": "No-account route succeeded: `ssh railway.new` (documented) issued a project-scoped token, and the first API/CLI call with it succeeded, so sign-up is not needed to get started. Full interactive account sign-up (required for code/image/repo deploys, MCP, environments, usage, pay and delete) is separately blocked by a visible Cloudflare Turnstile on email sign-up, for a handoff; that gap is reflected in credentials and cannot_do.", "status_driver": "n/a" }, "verify": { "status": "n/a", "note": "Not needed: a documented route works without an account.", "no_account": true, "note_driver": "No account was created (the no-account route was used instead), so email/identity verification was never applicable.", "status_driver": "n/a" }, "credentials": { "status": "headless", "via": "", "note": "A working credential was obtained headless and documented: `ssh railway.new`'s anonymous box carries a project token (RAILWAY_TOKEN), usable via the GraphQL Project-Access-Token header and the CLI; it drove the first call, the first action and 7 other capabilities. A full-account token is not reachable headless: `railway login --browserless` (RFC 8628 device flow) prints a code but approval needs a signed-in browser behind Turnstile, and a DCR-registered client's device-flow request was refused ('not allowed for this client')." }, "first_call": { "status": "headless", "note": "GraphQL projectToken/project queries with the anonymous box's project token (Project-Access-Token header), 200" }, "first_action": { "status": "headless", "note": "`railway add -d postgres` with the anonymous project token created a Postgres service, deployment SUCCESS (CLI wrongly printed 'Project not found')" }, "pay": { "status": "", "grade": "P1", "rails": [ "card via web Billing page (Stripe)" ], "rail_ids": [ "card" ], "first_party": false, "rail_scope": "none", "trial_path": "no-card trial", "note": "No 402 anywhere (API base 400, x402./mpp. subdomains do not answer), not in mpp.dev or x402 Bazaar (only a third-party app hosted on up.railway.app), no x-payment-info, no /.well-known/ucp. Docs: 'Railway only accepts credit cards for plan subscriptions'; upgrade on the web Billing page; GraphQL has only customerCreateFreePlanSubscription. Trial and free plan need no card. Checkout itself not seen (behind sign-in); because an agent cannot reach checkout without a human passing Turnstile.", "reached": false }, "cancel": { "status": "n/a", "note": "Nothing to cancel: our agent started no paid plan.", "docs_note": "no plan started; docs: Billing page > Active Plan > Cancel Plan (web)", "docs_grade": "", "nothing": "no_plan" }, "delete": { "status": "blocked", "note": "No account to delete (account delete is web: Account Settings > Delete Account). Anonymous project: projectDelete/serviceDelete with its project token 'Not Authorized'; deploymentRemove worked, tcpProxyDelete hung; Railway deletes unclaimed boxes after the 24 h claim window (docs).", "left": "expires", "after_hours": 24, "account": false } }, "routes": [], "checkout": null, "docs": null, "claims": null, "pay_options": { "checked": "2026-10-06", "source": "drive", "options": [ { "id": "card", "name": "Card checkout", "kind": "checkout", "first_party": false, "lead": false, "networks": [], "testnet": false } ], "agentic": [], "paid": null, "exercised": null, "detected_grade": null, "trial": { "no_card": true, "card_required": null, "free_plan": null }, "owner_fixes": [ { "title": "Accept x402 or MPP on your API", "how": "Answer an unpaid call with 402 and a payment challenge, so an agent pays per call or buys credits without an account or a card." }, { "title": "List your plans on Stripe Projects", "how": "Agents buy a plan with `stripe projects add`, paid with a token under a spend cap the owner sets (projects.dev)." } ] }, "surfaces": { "api": true, "openapi": true, "cli": true, "sdk": false, "mcp": "official", "llms_txt": true, "webhooks": true, "sandbox": true }, "surface_notes": { "api": "GraphQL, documented examples", "openapi": "3.1.0, describes the GraphQL entrypoint and OAuth endpoints only", "mcp": "official remote, OAuth", "cli": "@railway/cli 5.63.3 on npm" }, "can_do": [ "Get a free Linux VM with a public preview URL without an account (ssh railway.new) and serve an app on it", "Add a Postgres or Redis database to the anonymous box's project with the CLI and see it deploy", "Set and read service variables through the GraphQL API", "Open a public TCP proxy to a database and query it with psql", "Read deployment logs and CPU/memory metrics through the API", "Redeploy and remove deployments through the API", "Create, exec into and destroy a sandbox VM with the CLI", "Attach a volume to a service" ], "cannot_do": [ { "what": "Create an account", "why": "visible Cloudflare Turnstile on email sign-up; GitHub/Google need third-party accounts" }, { "what": "Deploy own code or an image", "why": "'You must be logged in to deploy' with the anonymous project token; account needed" }, { "what": "Use the MCP server", "why": "OAuth needs a signed-in account" }, { "what": "Create environments, delete services or projects, see usage, use the Railway Agent", "why": "'Not Authorized' / 'Unauthorized' with the project token" }, { "what": "Pay", "why": "card-only, web Billing page" } ], "blockers": [ "Cloudflare Turnstile on email sign-up", "Anonymous project token cannot deploy code" ], "tips_for_owner": [ "Let verified signed agents sign up", "Let the anonymous box token deploy code", "Fix railway add false 'Project