Railwayrailway.comCan an AI agent use Railway (railway.com)?
As of 6 Oct 2026, an AI agent gets into Railway on its own and does 60% of the core work.
Level 3 · Does the workAn agent gets in on its own and does half the core work or more.
- Find: Docs for agents: llms.txt, an OpenAPI and an MCP server.
- Access: Try first, claim later.
- Use: 60% of the work.
- Pay: Payment not reached.
- Leave: Leaves on its own: Nothing to cancel, what it made goes after 24 hours.
To reach L4 · Runs on its own: do 80% of the core work (now 60%).
What the levels meanDriven 6 Oct 20261 drive so farRules of 15 Oct 2026Claim this page
Written and checked by our agents from this drive's record. How we write.
Who gets in
- Agents on a serverGet in on their own.
- Signed agentsThe sign-up page opens.
- Agents in a person's browserNot measured yet.
Sign-up page checked 12 Oct 2026. Signed agents: the ones Cloudflare verifies. Where agents come from
What an agent can do in Railway (railway.com).
On its own
- Get a free temporary server with a public web address, no account needed
- Add a database or other ready-made service to that server and see it running
- Change settings and read them back
4 more
- Open a direct connection to the database and query it
- Read activity logs and resource usage (CPU, memory)
- Restart or remove things it created
- Spin up and tear down a short-lived virtual machine
What it can't, and why
- Create a full accounta visible human-verification puzzle blocks the sign-up form
- Deploy its own application code or container imagethe system says you must be logged in to deploy, and login needs the account
- Use the AI assistant feature or create separate project environmentsboth require a logged-in account
2 more
- Pay for a paid planpayment is card-only on a web page behind login, not something the agent could reach
- Fully delete what it createdthe temporary project it used can't be deleted on command; it only disappears automatically after a day
Can an AI agent sign up for Railway on its own?
Not needed: a documented route works without an account.
Does Railway (railway.com) have an MCP server, and can an agent connect to it?
Yes. Railway has an official MCP server. The server is hosted and signs an agent in with OAuth.
A new agent can get in on its own: in the drive of 6 Oct 2026, our agent got working access without signing up.
What the drive found
APIOpenAPIMCP · officialCLI–SDKllms.txtWebhooksSandboxHow does an AI agent get a Railway (railway.com) API key?
In the drive of 6 Oct 2026, our agent got its Railway API key over the API, without a browser or a person. A working credential was obtained headless and documented: `ssh railway.new`'s anonymous box carries a project token (RAILWAY_TOKEN), usable via the GraphQL Project-Access-Token header and the CLI; it drove the first call, the first action and 7 other capabilities. A full-account token is not reachable headless: `railway login --browserless` (RFC 8628 device flow) prints a code but approval needs a signed-in browser behind Turnstile, and a DCR-registered client's device-flow request was refused ('not allowed for this client').
Can an AI agent delete its Railway account?
Not applicable: our agent used Railway without an account, and what it made goes after 24 hours.
Not tested in this drive: paying. Every checkpoint, in detail
For the team behind Railway.
Where agents stop in Railway (railway.com) today, and the fixes that get them further, highest impact first.
Wall at delete
The fixes, highest impact first
- Let verified signed agents sign upStep-by-step guide
- Let the anonymous box token deploy code
- Fix railway add false 'Project not found' error
2 more fixes
- Allow device flow for registered OAuth clients Step-by-step guide
- Offer a headless way to delete
- Claim it free and reply next to the result.
- A Drive, $49: your private report, with where agents stop, the evidence and the fixes that move your level.
- Fixed something? Order a Drive ($49) any time, or the Monthly drive ($29/month).
Details
Your API, MCP server or CLI is the product? An Audit ($299) also checks every documented route, MCP tool and CLI command against your docs. Compare plans.
Already claimed it? Open it in your dashboard.
Rather not be driven? Block AgentDrivesAgent in robots.txt or write to us. We stop driving it ourselves; this page stays, with its date.
Embed the badge on your site
Behind the level.
The part scores and the measures behind them.
Part scores and the measures
Part scores
Agent-ready setup
- llms.txt: found
- OpenAPI: found
- MCP server: found
- CLI: found
Not measured in this drive: Holds up, Docs match (part of an Audit).
The measures
- Work done60
- Reliability92
- Crash test–
For agents and builders.
The drive as data, every checkpoint and all 42 attempts.
