{ "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-10", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "tool": { "slug": "hatchet", "name": "Hatchet", "vendor": "Hatchet Technologies, Inc.", "vendorUrl": "https://hatchet.run", "kind": "platform", "category": "human-in-the-loop", "summary": "Hatchet is an open-source (MIT) platform for durable tasks, queues and workflows, sold as Hatchet Cloud or self-hosted. A durable task can pause until an event arrives, which is its building block for human approval steps.", "url": "https://www.anchorterminal.com/tools/hatchet", "markdownUrl": "https://www.anchorterminal.com/tools/hatchet.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/hatchet.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/hatchet.json", "repo": "https://github.com/hatchet-dev/hatchet", "license": "MIT", "transports": [ "http", "stdio" ], "remoteUrl": "https://cloud.hatchet.run", "packages": [ { "registry": "pypi", "name": "hatchet-sdk" }, { "registry": "npm", "name": "@hatchet-dev/typescript-sdk" }, { "registry": "go", "name": "github.com/hatchet-dev/hatchet" } ], "auth": "api-key", "authNotes": "Self-serve. A person signs up at cloud.hatchet.run and creates an API token in Settings, scoped to one tenant with a configurable expiry. SDK clients, workers and the REST API send it as a Bearer token. The MCP server reads tokens from CLI profiles the user granted. Embedded mode runs a local engine with no token.", "pricing": "freemium", "pricingNotes": "Hatchet Cloud is pay as you go from $0, and the plan without a card includes 1 million runs and 1 million events a month, capped at 2,000 of each a day, so an agent's owner can start without a contract. Beyond that, $30 per million runs and $5 per million events. Enterprise is priced by sales. Self-hosting is free under MIT (https://hatchet.run/pricing).", "priceSummary": "$0.03 / 1k calls", "where": "both", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the docs index, the OpenAPI file or the pricing page (checked 2026-10-09).", "endpoints": [] }, "toolCount": 7, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-09" }, "docsUrl": "https://docs.hatchet.run/v1/durable-event-waits", "llmsTxt": "https://docs.hatchet.run/llms.txt", "openapi": "https://github.com/hatchet-dev/hatchet/blob/main/api-contracts/openapi/openapi.yaml", "capabilities": [ "hitl.approve", "hitl.ask", "agent.durable", "automation.workflows", "automation.code" ], "tags": [ "hosted", "self-hosted", "open-source", "freemium", "free-tier", "mcp", "openapi", "llms-txt", "python", "typescript", "go", "durable", "webhooks", "idempotency", "hipaa" ], "lastRelease": "2026-10-08", "graded": true, "anchor": { "graded": true, "score": 68.3, "grade": "B", "agentReady": false, "rank": 225, "ranked": true, "rankOf": 950, "categoryRank": 4, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 82, "maintenance": 90, "payments": 40, "reliability": 66, "schema": 85, "security": 62, "transparency": 71 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 66, "points": 13.2, "reason": "Graded as Hatchet Cloud, with the hosted lines. Status page at status.hatchet.run on Better Stack with three components (20). Its incident list, which reaches back to August 2026, shows one incident, about nine hours of elevated latency and delayed task processing on one shared shard in us-west-2 on 22 August 2026. Other shards and regions were unaffected, so we score it between minor and major (15 of 30). The pricing page gives plan quotas with numbers (2,000 runs a day without a card, worker slots, queue backlog) and the docs give a 4 MB payload limit, but no request rate for the API was found (8 of 15). The docs say which errors each SDK retries, the Go SDK honours `Retry-After` on 429, the OpenAPI file lists 429 on event creation, and idempotency keys are generally available (12 of 15). SLAs are named for the enterprise plan only and no SLA document is published (3 of 10). Event waits carry no beta label, the SDKs are 1.x except Ruby at 0.9.0, and the platform version is still 0.x (8 of 10)." }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 85, "points": 13.81, "reason": "OpenAPI 3.1 file in the repository with 147 operations, and typed inputs on all seven MCP tools (25). llms.txt on the docs host (10). The docs say when to use a durable task and when a DAG, and warn about determinism. The MCP tool descriptions are one line each and do not say when not to use a tool (14 of 20). Typed SDK signatures with an optional payload validator and 56 enums in the API schemas, but event data and MCP run input are free-form objects (11 of 15). Code samples in four languages. The API file has few examples, and no rendered REST