not found' error", "Allow device flow for registered OAuth clients", "Offer a headless way to delete" ], "tips_for_agents": [ "Without an account: `ssh railway.new` gives a VM with a preview URL; the RAILWAY_TOKEN inside is a project token you can use with the CLI (RAILWAY_TOKEN=…) or GraphQL (Project-Access-Token header)", "GraphQL errors come back as HTTP 200 with an errors array: always check errors", "`railway add` may print 'Project not found' after it did create the service: read the state back", "`railway connect` needs an SSH key and an account; use `railway run` + a TCP proxy + psql instead", "Read railway.com/auth.md and /.well-known/api-catalog first: they map every auth route" ], "selfhost": null, "summary": "Railway is unusually agent-ready on paper (llms.txt, markdown docs, auth.md, API catalog, PRM, CIMD, device flow, official MCP), and an agent can get a free VM and a project token with no account via `ssh railway.new`, then add databases, set variables, open TCP proxies, read logs and metrics, and run sandboxes. But account sign-up sits behind a visible Cloudflare Turnstile, and the anonymous token cannot deploy code, so deploying an app, MCP and paying all need a human.", "wall": "Cloudflare Turnstile on the email sign-up", "plan_scope": "none (no account; anonymous ssh railway.new box and its project token)", "robots_stop": null, "robots": null, "plain": { "summary": "Railway is a cloud hosting platform where you deploy apps, databases and background jobs. Without creating any account, our agent got a free temporary server, added a database, read its logs, and controlled it through code -- but it could not deploy its own application, use Railway's AI assistant, or pay, because those require a real account and the sign-up form has a 'prove you're human' check with no way for the agent to pass it.", "can_do": [ "Get a free temporary server with a public web address, no account needed", "Add a database or other ready-made service to that server and see it running", "Change settings and read them back", "Open a direct connection to the database and query it", "Read activity logs and resource usage (CPU, memory)", "Restart or remove things it created", "Spin up and tear down a short-lived virtual machine" ], "cannot_do": [ { "what": "Create a full account", "why": "a visible human-verification puzzle blocks the sign-up form" }, { "what": "Deploy its own application code or container image", "why": "the system says you must be logged in to deploy, and login needs the account" }, { "what": "Use the AI assistant feature or create separate project environments", "why": "both require a logged-in account" }, { "what": "Pay for a paid plan", "why": "payment is card-only on a web page behind login, not something the agent could reach" }, { "what": "Fully delete what it created", "why": "the temporary project it used can't be deleted on command; it only disappears automatically after a day" } ] }, "plan_gated": [], "reply": null, "capabilities": [ { "id": "cap-01", "group": "Deploy", "capability": "Deploy a service from a Git repo", "weight": "core", "plan": "free", "surfaces": { "api": "mutation serviceCreate / serviceConnect (GraphQL)", "mcp": "railway-agent / deploy tools", "cli": "railway up", "ui": "New Project > Deploy from GitHub repo" }, "check": "GET deployment status shows SUCCESS and service has a running deployment id", "source": "https://docs.railway.com/platform, https://docs.railway.com/cli/deploying" }, { "id": "cap-02", "group": "Deploy", "capability": "Deploy a Docker image from a registry", "weight": "core", "plan": "free", "surfaces": { "api": "mutation serviceCreate (source: image)", "mcp": "railway-agent", "cli": "railway service / railway up", "ui": "New Service > Docker Image" }, "check": "service source shows the image reference and deployment is SUCCESS", "source": "https://docs.railway.com/platform" }, { "id": "cap-03", "group": "Deploy", "capability": "Deploy from the local directory in one command", "weight": "core", "plan": "free", "surfaces": { "api": null, "mcp": null, "cli": "railway up", "ui": null }, "check": "CLI prints dashboard link and running URL; GET deployment shows SUCCESS", "source": "https://railway.com/ (Railway for AI Agents), https://docs.railway.com/cli" }, { "id": "cap-04", "group": "Deploy", "capability": "Deploy a managed database (Postgres, MySQL, Redis, MongoDB, ClickHouse)", "weight": "core", "plan": "free", "surfaces": { "api": "mutation templateDeploy", "mcp": "railway-agent (templates)", "cli": "railway add --database postgres", "ui": "New > Database" }, "check": "GET service shows database plugin type and a running deployment", "source": "https://railway.com/ (Core operations table), https://docs.railway.com/cli" }, { "id": "cap-05", "group": "Deploy", "capability": "Deploy a one-click template stack", "weight": "core", "plan": "free", "surfaces": { "api": "mutation templateDeploy", "mcp": "templates tool", "cli": "railway deploy --template postgres", "ui": "railway.com/templates" }, "check": "project contains the services listed by the template, each deployed", "source": "https://railway.com/templates, https://docs.railway.com/cli" }, { "id": "cap-06", "group": "Deploy", "capability": "Redeploy / rollback to a prior deployment", "weight": "core", "plan": "free", "surfaces": { "api": "mutation deploymentRedeploy / deploymentRollback", "mcp": "accept-deploy / rollback tools", "cli": "railway redeploy", "ui": "Deployment history > Redeploy/Rollback" }, "check": "GET deployment