what's in the binary

Six capabilities.
One consistent contract: claim → proof.

Every card ends with the literal test function that proves it. That's the brand: nothing on this site outruns the suite.

[mcp]

Agent-native, zero glue

Every function in riz.toml is a typed MCP tool at /_riz/mcp the moment riz boots — and one [agent] block makes the binary itself a delegable A2A agent. No SDK. No wrappers.

Typed per-route schemas from your route templates; WebSocket functions are session tools
A2A: Agent Card + SendMessage/SSE streaming — riz meshes with riz via [agent.peers]
Bad calls answer -32602 naming the param — agents self-correct

✓ proof: mcp_inspect_against_running_riz_lists_tools_and_spec_version

the agent layer →

[run]

Lambda, without AWS

Exact API Gateway v2 HTTP + WebSocket payloads. Handlers move between AWS and riz unchanged — and back.

Warm pre-spawned pools — no per-request cold start
Real Lambda context: getRemainingTimeInMillis, ARNs
Six runtimes, parity-tested on every HTTP capability

✓ proof: wasm_echo_passes_path_and_query

vs. Lambda & frameworks →

[wasi]

Run code you didn't write

WASM handlers run deny-by-default under wasmtime — and still reach Postgres through capability grants the host enforces.

No sockets, no DSNs in guest memory — ever
Deadlines, rate limits, payload caps, audit — host-side
Neon, Supabase, RDS, any PG: one config row

✓ proof: wasm_guest_brokers_pg_through_capability_grants

sandbox + broker →

[grd]

One guard, every runtime

A .wasm policy screens every request and response — the same module wraps Bun, Node, Python, Rust, Go, and WASM handlers.

guard_in: allow, scrub, or deny before the handler
guard_out: redact PII before bytes leave
Failures fail closed — a broken policy never allows

✓ proof: one_wasm_guard_protects_every_runtime

the guard layer →

[llm]

LLM gateway, built in

OpenAI-compatible endpoint on the same port. Point any client at it by changing base_url.

OpenAI · Anthropic · local Ollama by model prefix
Budget caps that fail closed; per-provider cost ledger
Bearer-gated — never the unauthenticated door

✓ proof: gateway_endpoints_return_401_without_token_when_configured

the gateway →

[ops]

Production substrate, free

You write business logic. The runtime brings the part that usually takes a platform team.

Always-on safety profile per child (rlimits, no-new-privs)
Crash-respawn, liveness, graceful 30s drain
S3 hot-swap deploys with auto-rollback · P50–P99 live

✓ proof: liveness_fault_injection_respawns_within_250ms

lifecycle docs →

claims-as-code Every capability sentence on this site is pinned to a passing test — the claims registry maps claim → proof and CI fails when copy drifts from code. Marketing that can't lie.

where to start

Vibe-code a service.
Ship it production-grade.

Have an LLM write a handler, declare it in riz.toml, and the runtime makes it production — isolation, supervised respawn, graceful drain, live observability — while the agent layer, a WASM sandbox for the generated code, and the LLM gateway come already wired. You write functions; riz brings the substrate. Reach for it first when one of these is you:

# orders.ts — a plain handler
export const handler = (e) => order(e.pathParameters.id)

$ riz run
  ▸ orders ready · MCP at /_riz/mcp

$ curl :3000/orders/1042
  {"id":"1042","total":4299}

$ claude mcp add riz …/_riz/mcp
  ✓ riz · 1 tool: get_order

agent ▸ get_order {"id":"1042"}
  ← {"id":"1042","total":4299}

Give agents safe, typed access to real APIs. Declare a function — that is the integration. Claude, Cursor, or your own agents call it as a typed MCP tool: no wrapper service, no SDK glue.

Run code an LLM wrote. runtime = "wasm" executes untrusted code deny-by-default under wasmtime, reaching Postgres only through host-enforced capability grants.

Run Lambda-shaped functions without AWS. Locally, in CI, or self-hosted — the same handler moves to real Lambda unchanged, and back.

Self-host steady-traffic APIs. No per-request cold start, no per-invocation bill — and you run it always-on as a container (Cloud Run / ECS Express / Azure).

the whole pitch, runnable

Your function.
An agent's tool.

The exact handler you write is the typed tool an agent calls — same code, two views, no SDK or wrapper in between.

1 · A handler you'd write anyway

No framework, no router, no middleware stack to choose. The AWS handler shape you already know — if it runs on Lambda, it runs here.

index.tsbun · node · python · rust · go · wasm

export const handler = async (event) => ({
  statusCode: 200,
  body: JSON.stringify({
    order: event.pathParameters.id,
    status: "shipped"
  })
});

2 · …and what the agent sees

Boot riz, point any MCP client at it. Your route template already typed the tool's input schema — the agent calls it right on the first try.

any MCP clientspec 2025-11-25

# claude mcp add riz --transport http localhost:3000/_riz/mcp

tools/list →
{ "name": "orders",
  "inputSchema": { "pathParams": {
    "id": { "type": "string" }, required } } }

tools/call orders { id: "1042" } →
{ statusCode: 200, body: { status: "shipped" } }

where it sits

Not a framework.
Not someone else's cloud.

A third thing: the Lambda programming model, self-hosted, with the agent layer built in.

	riz	AWS Lambda	Express / FastAPI / Axum
Your code is…	a plain Lambda handler	a plain Lambda handler	routes + middleware + server glue
Per-request cold start	None — warm pools	Yes — infamous	None
Agent tools (MCP)	Automatic, typed, every function	Build it yourself	Bolt on an SDK per app
Process isolation & respawn	Built in + WASM sandbox	Managed (theirs)	Your PM2 / systemd problem
The bill	Your box. $0 per request	Per-invocation, forever	Your box

Full comparison →

Six capabilities.One consistent contract: claim → proof.