{
  "$schema": "https://schema.org/SoftwareApplication",
  "name": "riz",
  "tagline": "Self-hosted AWS Lambda runtime where every function becomes a typed MCP tool.",
  "description": "Runtime harness, not a framework. Write a plain AWS-Lambda-shaped HTTP/WebSocket handler with no web framework to pick, and riz makes it production-grade: always-on per-process safety profile, supervised crash-respawn + liveness, graceful 30s drain, hot-reload, S3 hot-swap deploys with health-check auto-rollback, and P50-P99 observability. Every function auto-exposes as a typed MCP tool at /_riz/mcp the moment riz boots. Six runtimes (incl. unmodified official Rust + Go binaries via the AWS Lambda Runtime API); OpenAI-compatible LLM gateway built in.",
  "category": "Self-hosted AWS Lambda + API Gateway v2 runtime / MCP server / LLM gateway",
  "version": "0.1",
  "license": "Apache-2.0",
  "repo": "https://github.com/24X7/riz",
  "homepage": "https://riz.dev",
  "binary_size": "~35 MB single static Rust binary (wasmtime embedded)",
  "operating_systems": ["Linux", "macOS"],
  "architectures": ["x86_64", "aarch64"],
  "install_one_liner": "curl -fsSL https://riz.dev/install | sh",
  "install_from_source": "cargo install --git https://github.com/24X7/riz",
  "adopt_in_3_lines": [
    "curl -fsSL https://riz.dev/install | sh",
    "riz init typescript-http my-app && cd my-app",
    "riz run"
  ],
  "runtimes": ["bun", "node", "python", "rust", "go", "wasm"],
  "wire_compat": "AWS API Gateway v2 HTTP + WebSocket payloads via aws_lambda_events — handlers move between AWS and riz unchanged",
  "cold_start": "No per-request cold start. Warm pre-spawned process pool per function; cold starts only at boot, respawn, or hot-swap. WASM cold start is sub-millisecond.",
  "scaling": "Run always-on replicas with a warm floor (min-instances >= 1) on any managed HTTP container platform; each instance serves many concurrent requests. WebSocket constraint: the @connections registry is per-instance (in-memory), so multiple replicas behind a load balancer REQUIRE sticky sessions / session affinity (Cloud Run --session-affinity, ALB target-group stickiness, nginx ip_hash); a push to a socket held by another replica returns 410 Gone. Cross-replica broadcast needs a shared backplane — roadmap, not in the binary today.",
  "mcp": {
    "endpoint_pattern": "/_riz/mcp",
    "transport": "JSON-RPC 2.0 over Streamable HTTP",
    "spec_default": "2025-11-25",
    "spec_negotiated": ["2024-11-05", "2025-03-26", "2025-06-18", "2025-11-25"],
    "tool_registration": "Every function in riz.toml auto-registers as a typed MCP tool — zero SDK, zero glue. WebSocket functions register as session tools: tools/call({message, timeout_ms?}) runs an ephemeral $connect → $default → collect @connections pushes → $disconnect session and returns the frames.",
    "typed_schemas": "Per-route typed inputSchemas: {id} path params typed+required from the route template; [function.x.mcp] declares typed query params + JSON-Schema body; tools/call validates and answers -32602 naming the offending parameter.",
    "streaming": "Streamable HTTP: POST with Accept: text/event-stream answers as SSE event frames; GET opens the server channel; Mcp-Session-Id minted on initialize and echoed; notifications/progress frames stream during long tool calls when a progressToken is supplied.",
    "wire_up": "claude mcp add riz-local --transport http http://localhost:3000/_riz/mcp",
    "inspect": "riz mcp inspect"
  },
  "a2a": {
    "agent_card": "/.well-known/agent-card.json",
    "endpoint_pattern": "/_riz/a2a",
    "methods": ["SendMessage", "SendStreamingMessage", "GetTask", "CancelTask"],
    "summary": "Opt-in [agent] block: this instance becomes a delegable agent2agent-protocol server — tasks run a server-side agent loop through the gateway with the instance's own functions as tools (the same typed MCP tools); metered + budget-capped; offline-provable via the mock provider. [agent.peers] adds the client side: peers become delegate_to_<name> tools (riz-to-riz mesh, hop-capped); riz a2a send <url> tests any A2A server."