list shows new deployment pointing at prior build SHA, status SUCCESS", "source": "https://railway.com/ (One-click rollback), https://docs.railway.com/cli" }, { "id": "cap-07", "group": "Deploy", "capability": "Scale a service (replicas, CPU/RAM limits, regions)", "weight": "core", "plan": "free", "surfaces": { "api": "mutation serviceInstanceUpdate", "mcp": "railway-agent", "cli": "railway scale", "ui": "Service Settings > Resources" }, "check": "GET service shows updated replica count / resource limits matching request", "source": "https://railway.com/ (Scaling row, Core operations), https://docs.railway.com/cli" }, { "id": "cap-08", "group": "Deploy", "capability": "Stop/remove a deployment", "weight": "core", "plan": "free", "surfaces": { "api": "mutation deploymentRemove", "mcp": "railway-agent", "cli": "railway down", "ui": "Deployment > Remove" }, "check": "GET deployment list no longer shows the deployment as active", "source": "https://docs.railway.com/cli" }, { "id": "cap-09", "group": "Networking", "capability": "Generate a public domain / attach a custom domain with TLS", "weight": "secondary", "plan": "free", "surfaces": { "api": "mutation domainCreate / customDomainCreate", "mcp": "create-domain tool", "cli": "railway domain / railway domain example.com", "ui": "Service Settings > Networking > Public Networking" }, "check": "GET domain status shows ACTIVE with issued SSL certificate", "source": "https://docs.railway.com/networking/public-networking" }, { "id": "cap-10", "group": "Networking", "capability": "Expose a TCP service via public proxy", "weight": "secondary", "plan": "free", "surfaces": { "api": "mutation tcpProxyCreate", "mcp": null, "cli": "railway tcp-proxy create --port 5432", "ui": "Service Settings > Networking > TCP Proxy" }, "check": "GET tcp proxy list shows assigned external host:port reachable", "source": "https://docs.railway.com/cli" }, { "id": "cap-11", "group": "Networking", "capability": "Enable CDN caching for a service", "weight": "secondary", "plan": "paid", "surfaces": { "api": null, "mcp": null, "cli": "railway cdn enable", "ui": "Service Settings > Networking > CDN" }, "check": "railway cdn status shows enabled: true", "source": "https://docs.railway.com/cli" }, { "id": "cap-12", "group": "Networking", "capability": "Enable WAF / Under Attack Mode", "weight": "secondary", "plan": "paid", "surfaces": { "api": null, "mcp": null, "cli": "railway waf under-attack enable", "ui": "Service Settings > Networking > WAF" }, "check": "railway waf under-attack status shows enabled", "source": "https://docs.railway.com/cli" }, { "id": "cap-13", "group": "Networking", "capability": "Enable static outbound IP / outbound IPv6", "weight": "secondary", "plan": "paid", "surfaces": { "api": null, "mcp": null, "cli": "railway outbound-network static-ip enable", "ui": "Service Settings > Networking > Outbound" }, "check": "railway outbound-network status shows assigned static IP", "source": "https://docs.railway.com/cli" }, { "id": "cap-14", "group": "Configuration", "capability": "Set and manage environment variables and secrets", "weight": "core", "plan": "free", "surfaces": { "api": "mutation variableUpsert / variableDelete", "mcp": "set-variables tool", "cli": "railway variable set KEY=value", "ui": "Service > Variables tab" }, "check": "GET variable list / railway variable list shows the key with the new value", "source": "https://docs.railway.com/integrations/api/manage-variables, https://docs.railway.com/cli" }, { "id": "cap-15", "group": "Configuration", "capability": "Create and configure environments (incl. PR preview environments)", "weight": "secondary", "plan": "free", "surfaces": { "api": "mutation environmentCreate", "mcp": "manage-environments tool", "cli": "railway environment new staging", "ui": "Project > Environments" }, "check": "GET project shows new environment with isEphemeral flag for PR previews", "source": "https://docs.railway.com/integrations/api/manage-environments, https://railway.com/ (PR preview environments)" }, { "id": "cap-16", "group": "Configuration", "capability": "Pin build/deploy config as code (railway.toml / railway.json)", "weight": "secondary", "plan": "free", "surfaces": { "api": null, "mcp": null, "cli": "railway config init / pull / plan / apply", "ui": "Service Settings (mirrors config file)" }, "check": "railway config pull reflects committed railway.toml values on the service", "source": "https://docs.railway.com/cli, https://railway.com/ (Config as code row)" }, { "id": "cap-17", "group": "Storage", "capability": "Attach a persistent volume to a service", "weight": "secondary", "plan": "free", "surfaces": { "api": "mutation volumeCreate", "mcp": "manage-volumes tool", "cli": "railway volume add", "ui": "Service > Volumes" }, "check": "GET service shows attached volume with mount path and size", "source": "https://docs.railway.com/integrations/api/manage-volumes, https://docs.railway.com/cli" }, { "id": "cap-18", "group": "Storage", "capability": "Browse and download files from a volume or service", "weight": "secondary", "plan": "free", "surfaces": { "api": null, "mcp": null, "cli": "railway volume browse / railway service files download", "ui": "Service > Volumes (file browser)" }, "check": "downloaded file matches checksum of file on the volume", "source": "https://docs.railway.com/cli" }, { "id": "cap-19", "group": "Storage", "capability": "Create an S3-compatible object storage bucket", "weight": "secondary", "plan": "free", "surfaces": { "api": null, "mcp": null, "cli": "railway