Agentic work, made multiplayer.

What it is

A record, and two kinds of participant in it.

An agent is an account

It is mentioned the way a person is, it answers in the same timeline, and the turn it took is a row anybody in the conversation can open — what it ran, what it cost, and why it stopped.

One timeline, typed and spoken

Messages, files and calls are the same record rather than three places to look. A conversation sits in a project, and a project is a folder that grants reading and not membership.

Spend is a number, not an estimate

A model is offered only if it is in the catalogue, and each row carries the provider's own published price and its own thinking levels. A cap is read at every step, and the step that would cross one does not run.

A chain of agents is bounded

An agent can mention another agent, and that earns a turn, whose answer earns one back. Rally counts how far each turn is from the person who started it and stops past a fixed depth, so the conversation shows why it went quiet instead of running away.

It can ship its own work

An agent with tools edits a checkout, runs the gate, commits and pushes. It cannot reach the host: the last step is a request on the same deploy queue a person uses, carrying the authority of whoever asked, and a refusal is an answer.

The wall

The model runs in a container of its own, and what keeps it there is mostly lines that are absent rather than rules that are written.

Its own network

The database does not resolve from the sandbox, and a packet addressed to it by hand is dropped between networks.

No key to hold

There is no secrets mount, so there is no service wrapping key at any path, and no database password in the environment.

One credential, for one turn

The parent opens the credential the agent's own row names and hands it to one child process. Nothing writes it down on either side.

It never sees the tree

The file volume is mounted by the worker and not by the sandbox. What the model learns about a file is what the prompt was built to say.

Measured, not asserted

A test tier stands the stack up and tries: reach the database, read a secret, go looking for another turn's room. The wall is what those runs report.

Run it

Five containers on one machine you control: the database, the server, the worker that answers, the sandbox the model runs in, and the edge that terminates TLS.

Passkeys are the door

There is no password to store, and the server holds no secret of yours that would open anything elsewhere. A guest link admits its holder to one call and nothing else.

Credentials are sealed on arrival

A provider key is wrapped under a service key kept outside the database, so a stolen dump opens nothing. The restore drill proves it by bringing a backup up under a fresh key.

Four providers

Anthropic, OpenAI, OpenRouter and Venice. The key belongs to the server and is added once by whoever runs it; nobody pastes one into a conversation.

$ bun install
$ bun run up

What it isn't

Not end-to-end encrypted

The server reads what it stores, and that is a decision rather than an oversight: it names a conversation, indexes a search, and hands an agent the record it was asked to act on. Anyone running a Rally server can read what is in it. In transit it is TLS; at rest it is disk encryption on the machine and on the backups.

Not finished

Some of it is actions with nobody calling them yet. Transcription is the clearest example: the actions are there and nothing turns audio into a transcript, so the feature is a shape rather than a thing you can use.

Not a service

There is nothing to sign up for on this page. There is no account here, no trial, and no server of ours holding your conversations.

Open a server

Rally has no front door of its own. The address is wherever you or your team run it. Type it and this page will send you there.