What's new
- Oct 5, 2026 · AWS joins the platform layer. The same gateway now runs on Lambda, with durable work, S3 files, AppSync Events and AgentCore sandboxes. The shared browser and realtime client work on AWS too. A fresh deployment passed functional checks plus worker timeout/retry, active-turn reconnect, pending forms across a release and an eight-minute browser handoff with image-version recovery. AWS · What was tested
- Oct 5 · Runs and approvals recover more cleanly. Follow a turn's status, recover unanswered forms after reconnecting, and resume an answer once. Queued turns reject stale work, and scheduled jobs recheck their current definition before running. These changes live in the shared core. Sessions · Human in the loop · Upgrade notes
- Oct 2 · Cloudflare and PostgreSQL. Cloud packs implement six shared contracts; the same agents run on Azure or Cloudflare. Cosmos DB and PostgreSQL with pgvector pass the same storage suite. Platforms · Database
- Oct 1 · A real browser for every agent. Chromium reads pages, clicks, types and handles files inside the user's sandbox. For a step the user needs to take, the agent hands over the live browser and continues after Done. Off by default. Browser
- Sep 30 · One-command quickstart and a web chat sample with approval forms and reminders.
- Sep 30 · Backend review. Scheduler, billing, sessions, approvals and credential handling received fixes recorded in UPGRADING.md.
- Sep 29 · Open source, Apache-2.0, in preview.
Next: local development without an Azure account, a starter app you can rebrand, and a Google Cloud pack. Roadmap
Architecture
One shared runtime. An agent for every user. Your choice of cloud. The gateway, agent loop, workflows and client use six platform contracts; Azure, Cloudflare and AWS implement them with their own services.
Open the full diagram · Cloud services and capabilities
How users stay separate
A tenant here is a canonical userId. Users share compute and infrastructure; the runtime carries the authenticated owner's identity through their work:
- Identity: app sign-in and paired channel accounts resolve to the same user. Requests use that identity to check ownership.
- State: sessions, memories and schedules use user-scoped storage. Files and sandbox identifiers include their owner; this does not require a database or an always-on server per user.
- Work and replies: a renewed lease serializes turns within a conversation. Approval answers belong to the requesting user, and realtime events target that user's connections. Reconnects can recover run status and unanswered forms.
Deploy one cloud pack in your account. Model providers are configured independently of the hosting cloud, and backend capabilities differ. Azure · Cloudflare · AWS, preview · Security model
The Azure implementation uses Functions, Durable Functions, Cosmos DB or PostgreSQL, Web PubSub and Container Apps. The other packs fill the same roles with the services shown above.
Architecture details · Sessions · Approvals
Hyperscale by design
An agent is a user's state and work, with compute allocated when needed. You don't provision an always-on brain process for every user. Independent users can run on different instances; a conversation keeps its own lease.
Cloud quotas, the database and your configuration set capacity. The scaling guide explains the limits; cloud packs map the same runtime to Cloudflare and AWS.
Measured end to end
Measured on Azure: 1,000 users arriving over three minutes completed 3,000/3,000 turns, with about 0.1 s p50 to accept a message. In a separate GPT-5.6 Luna run, 120 users completed 4,799/4,800 turns at about $2 of model cost per 1,000 turns. Method and raw results
Validated on AWS: application, durable jobs, sandbox, S3, realtime and browser contracts on a fresh deployment, with targeted resilience checks. This is functional validation, not an AWS load benchmark. Validation record
Pay for awake agents, not for users
On the Azure cost model, the platform is estimated at about 1–2¢ per user a month, plus model tokens, and an inactive user's 3 MB of storage at about $0.0008 a month.
These are estimates with documented assumptions and a script for your own numbers. The comparison uses the smallest VM per user. Cloudflare and AWS have different pricing and minimum infrastructure costs; see the Cloudflare and AWS deployment guides.
You build the product. It runs the brain.
You bring the interface, brand, sign-in, agent personality and skills. AgentForEach supplies the runtime and keeps each user's state separate. Azure, Cloudflare and AWS implement the same six platform contracts. The expandable illustration shows an Azure deployment.
It runs in your cloud account, using the model providers you configure. For one person's own agent, there is single-user mode.