bucket create", "ui": "New Service > Bucket" }, "check": "railway bucket info shows bucket with endpoint and credentials", "source": "https://docs.railway.com/cli, https://railway.com/pricing (Object Storage rate)" }, { "id": "cap-20", "group": "Compute", "capability": "Create and run an ephemeral sandbox VM", "weight": "secondary", "plan": "free", "surfaces": { "api": "mutation sandboxCreate", "mcp": "sandbox tools", "cli": "railway sandbox create", "ui": "Dashboard > Sandboxes" }, "check": "railway sandbox list shows RUNNING sandbox with assigned resources", "source": "https://railway.com/pricing (Sandboxes and VMs), https://docs.railway.com/sandboxes" }, { "id": "cap-21", "group": "Compute", "capability": "Exec/SSH into a running service or sandbox", "weight": "secondary", "plan": "free", "surfaces": { "api": null, "mcp": null, "cli": "railway ssh / railway sandbox ssh / railway sandbox exec", "ui": "Service context menu > Copy SSH Command" }, "check": "interactive shell session opens against the target container", "source": "https://docs.railway.com/cli" }, { "id": "cap-22", "group": "Compute", "capability": "Create and push a Railway Function (edge TypeScript)", "weight": "secondary", "plan": "free", "surfaces": { "api": null, "mcp": null, "cli": "railway functions new / railway functions push", "ui": "New Service > Function" }, "check": "railway functions list shows function deployed and reachable at its URL", "source": "https://docs.railway.com/cli, https://docs.railway.com/reference/functions" }, { "id": "cap-23", "group": "Observability", "capability": "Stream and view deployment/build/HTTP logs", "weight": "core", "plan": "free", "surfaces": { "api": "query deploymentLogs / httpLogs", "mcp": "get-logs tool", "cli": "railway logs / railway logs --build", "ui": "Deployment > Logs" }, "check": "returned log lines correspond to recent deploy/build/HTTP activity", "source": "https://railway.com/ (Logs row), https://docs.railway.com/cli" }, { "id": "cap-24", "group": "Observability", "capability": "View resource and HTTP metrics for a service", "weight": "secondary", "plan": "free", "surfaces": { "api": "query metrics", "mcp": "get-metrics tool", "cli": "railway metrics", "ui": "Service > Metrics tab" }, "check": "metrics response shows CPU/memory/network datapoints for the service window", "source": "https://docs.railway.com/cli, https://railway.com/ (Metrics row)" }, { "id": "cap-25", "group": "Observability", "capability": "Enable distributed tracing and inspect traces", "weight": "secondary", "plan": "paid", "surfaces": { "api": null, "mcp": null, "cli": "railway trace enable / railway trace get ", "ui": "Service > Observability > Tracing" }, "check": "railway trace status shows enabled: true and railway trace get returns a span tree", "source": "https://docs.railway.com/cli, https://docs.railway.com/observability/tracing" }, { "id": "cap-26", "group": "Observability", "capability": "Configure webhook notifications for deploy/alert events", "weight": "secondary", "plan": "free", "surfaces": { "api": "mutation notificationRuleCreate/Update", "mcp": "create-webhook / update-webhook / test-webhook", "cli": null, "ui": "Project Settings > Webhooks" }, "check": "Test Webhook returns 2xx and the configured URL receives the event payload on the next deploy", "source": "https://docs.railway.com/observability/webhooks" }, { "id": "cap-27", "group": "Observability", "capability": "Set volume/CPU/RAM usage alerts (Slack/Discord/email)", "weight": "secondary", "plan": "free", "surfaces": { "api": null, "mcp": null, "cli": null, "ui": "Project Settings > Webhooks (Discord/Slack muxers), Notifications" }, "check": "alert webhook fires when threshold crossed, observed as delivered event", "source": "https://railway.com/ (Alerts row), https://docs.railway.com/observability/webhooks" }, { "id": "cap-28", "group": "Database ops", "capability": "Connect to a managed database shell", "weight": "secondary", "plan": "free", "surfaces": { "api": null, "mcp": "connect tool", "cli": "railway connect", "ui": "Database service > Data tab" }, "check": "interactive DB shell session opens against the managed database", "source": "https://docs.railway.com/cli" }, { "id": "cap-29", "group": "Database ops", "capability": "View Postgres backup/PITR and HA cluster health", "weight": "secondary", "plan": "paid", "surfaces": { "api": null, "mcp": null, "cli": "railway postgres pitr status / railway postgres ha status", "ui": "Postgres service > Backups" }, "check": "command output shows archiver/backup health status and HA node state", "source": "https://docs.railway.com/cli, https://docs.railway.com/databases/postgresql" }, { "id": "cap-30", "group": "Account/Org", "capability": "Invite and manage team members on a project/workspace", "weight": "peripheral", "plan": "hobby", "surfaces": { "api": "mutation workspaceMemberInvite", "mcp": null, "cli": null, "ui": "Workspace Settings > Members" }, "check": "GET workspace members list includes the invited email with assigned role", "source": "https://railway.com/pricing (Members per project limits)" }, { "id": "cap-31", "group": "Account/Org", "capability": "Generate API tokens (account, workspace, project) for CI/automation", "weight": "peripheral", "plan": "free", "surfaces": { "api": null, "mcp": null, "cli": null, "ui": "Account/Workspace/Project Settings > Tokens" }, "check": "newly created token successfully authenticates a GraphQL