reference was found in the docs index (10 of 15). Dated changelogs for the platform and each SDK, and `/api/v1/stable` paths (15)." }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 82, "points": 13.33, "reason": "Seven compact MCP tools, and list endpoints with limit and offset (23 of 25). Events list by key, workflow, status and search text (18 of 20). Errors return a code, field, description and docs link, though no list of codes was found (14 of 20). Idempotency keys by TTL or status, and scope with a lookback window against a race between push and wait. No MCP tool sets `readOnlyHint` or `destructiveHint` (12 of 20). A wait needs only an event key, and there are official SDKs in four languages (15)." }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 62, "points": 10.85, "reason": "API tokens per tenant with a configurable expiry, created and revoked through the dashboard or API. No narrower scopes, and the docs say tokens are not restricted by role or payload visibility (20 of 30). A read-only VIEWER role, a per-member payload flag and deny-by-default profile grants for the MCP server, with no read-only token and no confirmation before `trigger_run` or `replay_run` (11 of 20). Event payloads from webhooks are untrusted content. Hatchet has payload validators, CEL filters and webhook checks by HMAC, API key or basic auth, and no prompt-injection guidance was found (8 of 15). Audit logs with actor, action, IP address and time on Business plans and above, kept 30 days. Event pushes are not among the documented actions (9 of 15). SECURITY.md with private GitHub advisories and security@hatchet.run, advisories published with CVE IDs, SOC 2 Type II, HIPAA and independent testing stated in the docs. No bug bounty (SECURITY.md says so), no security.txt, and the trust centre was not readable (14 of 20)." }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 40, "points": 5, "reason": "No machine payment protocol (0). Per-unit prices published without a login, $30 per million runs and $5 per million events (20). The pay-as-you-go plan starts at $0 without a card (20). A person signs up in the browser for the cloud. Embedded mode needs no account but is local software for development (0)." }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 90, "points": 7.88, "reason": "Platform v0.110.19 tagged on 8 October 2026 (30). Tags on most working days in September and October, and five dated changelog entries between 25 August and 5 October (20). Issue reply times were not sampled. There is a Discord, a stale-issue workflow and a changelog (15 of 25). Current official SDKs, Python 1.41.1 on 24 September and Ruby 0.9.0 on 5 October 2026. The MCP server is not in the official registry (15). CI workflows for tests, each SDK, lint and an OSV scanner (10)." }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 71, "points": 6.21, "note": "editorial 69, provenance 72", "reason": "MIT (30). The privacy policy of 18 August 2026 gives retention periods (workflow logs up to 90 days, account data 12 months after closure) and the pricing page gives 1, 7 or 90 or more days by plan. No DPA or sub-processor list could be read, because the trust centre is script-drawn (18 of 30). No deprecation policy was found. The changelogs carry Removed sections, there are migration guides, and the cloud agreement gives 15 days' notice of price changes (8 of 20). CLI telemetry is disclosed with an opt-out, server analytics are settings, the privacy policy names PostHog and Google Ads without a full list, and regions are published (13 of 20)." } ], "assessment": { "date": "2026-10-09", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "Seven compact MCP tools, and list endpoints with limit and offset (23 of 25). Events list by key, workflow, status and search text (18 of 20). Errors return a code, field, description and docs link, though no list of codes was found (14 of 20). Idempotency keys by TTL or status, and scope with a lookback window against a race between push and wait. No MCP tool sets `readOnlyHint` or `destructiveHint` (12 of 20). A wait needs only an event key, and there are official SDKs in four languages (15).", "maintenance": "Platform v0.110.19 tagged on 8 October 2026 (30). Tags on most working days in September and October, and five dated changelog entries between 25 August and 5 October (20). Issue reply times were not sampled. There is a Discord, a stale-issue workflow and a changelog (15 of 25). Current official SDKs, Python 1.41.1 on 24 September and Ruby 0.9.0 on 5 October 2026. The MCP server is not in the official registry (15). CI workflows for tests, each SDK, lint and an OSV scanner (10).", "payments": "No machine payment protocol (0). Per-unit prices published without a login, $30 per million runs and $5 per million events (20). The pay-as-you-go plan starts at $0 without a card (20). A person signs up in the browser for the cloud. Embedded mode needs no account but is local software for development (0).", "reliability": "Graded as Hatchet Cloud, with the hosted lines. Status page at status.hatchet.run on Better Stack with three components (20). Its incident list, which reaches back to August 2026, shows one incident, about nine hours of elevated latency and delayed task processing on one shared shard in us-west-2 on 22 August 2026. Other shards and regions were unaffected, so we score it between minor and major (15 of 30). The pricing page gives plan quotas with numbers (2,000 runs a day without a card, worker slots, queue backlog) and the docs give a 4 MB payload limit, but no request rate for the API was found (8 of 15). The docs say which errors each SDK retries, the Go SDK honours `Retry-After` on 429, the OpenAPI file lists 429 on event creation, and idempotency keys are generally available (12 of 15). SLAs are named for the enterprise plan only and no SLA document is published (3 of 10). Event waits carry no beta label, the SDKs are 1.x except Ruby at 0.9.0, and the platform version is still 0.x (8 of 10).", "schema": "OpenAPI 3.1 file in the repository with 147 operations, and typed inputs on all seven MCP tools (25). llms.txt on the docs host (10). The docs say when to use a durable task and when a DAG, and warn about determinism. The MCP tool descriptions are one line each and do not say when not to use a tool (14 of 20). Typed SDK signatures with an optional payload validator and 56 enums in the API schemas, but event data and MCP run input are free-form objects (11 of 15). Code samples in four languages. The API file has few examples, and no rendered REST reference was found in the docs index (10 of 15). Dated changelogs for the platform and each SDK, and `/api/v1/stable` paths (15).", "security": "API tokens per tenant with a configurable expiry, created and revoked through the dashboard or API. No narrower scopes, and the docs say tokens are not restricted by role or payload visibility (20 of 30). A read-only VIEWER role, a per-member payload flag and deny-by-default profile grants for the MCP server, with no read-only token and no confirmation before `trigger_run` or `replay_run` (11 of 20). Event payloads from webhooks are untrusted content. Hatchet has payload validators, CEL filters and webhook checks by HMAC, API key or basic auth, and no prompt-injection guidance was found (8 of 15). Audit logs with actor, action, IP address and time on Business plans and above, kept 30 days. Event pushes are not among the documented actions (9 of 15). SECURITY.md with private GitHub advisories and security@hatchet.run, advisories published with CVE IDs, SOC 2 Type II, HIPAA and independent testing stated in the docs. No bug bounty (SECURITY.md says so), no security.txt, and the trust centre was not readable (14 of 20).", "transparency": "MIT (30). The privacy policy of 18 August 2026 gives retention periods (workflow logs up to 90 days, account data 12 months after closure) and the pricing page gives 1, 7 or 90 or more days by plan. No DPA or sub-processor list could be read, because the trust centre is script-drawn (18 of 30). No deprecation policy was found. The changelogs carry Removed sections, there are migration guides, and the cloud agreement gives 15 days' notice of price changes (8 of 20). CLI telemetry is disclosed with an opt-out, server analytics are settings, the privacy policy names PostHog and Google Ads without a full list, and regions are published (13 of 20)." }, "sources": [ { "what": "home page and footer links", "url": "https://hatchet.run", "seen": "2026-10-09" }, { "what": "pricing page", "url": "https://hatchet.run/pricing", "seen": "2026-10-09" }, { "what": "cloud terms (Common Paper cover page)", "url": "https://hatchet.run/policies/terms", "seen": "2026-10-09" }, { "what": "standard terms the cover page incorporates", "url": "https://commonpaper.com/standards/cloud-service-agreement/2.1/", "seen": "2026-10-09" }, { "what": "privacy policy", "url": "https://hatchet.run/policies/privacy", "seen": "2026-10-09" }, { "what": "docs index for agents", "url": "https://docs.hatchet.run/llms.txt", "seen": "2026-10-09" }, { "what": "durable event waits", "url": "https://docs.hatchet.run/v1/durable-event-waits", "seen": "2026-10-09" }, { "what": "pushing events", "url": "https://docs.hatchet.run/v1/events", "seen": "2026-10-09" }, { "what": "MCP server docs", "url": "https://docs.hatchet.run/reference/cli/mcp", "seen": "2026-10-09" }, { "what": "exposing