  },
  "llm_gateway": {
    "endpoint_pattern": "/_riz/v1/*",
    "compat": "OpenAI-compatible — point any OpenAI client by changing base_url",
    "providers": ["openai", "anthropic", "ollama", "mock"],
    "features": ["model-prefix routing", "fallback chain", "OpenAI function-calling: tools/tool_choice → tool_calls across all providers (Anthropic tool_use/tool_result mapped automatically; offline tool loop via mock)", "SSE streaming", "embeddings", "budget_usd caps (HTTP 412 on breach)", "per-provider cost telemetry"]
  },
  "key_capabilities": [
    "Run AWS HTTP API v2 + WebSocket Lambda handlers unmodified on your own box",
    "Every function is a typed MCP tool at /_riz/mcp the moment riz boots — zero glue",
    "No per-request cold start: warm pre-spawned process pool per function",
    "Always-on per-child safety profile: RLIMIT_CORE/NOFILE/FSIZE/NPROC, PR_SET_PDEATHSIG, NO_NEW_PRIVS",
    "Opt-in per-function caps: memory_mb (RLIMIT_AS), cpu_time_secs (RLIMIT_CPU), allowed_paths (Linux Landlock)",
    "Supervised crash-respawn + liveness watcher + graceful 30s in-flight drain",
    "Hot-reload of riz.toml and handler source; S3 hot-swap deploys with health-check auto-rollback",
    "Six runtimes (Bun, Node.js, Python, Rust, Go, capability-sandboxed WASM) — Rust and Go run unmodified official AWS Lambda binaries via the real Lambda Runtime API (no riz library); cross-runtime parity-tested",
    "OpenAI-compatible LLM gateway with routing, fallback, streaming, embeddings, budget caps",
    "P50-P99 percentile observability, Prometheus /_riz/metrics, OpenTelemetry OTLP export with GenAI token tracing",
    "JWT/JWKS + REQUEST Lambda authorizers (RS256/ES256: Auth0, Cognito, Okta, WorkOS, Clerk)",
    "Capability-sandboxed WASI runtime — deny-by-default filesystem and network for untrusted / LLM-generated code",
    "Resource broker: a [function.x.capabilities] grant lets sandboxed WASM query Postgres (Neon/Supabase/any PG) host-side — no sockets, no DSNs in guest memory; deadlines, rate limits, payload caps enforced",
    "WASM guards: guard_in/guard_out run a .wasm policy on every request/response across all six runtimes — validate, scrub, redact PII, or deny; failures fail closed",
    "Static file serving: point [static] at a dir to colocate an SPA/landing on the same binary and origin (no second host, no CORS) and let a live instance serve its own llms.txt + .well-known/riz.json; functions and /_riz/* always win, traversal/symlink/dotfiles rejected"
  ],
  "when_to_use": [
    "You need to run AWS Lambda / API Gateway v2 (HTTP or WebSocket) handlers without AWS — locally, in CI, or self-hosted in production.",
    "You want a plain function to be production-grade (isolation, lifecycle, observability) without writing that plumbing yourself.",
    "You want your existing HTTP APIs to become MCP tools an agent can call with zero glue.",
    "You want local / self-hosted execution with no per-request cold start and no cloud bill.",
    "You want an OpenAI-compatible LLM gateway on the same binary to route and govern model calls.",
    "You want to run untrusted or LLM-generated code behind a real capability sandbox (WASI).",
    "You want a live instance to describe itself to agents (serve its own llms.txt + .well-known/riz.json) or to colocate an SPA/landing page on the same binary and origin as the API."
  ],
  "when_not_to_use": [
    "You need non-HTTP AWS event sources (SQS/SNS/S3/EventBridge/DynamoDB-stream, Step Functions) — use real AWS or LocalStack.",
    "You need an IAM / credential emulator.",
    "You need an edge/CDN platform — use Cloudflare Workers.",
    "You need Windows support."
  ],
  "links": {
    "repo": "https://github.com/24X7/riz",
    "releases": "https://github.com/24X7/riz/releases",
    "homepage": "https://riz.dev",
    "install_script": "https://riz.dev/install",
    "llms_txt": "https://riz.dev/llms.txt"
  },
  "author": {
    "name": "Chris Rizzuto",
    "email": "chris@riz.dev",
    "url": "https://linkedin.com/in/ship247"
  }
}