request", "source": "https://docs.railway.com/integrations/api" }, { "id": "cap-32", "group": "Account/Org", "capability": "Query usage and cost, rank projects by spend", "weight": "peripheral", "plan": "free", "surfaces": { "api": "query usage", "mcp": null, "cli": "railway usage / railway usage projects", "ui": "Account > Usage" }, "check": "railway usage output matches billing dashboard totals for the period", "source": "https://docs.railway.com/cli, https://docs.railway.com/pricing/cost-control" }, { "id": "cap-33", "group": "Account/Org", "capability": "Set compute/agent usage limits (cost control)", "weight": "peripheral", "plan": "hobby", "surfaces": { "api": null, "mcp": null, "cli": "railway usage limit status", "ui": "Workspace Settings > Usage Limits" }, "check": "railway usage limit status reflects the configured limit value", "source": "https://docs.railway.com/cli, https://docs.railway.com/pricing/cost-control" }, { "id": "cap-34", "group": "Account/Org", "capability": "Authenticate third-party apps via OAuth (Login with Railway)", "weight": "peripheral", "plan": "free", "surfaces": { "api": "OAuth authorize/token endpoints", "mcp": null, "cli": null, "ui": null }, "check": "OAuth flow returns an access token scoped to the approved permissions", "source": "https://docs.railway.com/integrations/oauth" }, { "id": "cap-35", "group": "AI/Agent tooling", "capability": "Chat with the Railway Agent to diagnose/fix deployments", "weight": "secondary", "plan": "free", "surfaces": { "api": null, "mcp": "railway-agent tool", "cli": "railway agent / railway agent -p \"...\"", "ui": null }, "check": "agent thread (railway agent --list) shows the session with its diagnosis response", "source": "https://docs.railway.com/cli, https://railway.com/ (Railway for AI Agents)" }, { "id": "cap-36", "group": "Compute", "capability": "Run local commands with Railway env vars injected (local dev loop)", "weight": "secondary", "plan": "free", "surfaces": { "api": null, "mcp": null, "cli": "railway run / railway shell / railway dev", "ui": null }, "check": "command run via `railway run env` prints the service's configured variables", "source": "https://docs.railway.com/cli" } ], "attempts": [ { "t": "01:01", "cap": "discovery", "route": "api", "documented": true, "verified": true, "capability": "docs", "task": "Fetch llms.txt and markdown docs", "result": "done", "evidence": "https://docs.railway.com/llms.txt 200 text/plain 76695 bytes; llms-full.txt 2.6MB; pages as .md; Accept: text/markdown on docs.railway.com/quick-start -> content-type text/markdown, vary: Accept", "notes": "railway.com/llms.txt also present" }, { "t": "01:01", "cap": "discovery", "route": "api", "documented": true, "verified": true, "capability": "mcp discover", "task": "POST server/discover 2026-07-28 to https://mcp.railway.com", "result": "partial", "evidence": "401 {\"error\":\"Authentication required\"} WWW-Authenticate: Bearer realm=\"mcp\", resource_metadata=\"https://mcp.railway.com/.well-known/oauth-protected-resource\", scope=\"workspace:member\"", "notes": "auth required before discover; retry with credentials later" }, { "t": "01:01", "cap": "discovery", "route": "api", "documented": true, "verified": true, "capability": "prm/as metadata", "task": "Read PRM and AS metadata", "result": "done", "evidence": "PRM 200 authorization_servers [https://backboard.railway.com]; AS metadata: registration_endpoint (DCR), client_id_metadata_document_supported: true (CIMD), device_authorization_endpoint, grant device_code, S256 only, authorization_response_iss_parameter_supported true" }, { "t": "01:01", "cap": "discovery", "route": "api", "documented": true, "verified": true, "capability": "cards", "task": "Server card, AI catalog, A2A card", "result": "done", "evidence": "https://mcp.railway.com/server-card 404; https://railway.com/.well-known/ai-catalog.json 200 application/json specVersion 0.91 -> https://railway.com/.well-known/mcp/server-card.json 200 application/json; /.well-known/agent-card.json 404 html; /.well-known/agent.json 404" }, { "t": "01:01", "cap": "discovery", "route": "api", "documented": true, "verified": true, "capability": "aipref", "task": "robots.txt content preferences", "result": "done", "evidence": "robots.txt: 'Content-Signal: search=yes, ai-input=yes, ai-train=yes' (Cloudflare Content Signals scheme, parses) under User-agent: *; Disallow /new /project /dashboard /account /auth /oauth etc; no Content-Usage line, no Content-Usage header on railway.com/" }, { "t": "01:01", "cap": "discovery", "route": "api", "documented": true, "verified": true, "capability": "auth.md / api-catalog", "task": "auth.md and RFC 9727 api-catalog", "result": "done", "evidence": "https://railway.com/auth.md 200 text/markdown (a how-to doc, not WorkOS agent_auth; AS metadata has no agent_auth block); /.well-known/api-catalog linkset JSON; openapi.json 3.1.0 with /graphql/v2 + OAuth paths; no x-payment-info; /.well-known/ucp 404; /SKILL.md 404" }, { "t": "06:28", "cap": "credentials", "capability": "CLI device login", "task": "railway login --browserless (CLI 5.63.3 from npm)", "route": "cli", "documented": true, "result": "partial", "verified": false, "evidence": "Printed https://railway.com/activate?user_code=RVRJ-VCRT; RFC 8628 device flow; needs a signed-in browser to approve", "notes": "headless up to approval; approval page requires an account" }, { "t": "06:28", "cap": "signup", "capability": "sign up via railway up -y", "task": "auth.md says `railway up -y` signs the user up and deploys in one step; run it