a2a cloud
langgraph, in production

Deploy a LangGraph agent to production.

The LangGraph tutorial ends when your graph runs. Production is the next question: where does state live, who's allowed to call it, how do other agents reach its tools, and how do you prove what it did? a2a cloud hosts the process your graph already runs in — and adds managed Postgres, MCP, authenticated execution entry points, and signed evidence — without moving you onto LangSmith or LangGraph Platform.

your graph · managed DB · signed proof · no lock-in

0%
graph rewrite required
0
signed entry points
0$
idle cost
the problem

'It runs' is not 'it's in production.'

A LangGraph quickstart gets you a StateGraph that executes on your laptop against an in-memory or SQLite checkpointer. Then production asks the questions the tutorial skipped — durable state, authenticated access, tool exposure over a real protocol, cost accounting, and an auditable record of every run. The usual answer is LangGraph Platform or LangSmith, which solves hosting by trading it for lock-in and a trace format you don't own.

Checkpointers default to ephemeral storage — state disappears on restart or scale-down.
The graph's endpoint ships with no real auth, identity, or scoped access control.
Tools are Python functions; other agents can't call them without importing your code.
Observability means a LangSmith trace the vendor holds — not a record you can verify.
the a2a way

One deploy takes the graph the rest of the way.

a2a is framework-agnostic: it deploys the whole agent app around your LangGraph code — database, MCP, gateway, frontend, receipts — so you ship to production without re-expressing your graph in anyone else's runtime.

Your graph, unchangedManaged Postgres for stateAn MCP server, for freeOpenAPI gateway + authSigned execution evidenceScale-to-zero containers

Your graph, unchanged

Keep your StateGraph, nodes, edges, checkpointer, and tools exactly as written. a2a hosts the process — it doesn't rewrite your LangGraph app or ask you to re-express it in someone else's runtime.

Managed Postgres for state

LangGraph wants a real database for checkpoints and long-term memory. One deploy provisions a managed Postgres and wires the connection — no separate DB to stand up, no SQLite-in-a-container that vanishes on restart.

An MCP server, for free

Your graph's tools are exposed as a hosted MCP server, so other agents and MCP clients can call them over a real protocol instead of importing your Python.

OpenAPI gateway + auth

The graph gets an authenticated HTTP endpoint through an OpenAPI gateway — Keycloak-backed identity, TLS, and scoped grants — instead of an unguarded FastAPI route you bolted on yourself.

Signed execution evidence

Agent API calls plus public /invoke and standard MCP tools/call executions receive signed receipts for observed caller classification, input evidence, outcome, and timing. Only authenticated Agent API paid calls have linked economics; gateway receipts record zero.

Scale-to-zero containers

The hosted graph runs as a Knative container service that scales to zero when idle. Explicit code-execution commands can use a separate microsandbox microVM through ctx.sandbox.

side-by-side

Raw LangGraph deploy vs. a2a.

runtime

langgraph platform / diy

LangGraph Platform / LangSmith host your graph — on their runtime, their trace format, their lock-in.

a2a cloud

a2a hosts the process your graph already runs in. Framework-agnostic — no forced migration.

state

langgraph platform / diy

Checkpointer points at SQLite or a DB you provision, secure, and back up yourself.

a2a cloud

Managed Postgres provisioned and wired in the same deploy — durable checkpoints out of the box.

auth

langgraph platform / diy

The graph's endpoint ships with whatever auth you remembered to add — often none.

a2a cloud

OpenAPI gateway with Keycloak identity, TLS, and scoped grants. No ambient trust.

observability

langgraph platform / diy

Traces live in LangSmith; the vendor holds your record of what the agent did.

a2a cloud

Agent API, public /invoke, and standard MCP tools/call executions produce Ed25519-signed evidence.

cost

langgraph platform / diy

A warm container bills by the hour whether or not the graph ran.

a2a cloud

Scale-to-zero Knative service — you pay per invocation, idle costs nothing.

questions

Frequently asked.

How do I deploy a LangGraph agent to production?

Point a2a cloud at your LangGraph project and run one deploy. It hosts the graph in a Knative container service, provisions managed Postgres, and exposes tools over MCP. Agent API, public /invoke, and standard MCP tools/call executions are signed by trusted control-plane paths.

Do I have to use LangSmith or LangGraph Platform?

No. a2a is framework-agnostic — it hosts the process your LangGraph app already runs in rather than a proprietary runtime. You keep observability as signed receipts you can verify yourself, so there's no LangSmith trace lock-in and no vendor holding your record of what the agent did.

Where does LangGraph state and memory get stored?

In a managed Postgres provisioned in the same deploy. Your checkpointer and long-term memory point at a durable database instead of ephemeral SQLite, so state survives restarts and scale-to-zero without you standing up or backing up a DB.

Does my graph keep working the same way?

Yes. Your StateGraph, nodes, edges, conditional routing, checkpointer, and tools run as written. a2a owns the surrounding production concerns — database, auth, MCP, frontend, receipts — so you deploy the whole agent app without re-architecting the graph.

How does scale-to-zero work for a LangGraph agent?

The hosted graph runs as a Knative container service that scales to zero when there is no traffic and wakes on the next request. Code explicitly sent through ctx.sandbox uses a separate microsandbox boundary; the graph process itself is not a per-run VM.

keep reading

Related guides.

All guides live in the guides index.

don't trust the agent

Ship the graph. Keep the proof.

a2a cloud deploys any agent — LangGraph, OpenAI Agents SDK, CrewAI, or custom — with managed Postgres, MCP and API surfaces, and a frontend. The control plane signs authenticated Agent API calls; trusted ingress signs public /invoke and standard MCP tools/call executions. Connector MCP and formal A2A task routes are outside that coverage.