Rayrun Client Workspace Setup (Onboarding)

Rayrun Client Workspace Setup (Onboarding)

1. 01

   Create the client workspace in Rayrun and invite the client's technical contact as a member

   The Team plan at $25 monthly includes roles and client-specific access, so the client contact gets scoped permissions rather than workspace-wide visibility. Keep the agency owner as admin.

2. 02

   Add the upstream service for this client: remote MCP, OpenAPI spec, npm package, or container image

   One upstream service per client keeps the credential boundary clean. If the client insists on holding their own keys, store credentials in the client's AWS account instead of the shared vault.

3. 03

   Store upstream credentials in the shared credential vault and confirm the client only receives a Rayrun token

   The vault is what stops API keys from being pasted into client Slack channels or committed to their repos. Verify the client's token cannot be exchanged for the upstream secret.

4. 04

   Define per-tool access rules with allow, ask, or block for each tool the client's workflow needs

   Rules are decided per service, tool, and argument. Start restrictive: allow read tools, ask on write tools, block anything touching billing or destructive endpoints until the client signs off.

5. 05

   Deploy with rayrun deploy and watch validation, build, and release status stream to completion

   Confirm the non-root container and rollback image behaviour before handing the endpoint over. A failed build here is cheaper than a failed client demo.

6. 06

   Connect the client's chosen client (Claude, Cursor, VS Code, or Windsurf) to the single Rayrun endpoint URL

   One URL for every connected tool. Walk the client through adding it in their editor of choice during the onboarding call rather than sending a PDF.

7. 07

   Run a test tool call and open the activity history to verify caller identity and applied policy are recorded

   The Free tier keeps 30 days of activity history; Team extends it. Confirm the log shows the client's identity and the exact rule that fired before you close onboarding.

8. 08

   Set the client's monthly tool-call budget and document the overage conversation

   Team includes 100,000 tool calls per developer a month, pooled. At USD 0.2 per 1,000 calls beyond that, a runaway agent loop is a real invoice. Agree in writing who pays for overages.