unauthenticated in a non-TTY shell", "route": "cli", "documented": true, "result": "failed", "verified": false, "evidence": "Output: 'Not signed in. → Run `railway login` to authenticate, then re-run.'", "quality": { "error_legibility": "clear", "docs_match": "drift", "recoverable": "yes" } }, { "t": "06:28", "cap": "signup", "capability": "anonymous VM (ssh railway.new)", "task": "Get a free VM without an account, run a web server, reach preview URL", "route": "cli", "documented": true, "result": "done", "verified": true, "evidence": "ssh railway.new with a fresh ed25519 key: 'Creating your box... Ready in 2s', 60 min, claim link https://railway.com/ssh-signup?code=••••, preview https://preview-c85558acd04127b2.up.railway.app returned 200 'hello agentdrives' from python http.server on $PORT=8080", "notes": "Claimable resource pattern: sign-up deferred to human claim within 24h. Not an account: no API token from this." }, { "t": "06:28", "cap": "cap-20", "capability": "Create and run an ephemeral sandbox VM", "task": "Anonymous VM via ssh railway.new, serve a page", "route": "cli", "documented": true, "result": "partial", "verified": true, "evidence": "VM fvm-7b39e4b2… Linux 6.18.46-railway, node+python preinstalled, preview URL 200", "notes": "anonymous box, not the account sandbox command; account route tried later" }, { "t": "06:28", "cap": "signup", "capability": "web sign-up by email", "task": "railway.com/login > Log in using email", "route": "browser", "documented": true, "result": "blocked", "verified": false, "evidence": "Clicking 'Log in using email' loads Cloudflare Turnstile (sitekey 0x4AAAAAAC1ksDZJd9ksGuf7); form shows email field + visible 'Verify you are human' checkbox; Continue with Email disabled until it passes. Other options: Continue with GitHub, Continue with Google, SSO.", "notes": "visible Cloudflare Turnstile; not attempted by agent -> human handoff (own browser)" }, { "t": "11:33", "cap": "credentials", "capability": "project token from anonymous box", "task": "Use the RAILWAY_TOKEN env in the anonymous VM as a project token", "route": "api", "documented": true, "result": "partial", "verified": true, "evidence": "GraphQL query projectToken{projectId environmentId} -> project b485d82d…; me -> 'Not Authorized'", "notes": "project-scoped token only; no account token; cannot deploy code" }, { "t": "11:33", "cap": "first_call", "capability": "first API call", "task": "GraphQL projectToken / project services query with Project-Access-Token", "route": "api", "documented": true, "result": "done", "verified": true, "evidence": "200 data.projectToken.projectId=[id]", "notes": "on the anonymous ssh railway.new box's own project (stellar-magic) using the project token Railway put in the box (RAILWAY_TOKEN, documented Project-Access-Token header / CLI env)" }, { "t": "11:33", "cap": "cap-04", "capability": "Deploy a managed database", "task": "railway add -d postgres (project token), verify deployment", "route": "cli", "documented": true, "result": "done", "verified": true, "evidence": "CLI printed 'Project not found. Run `railway link`' but service Postgres was created; GraphQL serviceInstance latestDeployment 38dc314b… status SUCCESS image ghcr.io/railwayapp-templates/postgres-ssl:18; deploymentLogs show 'listening on … port 5432'", "notes": "on the anonymous ssh railway.new box's own project (stellar-magic) using the project token Railway put in the box (RAILWAY_TOKEN, documented Project-Access-Token header / CLI env); CLI error message wrong (action succeeded)", "quality": { "verify_route": "yes", "error_legibility": "silent", "docs_match": "drift", "recoverable": "yes" } }, { "t": "11:33", "cap": "first_action", "capability": "first real action", "task": "Create a Postgres database service", "route": "cli", "documented": true, "result": "done", "verified": true, "evidence": "Postgres deployment 38dc314b… SUCCESS", "notes": "on the anonymous ssh railway.new box's own project (stellar-magic) using the project token Railway put in the box (RAILWAY_TOKEN, documented Project-Access-Token header / CLI env)" }, { "t": "11:33", "cap": "cap-02", "capability": "Deploy a Docker image", "task": "railway add -i nginxdemos/hello -s web, then serviceInstanceDeployV2", "route": "api", "documented": true, "result": "blocked", "verified": false, "evidence": "service 'web' created with source.image nginxdemos/hello but latestDeployment null; serviceInstanceDeployV2 -> errors[0].message 'You must be logged in to deploy' (extensions.code BAD_USER_INPUT, HTTP 200)", "notes": "anonymous project token cannot deploy app code/images; needs an account (sign-up behind Turnstile)", "quality": { "verify_route": "yes", "error_legibility": "clear", "recoverable": "no" } }, { "t": "11:33", "cap": "cap-03", "capability": "Deploy from local directory", "task": "RAILWAY_TOKEN=… railway up --service web --detach", "route": "cli", "documented": true, "result": "blocked", "verified": false, "evidence": "'Indexing... Uploading... You must be logged in to deploy'", "notes": "needs an account; sign-up blocked by Turnstile", "quality": { "error_legibility": "clear", "recoverable": "no" } }, { "t": "11:33", "cap": "cap-14", "capability": "Set env variables", "task": "variableUpsert GREETING on web, read back with variables query", "route": "api", "documented": true, "result": "done", "verified": true, "evidence": "variableUpsert true; variables(...) returns GREETING=agentdrives-1", "notes": "on the anonymous ssh railway.new box's own project (stellar-magic) using