Mésange Bleue
Menu

Hosting for AI agents and appsRuns on AWS, us-west-1

Ship your AI agent with a git push.

Mésange Bleue builds your LangChain agent, Python app or Go service, scans it, and runs it at its own HTTPS address, with a Postgres database, encrypted secrets and searchable logs attached. No Dockerfile, no cluster, no pipeline to maintain.

Create a workspace See how it works
curl -fsSL https://get.mesangebleue.io | sh

Installs the mb CLI for macOS and Linux, no root needed. Windows: PowerShell installer.

$ mb login
$ mb agent create --name support-bot --runtime langchain
# adds a git remote called "mb"
$ git push mb main
# build, scan, deploy
$ mb agent get --slug support-bot
{
  "status": "running",
  "endpoint": "https://support-bot.acme.mesangebleue.io",
  …
}
Fig. 1 A first deploy, from an empty workspace to a public HTTPS endpoint.

How it works

Three steps, and the third one is the one you already know.

  1. Install and sign in

    One command installs mb. mb login opens your browser and sets up git credentials, so there are no SSH keys or tokens to manage.

    $ curl -fsSL https://get.mesangebleue.io | sh
$ mb login

  2. Create the agent

    Run it inside your repository and pick a runtime. The agent's address will be support-bot.<workspace>.mesangebleue.io.

    $ mb agent create --name support-bot \
    --runtime langchain

  3. Push

    Every push to the agent's branch builds, scans and deploys. Watch it in the dashboard or follow the logs from your terminal.

    $ git push mb main
$ mb agent logs --slug support-bot -f

Runtimes

Bring the code you have. We write the container.

The platform detects what you pushed and builds it from a curated set of base images. You choose a runtime and a language version, never a Dockerfile.

agent.py

LangChain agents

Export your LangGraph graph. A built-in harness serves it over HTTP with streaming, a chat page, and conversations that persist in Postgres between turns.

main.py · requirements.txt

Python apps

Any web app that listens on $PORT: an API, a webhook handler, a tool server. Python 3.10 to 3.13; a Procfile sets the start command.

go.mod

Go services

A module with a main package. Built with Go 1.23 to 1.26 and shipped on a minimal distroless image that runs as non-root.

Included

What an agent needs in production, already wired in.

Databases

Managed PostgreSQL

Create a database for your workspace and bind it to an agent. The connection string arrives as an environment variable, DATABASE_URL or any name you pick.

Databases
Secrets

Encrypted secrets

API keys are stored encrypted with AWS KMS and injected as environment variables. Copy them between agents without revealing them; every read-back is audited.

Secrets
Logs

Live tail and search

Follow an agent's output live, even across restarts, or search the archive of app and build logs by text. From the Logs tab or mb agent logs.

Observability
Domains

HTTPS everywhere, your domain too

Every agent gets https://<agent>.<workspace>.mesangebleue.io. Add your own domain with a TXT check and a CNAME; the certificate is issued for you.

Domains and networking
Scaling

Sizes and autoscaling

Pick small, medium or large. Run several replicas, or let CPU load move an agent between a minimum and a maximum you set.

Compute and scaling
Teams

Workspaces with real roles

Invite people to a workspace. Each agent has an owner and contributors: contributors ship, owners and admins manage. API clients cover CI.

Workspaces and teams
For coding agents

A CLI your coding assistant can drive

Commands offer --json output, exit codes are documented, and we publish llms.txt so an AI coding agent can create, deploy and debug apps on your behalf. Sign-in, secret reveals and deletions stay with you.

Private agents

Helpers without a public URL

Mark an agent private and only agents in the same workspace can reach it, at an internal address.

Private agents

Security and supply chain

Every build is scanned. Every fix is yours to accept.

Your agent's dependencies are its biggest attack surface. We pick and refresh the base images, isolate the build, scan what comes out, and keep scanning while it runs.

  1. Curated base images

    Builds start only from our catalog of Python, Go and distroless images, copied into our own registry and pinned by digest. The runtime generates the Dockerfile.

  2. Isolated, unprivileged builds

    Your build steps run without cloud credentials, without privileged containers, and can reach only the package indexes they need: PyPI, the Go module proxy and our registry.

  3. Trivy on every build, and daily

    Each image is scanned for known vulnerabilities in OS packages and libraries when it's built, and running images are re-checked daily against the latest database.

  4. We propose, you review the diff

    The Security tab lists findings with a fix and proposes the change: a dependency bump or a rebuild. You see the exact diff; nothing is committed until you confirm.

  5. Secrets sealed with KMS

    Secret values are encrypted at rest with AES-256-GCM under an AWS KMS key. Reading one back takes the owner's role and a reason, and is logged.

  6. Isolated at runtime

    Agents accept traffic only from the ingress and the platform by default, and traffic between nodes is encrypted with WireGuard.

Read the security overview

Your next agent is one push away.

New workspaces start on the Free plan, with one Python or Go app. Paid plans add agents, databases, custom domains and the LangChain runtime.

Create a workspace Read the getting-started guide