What you can build
Your agent in code
Give it a personality. Configure shared defaults; profiles and memories hold what the agent learns about each user. Dynamic prompts can also let each user's agent update its own documents (Configuration):
// Excerpt from gateway/config/agentforeach.json
"templates": {
"IDENTITY": { "name": "Tara", "emoji": "📚", "role": "Study coach", "vibe": "Patient and encouraging" },
"SOUL": { "coreTruths": ["Find out what the student already knows before explaining anything."] }
}
Teach it a skill. A Markdown file describes the tool and the user's connection. The platform handles host-bound credentials; sandbox injection capabilities depend on the cloud (Skills, Sandboxes):
---
id: courses
name: Courses
description: Look up the student's courses, grades and deadlines
category: education
credentials: [{"key":"LMS_TOKEN","label":"Your LMS token","hosts":["lms.example.com"],"header":"Authorization","format":"Bearer {value}"}]
---
Call `https://lms.example.com/api/me/courses` with `Authorization: Bearer $LMS_TOKEN`.
Connect your app. Send a message as the signed-in user. Background work owns the turn, so the HTTP request can return immediately:
const response = await fetch(`${API}/api/chat`, {
method: "POST",
headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },
body: JSON.stringify({ message: "Remind me to revise chapter 3 at 7pm" }),
});
const { runId, sessionId } = await response.json(); // 202 Accepted
The portable realtime client streams events on all three clouds. Follow the turn with GET /api/chat/runs/{runId}; the web chat sample shows chat, approvals, reconnects and browser handoffs together.
What's in the box
Capabilities such as sandbox credential injection vary by backend. Platforms and Sandboxes describe those differences.
How it compares
| A machine per user | An agent framework | AgentForEach |
|---|
| Built for | One person's own agent | Writing agent logic | Running an agent for every user |
| An idle user costs | A machine that stays on | Up to your hosting | User storage, plus shared cloud infrastructure |
| Memory, schedules and sandboxes | For the one owner | You build them | Built in, scoped to each user |
| Channels and identity linking | The owner's own accounts | You build them | Web, apps, Telegram and WhatsApp, with pairing |
| Deployment | A fleet you operate | Infrastructure you design | Shared runtime and a cloud pack |
More detailed comparisons: Cloudflare Agents, Letta, LangGraph, Mastra and the OpenAI Agents SDK.
Quick start
Choose where to run it. Your agent code and client API stay the same.
| Cloud | Runs on | Start here |
|---|
| Azure | Functions, Cosmos DB or PostgreSQL, Web PubSub and Container Apps | ./scripts/quickstart.sh · Guide |
| Cloudflare | Workers, Durable Objects, PostgreSQL through Hyperdrive, R2 and Containers | ./scripts/quickstart-cloudflare.sh · Guide |
| AWS · preview | Lambda, Lambda durable functions, PostgreSQL, S3, AppSync Events and AgentCore | Guided deployment · Live validation |
Fastest way to try the Azure sample: open Codespaces, then run the quickstart. It asks for an Azure sign-in and an OpenAI API key, creates a trial stack and prints a login for the web chat.
./scripts/quickstart.sh
The Azure and Cloudflare quickstarts use test sign-in. The cloud guides cover prerequisites, real authentication and teardown. Getting started also covers local setup and Azure OpenAI.
Preview. Tested on real deployments and covered by 2,100+ tests on Node 22 and 24. Production experience is still limited; check the cloud capabilities and security model for your deployment.
You need Node 22, Azure Functions Core Tools 4 (4.15.2 or newer), the Azure CLI, Pulumi, and an Azure subscription where you can assign roles (Owner, or Contributor plus User Access Administrator): the stack grants its own identities access to storage, Key Vault and Cosmos DB.
1. Create the Azure resources
npm ci && az login
cd infra && pulumi stack init dev
pulumi config set azure-native:location eastus
pulumi config set agentforeach:nameSuffix $(openssl rand -hex 3)
pulumi config set --secret agentforeach:openaiApiKey sk-...
pulumi up && cd ..
2. Choose how your users sign in. Set auth.providers in gateway/config/agentforeach.json: App Service authentication, JWT, API keys or a trusted proxy. A fresh stack trusts no one, so every API call returns 401 until you do. The web chat sample sends a bearer token, so use JWT to try it (a test token in two steps); API keys suit server-to-server calls.
3. Deploy the gateway. The config file ships with the code, so run this again whenever you change it:
./scripts/deploy-gateway.sh dev
4. Say hi. Open the web chat sample with your Function App URL and a token from the provider you chose.
Documentation
Full documentation index
Community
Try a deployment, show what you're building, or tell us where you got stuck. Deployment reports, reproducible bugs and focused fixes are especially useful while the project is in preview.
Created by Mohit Garg · Updates
License
Apache-2.0. Copyright 2026 Mohit Garg and AgentForEach contributors. Third-party notices are in NOTICE.
AgentForEach and the AgentForEach logo are trademarks of Mohit Garg. The license covers the code, not the name or logo (Apache-2.0, section 6): a fork or a product built on AgentForEach needs its own name.