the project token Railway put in the box (RAILWAY_TOKEN, documented Project-Access-Token header / CLI env)", "quality": { "verify_route": "yes", "docs_match": "match" } }, { "t": "11:33", "cap": "cap-10", "capability": "TCP proxy", "task": "tcpProxyCreate on Postgres port 5432, connect", "route": "api", "documented": true, "result": "done", "verified": true, "evidence": "tcpProxyCreate -> autorack.proxy.rlwy.net:45056; tcpProxies query lists it; TCP connect open; psql through it ran CREATE TABLE/INSERT/select sum=42", "notes": "on the anonymous ssh railway.new box's own project (stellar-magic) using the project token Railway put in the box (RAILWAY_TOKEN, documented Project-Access-Token header / CLI env)" }, { "t": "11:33", "cap": "cap-15", "capability": "Create environment", "task": "environmentCreate name staging", "route": "api", "documented": true, "result": "failed", "verified": false, "evidence": "errors[0].message 'Not Authorized' extensions.code INTERNAL_SERVER_ERROR", "notes": "project token cannot create environments (docs say project tokens are scoped to one environment); account token needed", "quality": { "error_legibility": "vague", "recoverable": "no" } }, { "t": "11:33", "cap": "cap-07", "capability": "Scale a service", "task": "serviceInstanceUpdate numReplicas 2 on web, read back", "route": "api", "documented": true, "result": "partial", "verified": true, "evidence": "serviceInstanceUpdate true; serviceInstance.numReplicas=2", "notes": "setting stored and read back, but service had no running deployment to scale" }, { "t": "11:33", "cap": "cap-06", "capability": "Redeploy", "task": "deploymentRedeploy on Postgres deployment", "route": "api", "documented": true, "result": "done", "verified": true, "evidence": "new deployment ba393505… INITIALIZING -> SUCCESS; old 38dc314b… REMOVED", "notes": "on the anonymous ssh railway.new box's own project (stellar-magic) using the project token Railway put in the box (RAILWAY_TOKEN, documented Project-Access-Token header / CLI env)" }, { "t": "11:33", "cap": "cap-24", "capability": "Metrics", "task": "metrics CPU_USAGE, MEMORY_USAGE_GB for Postgres", "route": "api", "documented": true, "result": "done", "verified": true, "evidence": "per-minute datapoints, MEMORY_USAGE_GB 0.088 at ts 1791257880", "notes": "on the anonymous ssh railway.new box's own project (stellar-magic) using the project token Railway put in the box (RAILWAY_TOKEN, documented Project-Access-Token header / CLI env)" }, { "t": "11:33", "cap": "cap-23", "capability": "Logs", "task": "deploymentLogs for Postgres deployment", "route": "api", "documented": true, "result": "done", "verified": true, "evidence": "log lines 'listening on IPv4 address 0.0.0.0, port 5432' matching the deploy", "notes": "all postgres stdout lines tagged severity 'error' (stderr); httpLogs not tested (no HTTP service could deploy)" }, { "t": "11:33", "cap": "cap-05", "capability": "Deploy a template", "task": "RAILWAY_TOKEN=… railway deploy -t redis", "route": "cli", "documented": true, "result": "done", "verified": true, "evidence": "service Redis 6ae40ab6… created with redis-volume /data; deployment 955d4d0a… SUCCESS", "notes": "on the anonymous ssh railway.new box's own project (stellar-magic) using the project token Railway put in the box (RAILWAY_TOKEN, documented Project-Access-Token header / CLI env)" }, { "t": "11:33", "cap": "cap-08", "capability": "Remove deployment", "task": "deploymentRemove on Redis deployment", "route": "api", "documented": true, "result": "done", "verified": true, "evidence": "deploymentRemove true; deployment(id) status REMOVED", "notes": "on the anonymous ssh railway.new box's own project (stellar-magic) using the project token Railway put in the box (RAILWAY_TOKEN, documented Project-Access-Token header / CLI env)" }, { "t": "11:33", "cap": "cap-09", "capability": "Public domain", "task": "serviceDomainCreate on web (port 80)", "route": "api", "documented": true, "result": "partial", "verified": false, "evidence": "domain web-production-eb2738.up.railway.app created; GET -> 404 because web could not be deployed (login required)", "notes": "custom domain not tried" }, { "t": "11:33", "cap": "cap-17", "capability": "Attach volume", "task": "volumeCreate on web at /data", "route": "api", "documented": true, "result": "done", "verified": true, "evidence": "volumeCreate web-volume; project.volumes lists web-volume mountPath /data serviceId web sizeMB 500" }, { "t": "11:33", "cap": "cap-36", "capability": "railway run", "task": "RAILWAY_TOKEN=… railway run --service Postgres -- env", "route": "cli", "documented": true, "result": "done", "verified": true, "evidence": "printed PGDATABASE=railway, PGUSER=postgres, RAILWAY_SERVICE_NAME=Postgres; psql via run against TCP proxy returned 42" }, { "t": "11:33", "cap": "cap-28", "capability": "DB shell", "task": "railway connect Postgres", "route": "cli", "documented": true, "result": "failed", "verified": false, "evidence": "'No SSH keys found in your SSH agent or ~/.ssh/ … ssh-keygen -t ed25519' (connect needs SSH key)", "notes": "psql via railway run + TCP proxy worked instead", "quality": { "error_legibility": "clear", "recoverable": "yes" } }, { "t": "11:33", "cap": "cap-35", "capability": "Railway Agent", "task": "RAILWAY_TOKEN=… railway agent -p 'list the services in this project'", "route": "cli", "documented": true, "result": "blocked", "verified": false, "evidence": "'Unauthorized. Please login with `railway login`'" }, { "t": "14:54", "cap": "cap-28", "capability": "DB