Rat Things is a self-hosted control plane for AI agents. It runs per-session EC2 or Lambda MicroVM workers in your own AWS account, plus a local workspace on your computer. It is built for developers making coding agents and services that need saved work, isolated execution, and control over their infrastructure. It is released under the MIT license.
Rat Things saves conversations and work so you can come back later, continue after a worker stops, or run tasks on a schedule. You can drive it from a native Rust desktop app, a CLI, or an interface compatible with the OpenAI Agents API, so the official OpenAI SDK can talk to a deployment you own.
You can start at home. Local Sessions run on your computer with private storage, using Codex or Pi Durable with your ChatGPT subscription. When you are ready for the cloud, a single quickstart command checks your AWS identity and model access, asks before deploying, and sets up Bedrock, private AWS endpoints, and no public runtime egress by default. An optional AWS spending alert can be added at install time.
Two runtimes are supported. Codex is the default, and Pi Durable can be selected per Session. Pi Durable saves conversations, pending tasks, and tool results, and a replacement worker can recover committed work without depending on the original machine.
Other features described in the project README:
- Session forks: branch a prepared Session into independent conversations and workspaces, try different approaches, and discard the ones you do not need.
- Provider events: authenticated GitHub, GitLab, Slack, and Teams events can start or continue Sessions, such as pull request reviews that keep context for follow-up comments.
- Schedules with time zones and overlap policy.
- A watchdog that reports stalled work and retries eligible transient failures once.
- Vault credentials, so workspace commands use placeholders while the host supplies secrets to allowed hosts.
On security, the agent process runs as a separate non-root user inside a Lambda MicroVM or dedicated EC2 worker, worker ingress is private, prompts and results live in encrypted S3, and integration credentials stay behind host-side brokers. Capabilities are fixed before launch.
Rat Things is an engineering preview. The repository documents current capabilities and limits, and includes comparison guides against E2B, Daytona, Modal, and Bedrock AgentCore.
Repo (MIT): https://github.com/gpazo/Rat-Things
Top comments (1)
Self-hosting changes the trust boundary but does not remove the need for governance. The control plane should make agent identity, tool grants, execution history, and revocation first-class records; otherwise the infrastructure is private while the decisions remain hard to audit.