Implementation BlueprintExecution layer

Rayrun Client Onboarding Sprint (5-7 days)

Stand up a client's first MCP server behind a Rayrun endpoint so their AI tools reach upstream services through one URL while credentials stay in Rayrun's vault. The sprint ends with per-tool access rules, activity logging, and a handoff the client's team can operate. Time: 5-7 days.

By InnovaAI ResearchPublished Updated

AI Agents

How do you implement it?

Blueprint

Rayrun Client Onboarding Sprint (5-7 days)

Stand up a client's first MCP server behind a Rayrun endpoint so their AI tools reach upstream services through one URL while credentials stay in Rayrun's vault. The sprint ends with per-tool access rules, activity logging, and a handoff the client's team can operate.

Prerequisites
  • Agency Rayrun workspace already deployed once internally, so build and release streaming behaviour is known before a client is involved
  • Client's upstream service credentials or a written agreement that Rayrun will hold them in its encrypted vault
  • One named client workflow to expose, plus the OpenAPI spec, remote MCP URL, npm package, or container image that backs it
  • Client-side admin who can approve allow, ask, or block rules per tool and per argument
  • A coding agent (Claude Code, Codex, Cursor, VS Code, or Windsurf) available for scaffolding the MCP project
Execution Timeline
  • 1.Create the client workspace in Rayrun and confirm the free tier covers the pilot: up to 25 source-built services and 50,000 tool calls a month
  • 2.Run rayrun init to scaffold a TypeScript or Python MCP project for the client's first workflow
  • 3.Map the client's upstream service to a deployment path: remote MCP, OpenAPI spec, npm package, or container image
  • 1.Store upstream credentials in Rayrun's encrypted vault or in the client's own AWS account so the client only ever receives a token
  • 2.Deploy with rayrun deploy and watch validation, build, and release status stream to completion
  • 3.Verify the non-root container and the 30-day rollback image before exposing anything to the client
  • 1.Define per-service, per-tool, and per-argument rules using allow, ask, or block
  • 2.Set the client's read-only tools to allow and any write or spend tool to ask so a human approves before execution
  • 3.Test each rule from the client's own client application, not from the agency's admin session
  • 1.Connect the client's AI client (Claude, Cursor, VS Code, or Windsurf) to the single Rayrun endpoint
  • 2.Confirm every tool call records caller identity and the policy that was applied
  • 3.Walk the client admin through the activity history view and show how to read a blocked call
  • 1.Run a live rehearsal of the client's real workflow end to end and log the tool calls it produces
  • 2.Tune ask rules that fired too often and loosen allow rules that blocked legitimate work
  • 3.Record the walkthrough video and write the handoff guide covering credential rotation and rollback
  • 1.Hand the workspace to the client admin and confirm they can add a second tool without agency help
  • 2.Agree the monthly tool-call ceiling the client will stay under and how overage is billed back
  • 3.Close the sprint with a written policy summary the client can hand to their own security reviewer
USD 0 on the Free plan for a single-developer pilot (up to 25 source-built services, 50,000 tool calls a month, 30 days of activity history). Move the client to Team at USD 25 per month when shared credential vault, roles, client-specific access, and pooled 100,000 tool calls per developer a month are needed. Tool-call overage runs at USD 0.2 per 1,000 calls.5-7 days
ROI Logic

A USD 1,800 Starter MCP Deploy at 16 hours of setup is roughly USD 112 per hour, and the client's ongoing Rayrun cost is USD 0 to USD 25 a month plus USD 0.2 per 1,000 tool calls. Margin holds while the client stays under the pooled call allowance; once a client crosses 100,000 calls per developer a month, the overage lands on the agency unless the retainer names a ceiling. Price the retainer with a stated call band so usage spikes do not eat the delivery fee.

Deliverables
  • Client Rayrun workspace with one deployed MCP server reachable through a single endpoint
  • Written access policy listing every tool and argument set to allow, ask, or block
  • Activity log export showing caller identity and applied policy for the pilot workflow
  • Handoff guide and walkthrough video covering credential rotation, rollback images, and adding a second tool
  • Monthly tool-call ceiling and overage terms attached to the client retainer
Definition of Done

The client's AI client reaches every agreed tool through the Rayrun endpoint, each call is logged with caller identity and applied policy, and the client admin can add or restrict a tool without agency involvement.

Open the Rayrun courseRayrun decision recordBrowse the Academy

More on Rayrun

More for AI Agents