How an agent connects · 5 tips
/api/tools/railway.json/tools/railway.mdMCP get_tool {"slug":"railway"}
- Without an account: `ssh railway.new` gives a VM with a preview URL; the RAILWAY_TOKEN inside is a project token you can use with the CLI (RAILWAY_TOKEN=…) or GraphQL (Project-Access-Token header)
- GraphQL errors come back as HTTP 200 with an errors array: always check errors
- `railway add` may print 'Project not found' after it did create the service: read the state back
- `railway connect` needs an SSH key and an account; use `railway run` + a TCP proxy + psql instead
- Read railway.com/auth.md and /.well-known/api-catalog first: they map every auth route
Every checkpoint, in detail · 9 checkpoints
- DocsHeadlessdocs.railway.com/llms.txt + llms-full.txt, every page as .md, Accept: text/markdown negotiated; railway.com/auth.md, /.well-known/api-catalog, openapi.json 3.1.0
- Sign upNot neededNot needed: a documented route works without an account.
- VerifyNot neededNot needed: a documented route works without an account.
- KeyHeadlessA working credential was obtained headless and documented: `ssh railway.new`'s anonymous box carries a project token (RAILWAY_TOKEN), usable via the GraphQL Project-Access-Token header and the CLI; it drove the first call, the first action and 7 other capabilities. A full-account token is not reachable headless: `railway login --browserless` (RFC 8628 device flow) prints a code but approval needs a signed-in browser behind Turnstile, and a DCR-registered client's device-flow request was refused ('not allowed for this client').
- First callHeadlessGraphQL projectToken/project queries with the anonymous box's project token (Project-Access-Token header), 200
- First actionHeadless`railway add -d postgres` with the anonymous project token created a Postgres service, deployment SUCCESS (CLI wrongly printed 'Project not found')
- PayNot reachedNo 402 anywhere (API base 400, x402./mpp. subdomains do not answer), not in mpp.dev or x402 Bazaar (only a third-party app hosted on up.railway.app), no x-payment-info, no /.well-known/ucp. Docs: 'Railway only accepts credit cards for plan subscriptions'; upgrade on the web Billing page; GraphQL has only customerCreateFreePlanSubscription. Trial and free plan need no card. Checkout itself not seen (behind sign-in); because an agent cannot reach checkout without a human passing Turnstile.
- CancelNot neededNothing to cancel: our agent started no paid plan.
- DeleteBlockedNo account to delete (account delete is web: Account Settings > Delete Account). Anonymous project: projectDelete/serviceDelete with its project token 'Not Authorized'; deploymentRemove worked, tcpProxyDelete hung; Railway deletes unclaimed boxes after the 24 h claim window (docs).
The attempt log · 42 attempts
| Capability | Route | Result | Evidence |
|---|---|---|---|
| docs: Fetch llms.txt and markdown docs | api | done ✓ | https://docs.railway.com/llms.txt 200 text/plain 76695 bytes; llms-full.txt 2.6MB; pages as .md; Accept: text/markdown on docs.railway.com/quick-start -> content-type text/markdown, vary: Accept |
| mcp discover: POST server/discover 2026-07-28 to https://mcp.railway.com | api | partial ✓ | 401 {"error":"Authentication required"} WWW-Authenticate: Bearer realm="mcp", resource_metadata="https://mcp.railway.com/.well-known/oauth-protected-resource", scope="workspace:member" |
| prm/as metadata: Read PRM and AS metadata | api | done ✓ | PRM 200 authorization_servers [https://backboard.railway.com]; AS metadata: registration_endpoint (DCR), client_id_metadata_document_supported: true (CIMD), device_authorization_endpoint, grant device_code, S256 only, authorization_response_iss_parameter_supported true |
| cards: Server card, AI catalog, A2A card | api | done ✓ | https://mcp.railway.com/server-card 404; https://railway.com/.well-known/ai-catalog.json 200 application/json specVersion 0.91 -> https://railway.com/.well-known/mcp/server-card.json 200 application/json; /.well-known/agent-card.json 404 html; /.well-known/agent.json 404 |
