Limits

The limits AgentServe applies to stacks, requests and accounts.

Anonymous stacks#

Limit	Value
Lifetime of an unclaimed stack	1h
Shortest TTL accepted	15m
stack.expiring notice	5m before expiry
Unclaimed stacks building or live per IP	3
Snapshot retention after expiry	7 days

• A stack's lifetime is set when it is created, from the request's ttl, then the manifest's, then the default. agentserve extend sets a new expiry counted from now; extensions are capped relative to the stack's creation time, and a request past the cap returns 422 with the latest possible expiry.
• The per-IP cap counts unclaimed stacks whose status is building or live. Expired, failed, deleted and claimed stacks don't count. Over the cap, creates return 429 N unclaimed stacks are already running from your network (limit 3); destroy or claim one first.
• Claimed stacks and stacks created with an API key have no TTL and don't count toward the per-IP cap.

Rate limits#

What	Limit	Key
Anonymous POST /v0/stacks	30 per hour	client IP
POST /v0/claim	10 per minute	client IP
Password forms: sign-in, sign-up and the claim form	10 per minute, shared across the three	client IP

Over a limit, the server returns 429 with {"detail": "too many requests; slow down and retry in a minute"} and a Retry-After header set to the window length: 3600 for creates, 60 for the others. Creates with an API key are not rate limited. The windows are sliding.

Stack size#

Limit	Value
Services per stack	4
Upload size (the compressed archive)	50 MB
Service name	20 characters, [a-z][a-z0-9]*

The service limit applies to every stack, claimed or not. A larger upload returns 413. There is no limit on disk use, memory or CPU per service: see Security model.

Timeouts#

Limit	Value
Each build command (install, build)	600 s
?wait=true on the API	90 s; poll again if the stack is still building
Health check after start	60 s
Proxied request to a service	60 s, 5 s to connect
Webhook delivery attempt	5 s
Builds running at the same time, server-wide	4

The build timeout applies to each command separately, not to the whole build. When ?wait=true runs out, the response returns the stack as it is, usually still building.

Logs and events#

Limit	Value
Runtime log per service	5 MB, then rotated to <service>.run.log.1. One rotated copy is kept. The API and CLI read only the current file.
Build log per service	Overwritten by every build; only the latest build's log exists.
Log lines returned	tail per service: default 200 from the API and MCP, 100 from the CLI.
Events per request	200. Page with after.
Error text	error and deploy_error keep the last 4,000 characters; event payloads the last 1,000.

Logs are deleted with the stack. Event rows stay in the server's database, but a deleted stack's events can no longer be read through the API.

Crash loops#

While a stack is live, the supervisor checks its processes about every 2 seconds. A process that exited is restarted after a backoff of 1, 2, 4, 8 and 16 seconds for successive crashes (capped at 30 seconds), with a service.crashed event before and service.restarted after.

The crash count is per service, over a sliding 10-minute window. On the 6th crash within 10 minutes (more than 5), the whole stack is stopped and marked failed with an error such as api crashed 6 times in 10 min (last exit code 1); check its logs and redeploy. A failed stack serves an error page until it is redeployed. A restart that doesn't become healthy counts as another crash. The count resets after a successful deploy or restore, and when a service is restarted from the dashboard.

Retention#

• When an unclaimed stack expires, its processes stop. Its built services, logs and every service's $DATA_DIR are kept as a snapshot for 7 days (retained_until in the stack object).
• Claiming during that time restores the stack without a rebuild, at the same URLs and with its data.
• When the 7 days are over, the stack is deleted with everything in it, and stack.deleted fires.
• Only the generation being served is kept on disk. Older generations are removed after each successful deploy or rollback, so there is no way to roll back to them later.
• Claimed stacks are kept until their owner deletes them.

Accounts#

Limit	Value
Password length	At least 8 characters.
Dashboard session	30 days.
API keys per account	One. Rotating it invalidates the previous key.