AgentRaaS 0.20.0

Indian brokers: Upstox and Dhan. Agents can place, modify and cancel NSE/BSE orders through AgentRaaS with the same guardrails as Alpaca: each order runs once, side, product, order type, validity and segment are checked before the broker sees the order, and undo cancels a placed order. Combine them with 0.19.0's allowed hours (09:15 to 15:30 Asia/Kolkata) and daily caps.

Under SEBI's retail algo framework, brokers accept API orders only from a static IP registered with them, with a login token renewed every trading day. So live Indian orders need self-hosted AgentRaaS on a server with a static IP; the trading guide shows a morning script that saves the day's token. See https://agentraas.io/trading#india. This is not trading advice; check the current SEBI and broker rules before going live.

Also: an alert channel that rejects a message (a deleted Teams workflow, a revoked bot) is now logged instead of failing silently.

Self-hosted upgrade: git pull && ./install.sh (no new migration).

AgentRaaS 0.19.0

Daily money caps. A spend cap can now add up a payload field per hour or day, for example "no more than 10,000 in notional a day" or "500 in refunds a day", alongside or instead of a call count. A call without a number in that field is refused, so leaving the field out can't skip the cap, and a refused call doesn't use up the budget. A cap can name a time zone, so its day starts at local midnight.

Allowed hours. An action policy can allow calls only inside set hours, for example weekdays 09:30 to 16:00 America/New_York, or 09:15 to 15:30 Asia/Kolkata. Daylight saving is handled. Outside the hours the call is blocked, or held for approval.

Both work in the dashboard (Rules), the API and agentraas apply. The trading guide uses them: https://agentraas.io/trading

Self-hosted upgrade: git pull && ./install.sh. It keeps your .env, rebuilds, and runs the new migration (060).

AgentRaaS 0.18.0

Approve held calls from anywhere. A call held for approval now sends a one-time link to every alert channel: Microsoft Teams, Telegram, email, Discord and Slack webhooks, alongside the Slack app. Opening the link only shows the request; the Approve or Deny button decides, so link previews can't approve anything. Held calls can also be approved from the dashboard (Monitor → Waiting for approval). The first decision wins, from any channel.

Limits hold for numbers sent as text. A policy limit or approval threshold now also applies when the number arrives as a string ("5000"). Before, a quoted number skipped the limit. Stripe form fields and Alpaca quantities arrive as strings, so this could happen without anyone trying. Upgrading is recommended.

Trading agents. Alpaca paper and live trading are built-in services: each order runs once, limits and allowed symbols are checked before the broker sees the order, and large orders wait for approval. See https://agentraas.io/trading.

One key, every service. An agent's AgentRaaS key works for every service you connect, and the dashboard now reuses it instead of creating a key per service. New per-key switches limit a key to chosen services.

Also: Teams and email alert channels; dashboard charts follow the org filter; new pages for Cloud, self-hosting, the community (GitHub Discussions) and trading.

Self-hosted upgrade: git pull && ./install.sh. It keeps your .env, rebuilds, and runs the new migrations (058, 059).

v0.9.2

Security

• DNS rebinding past the SSRF guard. A destination URL was checked when
  it was resolved, but the HTTP client resolved it again on its own, so a
  record with a zero TTL could pass the check and then connect to a private
  address. The client now drops private and reserved addresses itself, at
  connect time.
• /api/v1/public/execution-ledger (unauthenticated) ran a 24-hour count
  on every request. It is now computed at most once a minute.

Fixed

• A resource_id lock is released when the call finishes. It used to be
  held for its full 15 seconds, so a follow-up action on the same resource
  got a 409. It is still held until it expires when the upstream's outcome
  is unknown (a timeout after sending).

No migrations.

Image: ghcr.io/sumedhchatse/agentraas:0.9.2. Full history: CHANGELOG.md.

v0.9.1

Security

• MCP tool calls skipped action policies and spend caps. A call made
  through /mcp was forwarded even when a deny policy, the no_secrets /
  new_destination guards or a spend cap should have stopped it. MCP now
  runs the same checks as the webhook path; a rule that would ask for human
  approval blocks the call over MCP. Upgrade if you use action policies or
  spend caps with MCP clients.
• Calls held for approval stored the agent's raw API key in
  hitl_requests. They now store a prefix and SHA-256 only.
  Migration: run 051_hash_held_call_keys.sql.
• SSO discovery and the Slack approval callback now go through the SSRF
  guard: an org admin could otherwise point the server at an internal
  address.
• Security headers on every response (X-Frame-Options: DENY, nosniff,
  Referrer-Policy, HSTS in production).
• rustls 0.23.45 (RUSTSEC-2026-0285).

Fixed

• MCP audit rows recorded every agent as mcp-agent instead of the
  verified agent id.
• An internal error in the circuit-breaker, usage or spend-cap check left
  the call's dedup slot claimed, so an identical retry got 409 until the
  lease expired.

Image: ghcr.io/sumedhchatse/agentraas:0.9.1. Full history: CHANGELOG.md.

v0.9.0

First versioned release. It covers everything shipped up to this date; the
server's /health response now includes its version.

Added

• /metrics in Prometheus text format: agentraas_calls_total and the
  agentraas_call_duration_ms histogram, labeled by service and outcome.
  Off unless METRICS_TOKEN is set; scrape with it as a bearer token.
• OpenTelemetry export of every handled call as an OTLP span
  (OTEL_EXPORTER_OTLP_ENDPOINT, OTEL_EXPORTER_OTLP_HEADERS).
• Action policies (allow, deny, require approval per service and action)
  and the prompt-injection guard (no_secrets, new_destination).
• Timeout-safe forwarding: every forward sends
  Idempotency-Key: agentraas-<dedup hash>; a call that times out after
  sending is recorded as "outcome unknown", kept in its dedup slot and never
  retried automatically. PROXY_TIMEOUT_SECONDS (default 30).
• Crash recovery for in-flight calls: dedup claims carry a lease.
• Spend and call caps per agent, schema drift detection, a local dev tunnel,
  dead-letter queue with replay, circuit breakers, human approval (HITL).

Security

• Client IP for rate limiting is read only from CLIENT_IP_HEADER;
  X-Forwarded-For is no longer trusted.

Changed

• compose.yaml pulls MinIO from cgr.dev/chainguard/minio (runs as root
  so existing data stays writable). MinIO's own registries now refuse
  anonymous pulls.

Migrations

• Up to 050_known_destinations.sql. On an existing install, apply any of
  046 to 050 you have not run yet.

Image: ghcr.io/sumedhchatse/agentraas:0.9.0. Full history: CHANGELOG.md.