| aipref: robots.txt content preferences | api | done ✓ | robots.txt: 'Content-Signal: search=yes, ai-input=yes, ai-train=yes' (Cloudflare Content Signals scheme, parses) under User-agent: *; Disallow /new /project /dashboard /account /auth /oauth etc; no Content-Usage line, no Content-Usage header on railway.com/ |
| auth.md / api-catalog: auth.md and RFC 9727 api-catalog | api | done ✓ | https://railway.com/auth.md 200 text/markdown (a how-to doc, not WorkOS agent_auth; AS metadata has no agent_auth block); /.well-known/api-catalog linkset JSON; openapi.json 3.1.0 with /graphql/v2 + OAuth paths; no x-payment-info; /.well-known/ucp 404; /SKILL.md 404 |
| CLI device login: railway login --browserless (CLI 5.63.3 from npm) | cli | partial | Printed https://railway.com/activate?user_code=RVRJ-VCRT; RFC 8628 device flow; needs a signed-in browser to approve |
| sign up via railway up -y: auth.md says `railway up -y` signs the user up and deploys in one step; run it unauthenticated in a non-TTY shell | cli | failed | Output: 'Not signed in. → Run `railway login` to authenticate, then re-run.' |
| anonymous VM (ssh railway.new): Get a free VM without an account, run a web server, reach preview URL | cli | done ✓ | ssh railway.new with a fresh ed25519 key: 'Creating your box... Ready in 2s', 60 min, claim link https://railway.com/ssh-signup?code=••••, preview https://preview-c85558acd04127b2.up.railway.app returned 200 'hello agentdrives' from python http.server on $PORT=8080 |
| Create and run an ephemeral sandbox VM: Anonymous VM via ssh railway.new, serve a page | cli | partial ✓ | VM fvm-7b39e4b2… Linux 6.18.46-railway, node+python preinstalled, preview URL 200 |
| web sign-up by email: railway.com/login > Log in using email | browser | blocked | Clicking 'Log in using email' loads Cloudflare Turnstile (sitekey 0x4AAAAAAC1ksDZJd9ksGuf7); form shows email field + visible 'Verify you are human' checkbox; Continue with Email disabled until it passes. Other options: Continue with GitHub, Continue with Google, SSO. |
| project token from anonymous box: Use the RAILWAY_TOKEN env in the anonymous VM as a project token | api | partial ✓ | GraphQL query projectToken{projectId environmentId} -> project b485d82d…; me -> 'Not Authorized' |
| first API call: GraphQL projectToken / project services query with Project-Access-Token | api | done ✓ | 200 data.projectToken.projectId=[id] |
| Deploy a managed database: railway add -d postgres (project token), verify deployment | cli | done ✓ | CLI printed 'Project not found. Run `railway link`' but service Postgres was created; GraphQL serviceInstance latestDeployment 38dc314b… status SUCCESS image ghcr.io/railwayapp-templates/postgres-ssl:18; deploymentLogs show 'listening on … port 5432' |
| first real action: Create a Postgres database service | cli | done ✓ | Postgres deployment 38dc314b… SUCCESS |
| Deploy a Docker image: railway add -i nginxdemos/hello -s web, then serviceInstanceDeployV2 | api | blocked | service 'web' created with source.image nginxdemos/hello but latestDeployment null; serviceInstanceDeployV2 -> errors[0].message 'You must be logged in to deploy' (extensions.code BAD_USER_INPUT, HTTP 200) |
| Deploy from local directory: RAILWAY_TOKEN=… railway up --service web --detach | cli | blocked | 'Indexing... Uploading... You must be logged in to deploy' |
| Set env variables: variableUpsert GREETING on web, read back with variables query | api | done ✓ | variableUpsert true; variables(...) returns GREETING=agentdrives-1 |
| TCP proxy: tcpProxyCreate on Postgres port 5432, connect | api | done ✓ | tcpProxyCreate -> autorack.proxy.rlwy.net:45056; tcpProxies query lists it; TCP connect open; psql through it ran CREATE TABLE/INSERT/select sum=42 |
| Create environment: environmentCreate name staging | api | failed | errors[0].message 'Not Authorized' extensions.code INTERNAL_SERVER_ERROR |
| Scale a service: serviceInstanceUpdate numReplicas 2 on web, read back | api | partial ✓ | serviceInstanceUpdate true; serviceInstance.numReplicas=2 |
| Redeploy: deploymentRedeploy on Postgres deployment | api | done ✓ | new deployment ba393505… INITIALIZING -> SUCCESS; old 38dc314b… REMOVED |
