Read-only repository analysis
Detect frameworks, build commands, environment requirements, and deployment shape in an isolated checkout without changing the worktree, remotes, or history.
Open source · Independent operations agent
AgentMesh DeployHand product launch to an operations agent with hard boundaries.
When development is done, hand the Git repository to AgentMesh Deploy. It locks the commit, analyzes the stack, selects providers, and compiles a plan. Real changes happen only after you approve cost, database migration, DNS, and production cutover. Product repositories stay read-only; deployment state stays in an independent control plane.
- Apache 2.0
- Node.js 20+
- 611 release tests
- GitHub Release v0.2.0
Why it exists
Code complete is not the same as live.
Domains, servers, databases, email, environment variables, CI/CD, migrations, health checks, and rollback are scattered across vendor consoles. AgentMesh Deploy turns them into one reviewable, approvable, recoverable release chain.
Independent control plane
One Deploy Agent can operate many products.
AgentMesh Deploy does not install a sidecar into product repositories. It creates an isolated checkout from a locked commit and stores Manifest, Plan, Approval, Evidence, and Run objects in an external Control Home. Required source changes are emitted only as patch proposals.
Product repositories are read-only inputs. Provider changes require external plans, approvals, and evidence.
Core capabilities
From a source snapshot to a verified live result.
Every action binds the same Commit, Graph, and plan fingerprint. After interruption, the agent reconciles provider facts before deciding whether to resume or hand control to a human.
Compiled provider plans
Turn a high-level launch configuration into deterministic runtime, database, DNS, and email adapter actions.
Separate risk gates
Network, provider mutations, cost, database migration, and production cutover are authorized independently.
Evidence before migration
Inspect schema, classify SQL, capture snapshot or backup evidence, then apply a migration bound to the expected target version.
Exact DNS and email changes
Coordinate site routing and Resend domain records through reviewed change sets without fuzzy matches or unrelated record replacement.
Crash-safe continuation
Persist intent before mutation and receipt after it. Resume reconciles existing resources before any replay.
Provider adapters
One workflow across six core providers.
v0.2.0 publishes six core adapter contracts. Credentials are consumed only through Secret Refs; tokens, connection strings, and private keys never enter plans, runs, state, or logs.
VercelFrontend / Preview
RailwayRuntime / Service
NeonPostgres / Branch
SupabaseBackend / Database
CloudflareDNS / Edge
ResendEmail / Domain
Human-agent boundary
The agent runs the workflow. Humans keep final authority.
Automation should remove repetitive cross-vendor work, not remove accountability. Humans remain only at decisions that carry identity, money, data, or production risk.
Agent handles
Discovery and planning
Analyze source, inspect provider capabilities, compare architecture options, and calculate expected resources and mutations.
Human confirms
Accounts and credentials
Create vendor accounts, complete identity or payment steps, issue least-privilege tokens, and choose a secret backend.
Agent handles
Candidate environment and verification
Create isolated projects, deploy the locked commit, and verify HTTPS, API, database version, and email-domain state.
Human confirms
Cost and data risk
Approve paid plans, domain purchases, migrations, restores, and any operation that may affect existing data.
Agent handles
Evidence, resume, and rollback plans
Persist immutable receipts, detect drift, reconcile uncertain writes, and generate exact recovery steps.
Human confirms
Production cutover and deletion
Approve production DNS, real email sending, traffic cutover, resource deletion, and destructive database operations.
First launch
Let your development agent perform an operations handoff.
The CLI returns structured nextActions. A receiving agent does not need to guess the next command or improvise across six vendor consoles.
01
Register the product
Provide a local repository or remote Git URL. AgentMesh Deploy records the source and locks an immutable commit.
02
Analyze and choose a route
Detect the stack, compare Vercel, Railway, Neon, and Supabase options, then ask you to approve provider and budget choices.
03
Connect restricted credentials
Create least-privilege tokens following CLI guidance and store only references to Keychain, 1Password, or another backend.
04
Deploy a candidate
After Sandbox Profile, Approval, and Preflight, create isolated resources and verify the locked commit.
05
Approve production cutover
Review database, DNS, email, and rollback evidence before any production change.
agentmesh-deploy · GitHub Release install
$ gh release download v0.2.0 --repo jiyangnan/AgentMesh-Deploy-Agent --pattern 'agentmesh-deploy-*.tgz' $ npm install --global ./agentmesh-deploy-0.2.0.tgz $ agentmesh-deploy version 0.2.0 $ agentmesh-deploy project add --repo /path/to/product --id my-saas --name "My SaaS" --json $ agentmesh-deploy analyze my-saas --json nextActions → review configuration → connect providers → sandbox preflight
Common questions
FAQ.
Will it write files into my product repository?
V2 does not by default. The product repository is a read-only source and deployment state lives in an external Control Home. Required code changes are emitted as patch proposals for the repository owner.
Do I need an AgentMesh360 account?
No. AgentMesh Deploy is an Apache 2.0 open-source CLI. You need accounts and least-privilege credentials for the providers you choose, and provider costs remain on those accounts.
Can it buy domains, upgrade plans, or switch production traffic automatically?
It can plan and guide those workflows, but it never performs them by default. Purchases, paid upgrades, database risk, production DNS, email sending, cutover, and deletion each require explicit current authorization.
Where are credentials stored?
Persistent objects store only Secret Refs such as
keychain://, op://, or custom secret:// references. Raw values never enter Plan, Run, State, Receipt, or logs.Can an interrupted run create duplicate resources?
Mutations persist intent before the call and a receipt after it. Resume checks provider facts first and replays only when the resource is proven absent and the budget still allows it.
Start the handoff
When the next product is built, hand launch to the Deploy Agent.
Read the installation and agent guidance in the public repository. Start with read-only analysis and a sandbox before approving real provider changes.