tasks as agent tools", "url": "https://docs.hatchet.run/cookbooks/hatchet-and-mcp", "seen": "2026-10-09" }, { "what": "security page", "url": "https://docs.hatchet.run/v1/security/index", "seen": "2026-10-09" }, { "what": "audit logs", "url": "https://docs.hatchet.run/v1/security/audit-logs", "seen": "2026-10-09" }, { "what": "platform changelog", "url": "https://docs.hatchet.run/reference/changelog/platform", "seen": "2026-10-09" }, { "what": "status page and incident list", "url": "https://status.hatchet.run/incidents", "seen": "2026-10-09" }, { "what": "repository at v0.110.19 (shallow clone): MCP tool source, OpenAPI file, SECURITY.md, CHANGELOG.md, the licence file, tags, SDK versions, and the docs sources for or groups, durable tasks, retries, roles, webhooks, regions, idempotency and CLI telemetry", "url": "https://github.com/hatchet-dev/hatchet", "seen": "2026-10-09" }, { "what": "advisory GHSA-992g-9cr3-vm5x through the OSV mirror", "url": "https://api.osv.dev/v1/vulns/GHSA-992g-9cr3-vm5x", "seen": "2026-10-09" } ], "openQuestions": [ "unchecked: the trust centre at trust.hatchet.run is script-drawn, so the SOC 2 report, DPA, sub-processor list and penetration test summaries were not read.", "unchecked: GHSA-hf2m-86fv-rjw5. The OSV mirror answered 404 and GitHub's advisory page was not tried, so its severity and scope are known only from the changelog line.", "unchecked: issue and pull request reply times, GitHub stars and package download counts.", "unchecked: the domain's registration date, and whether the MCP server is in the official registry (no server.json is in the repository).", "unchecked: the status page history before August 2026, and whether the incident list is complete for the 90 days.", "The standard terms (Common Paper Cloud Service Agreement 2.1), as our reader summarised them, forbid security or vulnerability tests and allow aggregated usage data and customer content to be used for machine learning. Whether Hatchet's cover page changes either was not established. Recorded as a fact with no deduction, and it matters before any probe is run.", "The audit log page says Business plans and above, while the pricing page lists audit logs only under the enterprise plan and shows no Business plan.", "The pricing page lists 1 million runs a month as included on the plan without a card and also a limit of 2,000 runs a day. How the two interact was not established.", "The lead named an MCP server among the interfaces. It exists, but it is a local operations tool for coding agents and cannot push the event that resumes a wait.", "api.osv.dev answered 404 for robots.txt, so it publishes no rules. status.hatchet.run answered 200 with an empty file, and trust.hatchet.run answered its app page." ] }, "negative": -2, "negativeNotes": [ "Published 4 September 2026, -2. GHSA-992g-9cr3-vm5x (CVE-2026-88978), Moderate, CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. The `DurableTask` worker status path looked up durable event log entries by a caller-supplied task UUID with no tenant filter, so a holder of any tenant's token who knew another tenant's task UUID could read its entries. The advisory names Hatchet Cloud as affected and calls exploitation very unlikely because the IDs are random UUIDs. Fixed in 0.106.1. It is the event log this listing is graded on, so 2 points for a fixed path. https://github.com/hatchet-dev/hatchet/security/advisories/GHSA-992g-9cr3-vm5x (read through https://api.osv.dev/v1/vulns/GHSA-992g-9cr3-vm5x)", "Not deducted. GHSA-hf2m-86fv-rjw5, fixed in v0.110.5 on 5 October 2026, enforced payload visibility restrictions on endpoints that had returned payload data. The OSV mirror answered 404 for it, so its severity was not read. https://github.com/hatchet-dev/hatchet/blob/main/CHANGELOG.md" ], "verdict": "A durable task waits for a keyed event without holding a worker slot, and resumes from its event log after a restart, in Python, TypeScript, Go or Ruby. Hatchet supplies only the pause and resume. It has no approver inbox, notification channel or record of who answered, and its MCP server cannot push the event.", "bestFor": "It suits a team already running background jobs or agent loops on Hatchet that wants an approval pause inside the same durable task, in Python, TypeScript, Go or Ruby.", "strengths": [ "A durable task waiting on an event is evicted from its worker slot and resumes from the durable event log after a restart or crash", "Events can be filtered with a CEL expression, and a scope with a lookback window catches an answer pushed before the wait began", "MIT licence, self-hostable, with SDKs for Python (1.41.1), TypeScript (1.36.0), Go and Ruby (0.9.0)", "Pay-as-you-go