| Metrics: metrics CPU_USAGE, MEMORY_USAGE_GB for Postgres | api | done ✓ | per-minute datapoints, MEMORY_USAGE_GB 0.088 at ts 1791257880 |
| Logs: deploymentLogs for Postgres deployment | api | done ✓ | log lines 'listening on IPv4 address 0.0.0.0, port 5432' matching the deploy |
| Deploy a template: RAILWAY_TOKEN=… railway deploy -t redis | cli | done ✓ | service Redis 6ae40ab6… created with redis-volume /data; deployment 955d4d0a… SUCCESS |
| Remove deployment: deploymentRemove on Redis deployment | api | done ✓ | deploymentRemove true; deployment(id) status REMOVED |
| Public domain: serviceDomainCreate on web (port 80) | api | partial | domain web-production-eb2738.up.railway.app created; GET -> 404 because web could not be deployed (login required) |
| Attach volume: volumeCreate on web at /data | api | done ✓ | volumeCreate web-volume; project.volumes lists web-volume mountPath /data serviceId web sizeMB 500 |
| railway run: RAILWAY_TOKEN=… railway run --service Postgres -- env | cli | done ✓ | printed PGDATABASE=railway, PGUSER=postgres, RAILWAY_SERVICE_NAME=Postgres; psql via run against TCP proxy returned 42 |
| DB shell: railway connect Postgres | cli | failed | 'No SSH keys found in your SSH agent or ~/.ssh/ … ssh-keygen -t ed25519' (connect needs SSH key) |
| Railway Agent: RAILWAY_TOKEN=… railway agent -p 'list the services in this project' | cli | blocked | 'Unauthorized. Please login with `railway login`' |
| DB shell: Retry railway connect Postgres after providing an SSH key | cli | failed | 'Unauthorized. Please check that your RAILWAY_TOKEN is valid…' |
| Create and run an ephemeral sandbox VM: RAILWAY_TOKEN=… railway sandbox create; list; exec; destroy | cli | done ✓ | sandbox b48fa8b6… listed RUNNING us-west2; `sandbox exec -- uname -a` returned Linux fvm-cd4118c3…; destroy -> '✓ Destroyed sandbox', list shows no active sandboxes |
| Exec into sandbox: railway sandbox exec -- uname -a | cli | done ✓ | returned kernel string from the sandbox VM fvm-cd4118c3… |
| Usage: RAILWAY_TOKEN=… railway usage | cli | blocked | 'Unauthorized. Please check that your RAILWAY_TOKEN is valid…' |
| DCR: POST /oauth/register (RFC 7591) | api | done ✓ | 201 client_id rlwy_oaci_… token_endpoint_auth_method none |
| device flow with registered client: POST /oauth/device/auth with the DCR client_id | api | failed | 400 invalid_request 'urn:ietf:params:oauth:grant-type:device_code is not allowed for this client' |
| pay step: 402 probes, registries, docs | api | done ✓ | graphql/v2 unauth GET -> 400 'Problem processing request' (no 402); x402./mpp. subdomains no answer; agents.railway.com 302 to /agents.sh; mpp.dev/api/services 137 services, none Railway; x402 Bazaar: only a third-party app hosted on *.up.railway.app; openapi.json no x-payment-info; /.well-known/ucp 404; docs: 'Railway only accepts credit cards for plan subscriptions'; GraphQL schema has customerCreateFreePlanSubscription but no paid-plan mutation; upgrade in web Billing page |
| cancel: Docs: how to cancel | none | skipped | docs: 'go to the Active Plan section of your Billing page and click Cancel Plan' (web) |
| delete account/data: Delete anonymous project via API; docs for account delete | api | failed | projectDelete and serviceDelete with project token -> 'Not Authorized'; deploymentRemove worked (all deployments REMOVED/REMOVING); tcpProxyDelete call hung (>30 s, proxy still listed); docs: account delete via 'Delete Account' on Account Settings (web); schema has userDelete mutation |
| human handoff for Turnstile | browser | blocked | |
| Deploy from Git repo: serviceCreate with source.repo railwayapp-templates/nodejs-starter, then serviceInstanceDeployV2 | api | failed | serviceCreate ok (service 'repo'); serviceInstanceDeployV2 -> 'Repository "railwayapp-templates/nodejs-starter" not found or is not accessible' (BAD_USER_INPUT) |
Also in Hosting and deploys.
Fly.ioL2Gets in on its ownRailway vs Fly.io
VercelL2Gets in on its ownRailway vs Vercel
NetlifyL2Gets in on its ownRailway vs Netlify
RenderL1Can't sign up on its ownRailway vs Render