Separate the worker from the decisions
An agent can plan a task while a queue controls when a worker executes it. This makes retries visible and prevents a brief API failure from becoming a duplicate action. Give each job an identifier and record the state transitions that matter.
Treat tools as privileges
A process that can send email, spend money or write to production needs narrower credentials than a research worker. Use separate service accounts, per-tool permissions and explicit approval steps for consequential actions. Never place private keys in prompts or browser-accessible files.
- Keep secrets outside the web root and version control
- Use spending and request limits for external APIs
- Retain an auditable record without storing unnecessary personal data
Design for a stopped process
Use a service manager or container runtime, health checks and a bounded restart policy. An agent should resume from saved state rather than repeat the last external action blindly. Monitor disk growth, queue age and error rates, not just whether the process exists.
Right-size the machine
A worker calling a remote model often needs modest CPU and enough memory for its tools. Browser automation can use considerably more RAM. Local model inference has separate memory and accelerator requirements; a general VPS does not imply an attached GPU.
Provisioning workflow design
An agent integration workflow can inspect public plans, register an account and prepare a service order within an explicit spending limit. Payment and server creation require the appropriate authorisation. It should receive an operation identifier, wait for the completed state and then manage the server with its own public SSH key. Teardown must be intentional and preserve needed results.
Events instead of impatient polling
Signed webhooks can report payment settlement and lifecycle changes. Verify their authenticity, deduplicate deliveries and reconcile with the API before taking the next action. The provider should not receive the agent’s private SSH key, wallet seed or unrestricted model credentials.
Turn one task into one durable operation
Give each job a stable identifier and explicit states such as queued, running, awaiting approval, completed or failed. Save the result of an external action before acknowledging it to the planner. A restarted worker should inspect persisted state rather than replay a payment, message or production write because its terminal output was lost.
Provisioning tools and hosted workers are separate products
A VPS can run a customer’s agent continuously using its own service manager and credentials. A hosting control-plane API or MCP endpoint is a different integration. The first can be deployed as an application; the second requires a separately released KoalaVPS control-plane integration and is not connected by this documentation.
Budget for the complete worker
Reserve memory for the browser, model client, queue and database together. A small API-driven worker may need modest CPU while concurrent browser sessions exhaust RAM quickly. Set queue concurrency and external API spending limits before increasing the machine size. No model subscription, accelerator or third-party API allowance is included by implication.
A useful operational handover
Record the startup command, working directory, protected environment location, restart policy, queue storage, health check and owner of each external credential. Include the action that safely stops new jobs and the path for resuming unfinished ones. Monitoring should identify delayed or duplicate work as well as a process that has stopped.
A little more clarity.
Does an agent VPS include an AI subscription?
No model subscription or API credit is implied. Connect a provider you are authorised to use and keep its credential in private server configuration.
Can agents perform sensitive actions automatically?
That is a design decision for your application. Strong limits, human approval where appropriate and reliable duplicate prevention are recommended.
Does agent hosting include automatic access to my other accounts?
No. Each tool or provider requires a separately authorised credential and a clear permission boundary.