shell", "task": "Retry railway connect Postgres after providing an SSH key", "route": "cli", "documented": true, "result": "failed", "verified": false, "evidence": "'Unauthorized. Please check that your RAILWAY_TOKEN is valid…'", "notes": "connect needs account auth; project token not enough" }, { "t": "14:54", "cap": "cap-20", "capability": "Create and run an ephemeral sandbox VM", "task": "RAILWAY_TOKEN=… railway sandbox create; list; exec; destroy", "route": "cli", "documented": true, "result": "done", "verified": true, "evidence": "sandbox b48fa8b6… listed RUNNING us-west2; `sandbox exec -- uname -a` returned Linux fvm-cd4118c3…; destroy -> '✓ Destroyed sandbox', list shows no active sandboxes", "notes": "CLI warns sandboxes are experimental; `destroy -y` flag not accepted" }, { "t": "14:54", "cap": "cap-21", "capability": "Exec into sandbox", "task": "railway sandbox exec -- uname -a", "route": "cli", "documented": true, "result": "done", "verified": true, "evidence": "returned kernel string from the sandbox VM fvm-cd4118c3…", "notes": "railway ssh into a service not tried (needs account)" }, { "t": "14:54", "cap": "cap-32", "capability": "Usage", "task": "RAILWAY_TOKEN=… railway usage", "route": "cli", "documented": true, "result": "blocked", "verified": false, "evidence": "'Unauthorized. Please check that your RAILWAY_TOKEN is valid…'", "notes": "needs account token" }, { "t": "14:54", "cap": "discovery", "capability": "DCR", "task": "POST /oauth/register (RFC 7591)", "route": "api", "documented": true, "result": "done", "verified": true, "evidence": "201 client_id rlwy_oaci_… token_endpoint_auth_method none" }, { "t": "14:54", "cap": "credentials", "capability": "device flow with registered client", "task": "POST /oauth/device/auth with the DCR client_id", "route": "api", "documented": true, "result": "failed", "verified": false, "evidence": "400 invalid_request 'urn:ietf:params:oauth:grant-type:device_code is not allowed for this client'", "notes": "AS metadata advertises device_code; DCR clients don't get it (CLI's own client does)", "quality": { "error_legibility": "clear" } }, { "t": "14:54", "cap": "pay", "capability": "pay step", "task": "402 probes, registries, docs", "route": "api", "documented": true, "result": "done", "verified": true, "evidence": "graphql/v2 unauth GET -> 400 'Problem processing request' (no 402); x402./mpp. subdomains no answer; agents.railway.com 302 to /agents.sh; mpp.dev/api/services 137 services, none Railway; x402 Bazaar: only a third-party app hosted on *.up.railway.app; openapi.json no x-payment-info; /.well-known/ucp 404; docs: 'Railway only accepts credit cards for plan subscriptions'; GraphQL schema has customerCreateFreePlanSubscription but no paid-plan mutation; upgrade in web Billing page", "notes": "trial needs no card; paid plan card-only via web" }, { "t": "14:54", "cap": "cancel", "capability": "cancel", "task": "Docs: how to cancel", "route": "none", "documented": true, "result": "skipped", "verified": false, "evidence": "docs: 'go to the Active Plan section of your Billing page and click Cancel Plan' (web)", "notes": "no plan started" }, { "t": "14:54", "cap": "delete", "capability": "delete account/data", "task": "Delete anonymous project via API; docs for account delete", "route": "api", "documented": true, "result": "failed", "verified": false, "evidence": "projectDelete and serviceDelete with project token -> 'Not Authorized'; deploymentRemove worked (all deployments REMOVED/REMOVING); tcpProxyDelete call hung (>30 s, proxy still listed); docs: account delete via 'Delete Account' on Account Settings (web); schema has userDelete mutation", "notes": "unclaimed box/project is deleted by Railway after the 24 h claim window per docs; no account was created" }, { "t": "15:03", "cap": "signup", "capability": "human handoff for Turnstile", "task": "", "route": "browser", "documented": true, "result": "blocked", "verified": false, "evidence": "", "notes": "Visible Cloudflare Turnstile on email sign-up; GitHub/Google options need an existing third-party account we do not have" }, { "t": "16:03", "cap": "cap-01", "capability": "Deploy from Git repo", "task": "serviceCreate with source.repo railwayapp-templates/nodejs-starter, then serviceInstanceDeployV2", "route": "api", "documented": true, "result": "failed", "verified": false, "evidence": "serviceCreate ok (service 'repo'); serviceInstanceDeployV2 -> 'Repository \"railwayapp-templates/nodejs-starter\" not found or is not accessible' (BAD_USER_INPUT)", "notes": "repo deploys need a GitHub-connected account; with the anonymous project token code deploys are refused ('You must be logged in to deploy', /). Repo name may also be wrong: not checked further.", "quality": { "error_legibility": "clear", "recoverable": "no" } } ], "stale": false, "icon": "/logos/railway.png", "monitored": false, "verdict": "L3 · Does the work: our agent gets in on its own, no account needed. `ssh railway.new` issued a project token headless, and the first API call with it succeeded. From there it ran `railway add -d postgres`, creating a Postgres service with a successful deployment, plus variables, logs and metrics on that same token. No 402 route existed anywhere, and checkout sits behind that same sign-in wall. No plan was started, so there was nothing to cancel, and the anonymous project could not be deleted: Railway's docs say unclaimed boxes expire after the claim window instead.", "page": "https://agentdrives.com/tools/railway?via=api" }