cloud plan starts at $0 without a card, with 1 million runs and 1 million events a month included, per the pricing page", "Platform release v0.110.19 on 8 October 2026, with dated changelogs for the platform and each SDK" ], "weaknesses": [ "No approver inbox, Slack or email channel, routing or reminder. The owner builds the request and the way the answer is pushed", "An event wait has no timeout of its own. A deadline needs a sleep condition in the same or group", "API tokens are scoped to a tenant with an expiry, with no narrower scopes, and the role and payload restrictions do not apply to them", "Audit logs are for Business plans and above, kept 30 days, and the documented actions do not include event pushes", "The seven MCP tools trigger, inspect and replay runs. None pushes an event, and none sets a read-only or destructive annotation", "The standard terms the cloud agreement incorporates forbid security or vulnerability tests of the product. This matters before any probe is run" ], "agentNotes": [ "Put the approval wait in a durable task, and keep API calls, database reads and random values in child tasks, because the code between checkpoints is replayed", "Add a sleep condition in the same or group as the event condition to set a deadline, and treat the sleep firing first as a timeout", "Give the event a scope and the wait a lookback window when the answer can arrive before the wait starts. Both must be set together", "Filter with a CEL expression such as `input.user_id == '1234'` so one approval key cannot resume another request's task", "Push the answer with the SDK's event push or `POST /api/v1/tenants/{tenant}/events`. The MCP server has no tool for it", "Grant the MCP server one profile with `hatchet mcp auth --grant \u003cprofile\u003e`. It refuses profiles that were not granted" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 68.3 } ], "editorialScores": { "ergonomics": 82, "maintenance": 90, "payments": 40, "reliability": 66, "schema": 85, "security": 62, "transparency": 69 }, "provenanceScore": 72 }, "connect": { "install": "pip install hatchet-sdk", "claudeCode": "hatchet mcp install --target claude-code", "config": { "mcpServers": { "hatchet": { "args": [ "mcp", "serve" ], "command": "hatchet" } } } }, "letme": { "capability": "https://letme.dev/hitl.approve", "tool": "https://letme.dev/hatchet" }, "notable": [ "Event waits are `ctx.aio_wait_for_event()` in Python, `ctx.waitForEvent()` in TypeScript, `ctx.WaitForEvent()` in Go and `ctx.wait_for()` with `Hatchet::UserEventCondition` in Ruby (https://docs.hatchet.run/v1/durable-event-waits)", "The docs call event waits the foundation for human-in-the-loop workflows, and give sleep plus event in one or group as the way to put a deadline on a response (https://docs.hatchet.run/v1/durable-event-waits, https://docs.hatchet.run/v1/directed-acyclic-graphs)", "Lookback windows need a scope on both the wait and the pushed event. The Ruby SDK does not support them yet (https://docs.hatchet.run/v1/durable-event-waits)", "Events arrive from an SDK, the REST API (`event:create` in the OpenAPI 3.1 file, 147 operations) or an incoming webhook checked by basic auth, an API key header or HMAC (https://github.com/hatchet-dev/hatchet/tree/main/api-contracts/openapi, https://docs.hatchet.run/v1/webhooks)", "The CLI's local MCP server, added in v0.107.0 on 15 September 2026, has seven tools (`trigger_run`, `get_run`, `list_run_events`, `list_workers`, `replay_run`, `engine_status`, `submit_feedback`) and uses only CLI profiles the user granted (https://github.com/hatchet-dev/hatchet/blob/main/cmd/hatchet-cli/cli/internal/mcp/server.go)", "`submit_feedback` sends its arguments, the deployment type and the CLI version to Hatchet's PostHog project (https://github.com/hatchet-dev/hatchet/blob/main/cmd/hatchet-cli/cli/internal/mcp/feedback.go)", "Idempotency keys (TTL-based or status-based, from a CEL expression) became generally available in v0.101.27 on 17 August 2026 (https://docs.hatchet.run/reference/changelog/platform)", "Two security advisories were fixed in the last 90 days. GHSA-992g-9cr3-vm5x (CVE-2026-88978, Moderate), a missing tenant filter on durable event log lookups, fixed in 0.106.1. GHSA-hf2m-86fv-rjw5, payload visibility not enforced on some endpoints, fixed in v0.110.5 (https://github.com/hatchet-dev/hatchet/blob/main/CHANGELOG.md)", "The cloud terms are a Common Paper Cloud Service Agreement cover page, last updated 17 July 2025, that incorporates Standard Terms Version 2.1 (https://hatchet.run/policies/terms)", "The status page shows one incident since August 2026, about nine hours of elevated latency on one shared shard in us-west-2 on 22 August 2026 (https://status.hatchet.run/incidents)" ], "area": "agent-runtime", "details": [ { "label": "How the pause works", "value": "A durable task calls the event wait with an event key. Hatchet writes a checkpoint, can evict the task from its worker slot, and re-queues it when a matching event arrives" }, { "label": "How the answer arrives", "value": "An event with the matching key and a JSON payload, pushed from an SDK, `POST /api/v1/tenants/{tenant}/events` or an incoming webhook. The wait returns the payload" }, { "label": "Timeouts", "value": "None on the event wait itself. Combine a sleep condition and an event condition in one or group, and the first to be satisfied resumes the task" }, { "label": "Channels", "value": "None built in. The owner sends the request over Slack, email or a web page and pushes the event with the reply" }, { "label": "Free tier", "value": "$0 without a card, 1 million runs and 1 million events a month, 2,000 runs and 2,000 events a day, 3 users, 1-day retention, per the pricing page" }, { "label": "Usage prices", "value": "$30 per million runs and $5 per million events after the included amounts. A failed run is billed, retries are not" }, { "label": "Limits", "value": "Default maximum payload 4 MB. Plan quotas for daily runs, worker slots and queue backlog. No request rate for the REST API was found in the reviewed documentation" }, { "label": "MCP server", "value": "Local, stdio, inside the Hatchet CLI (`hatchet mcp serve`). Seven tools, deny-by-default profile grants in `~/.hatchet/mcp-grants.yaml`, no tool annotations" }, { "label": "Credentials", "value": "API tokens per tenant with a configurable expiry, created and revoked in the dashboard or the API. Dashboard sign-in with Google or GitHub, SSO on the enterprise plan" }, { "label": "Roles", "value": "OWNER, ADMIN, MEMBER and read-only VIEWER, plus a per-member flag that hides payloads. API tokens are not restricted by either" }, { "label": "Audit", "value": "Audit logs on Business plans and above, 30 days, with actor, action, resource, IP address and time, read through the management API" }, { "label": "SDKs", "value": "Python `hatchet-sdk` 1.41.1 (24 September 2026), TypeScript `@hatchet-dev/typescript-sdk` 1.36.0, Go in the main module, Ruby 0.9.0 (5 October 2026), all MIT" }, { "label": "Regions", "value": "Control plane in AWS Oregon. Data plane live in Oregon, N. Virginia and Ireland, Sydney in private beta" }, { "label": "Certifications", "value": "SOC 2 Type II, HIPAA and GDPR per the docs security page. The trust centre at trust.hatchet.run is script-drawn and was not read" }, { "label": "Status", "value": "status.hatchet.run on Better Stack, three components (API, Hatchet Cloud, website)" } ], "unitPrices": [ { "item": "Task runs after the first 1 million a month", "unit": "1k-calls", "usd": 0.03, "note": "$30 per million runs. A failed run is billed, retries are not" }, { "item": "Events after the first 1 million a month", "unit": "1k-calls", "usd": 0.005, "note": "$5 per million events" }, { "item": "Extra user beyond 50 (card on file)", "unit": "seat-month", "usd": 10 } ], "provenance": { "legalEntity": "Hatchet Technologies, Inc.", "domain": "hatchet.run", "domainRegistered": "", "endpointOnVendorDomain": true, "terms": "https://hatchet.run/policies/terms", "privacy": "https://hatchet.run/policies/privacy", "statusPage": "https://status.hatchet.run", "changelog": "https://docs.hatchet.run/reference/changelog", "securityTxt": "none", "checked": "2026-10-09", "notes": [ "The terms page is a Common Paper Cloud Service Agreement cover page for Hatchet Technologies, Inc., last updated 17 July 2025, governed by Delaware law, incorporating Standard Terms Version 2.1 at commonpaper.com.", "The privacy policy was last updated 18 August 2026, covers workflow data and API usage data, and names an EU representative in Ireland.", "hatchet.run/.well-known/security.txt answered 404. SECURITY.md in the repository takes reports through private GitHub advisories or security@hatchet.run and says there is no bug bounty.", "The dashboard and API are at cloud.hatchet.run. The webhook docs show incoming webhook URLs on cloud.onhatchet.run, a second domain.", "status.hatchet.run runs on Better Stack with three components. Its robots.txt answered 200 with an empty body.", "The repository's licence file is MIT, copyright 2023 to present Hatchet Technologies Inc.", "The domain's registration date was not looked up." ], "score": 72, "checks": [ { "check": "Legal entity named", "value": "Hatchet Technologies, Inc.", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "hatchet.run, no registry record we could read", "points": 0, "max": 15, "state": "no" }, { "check": "Endpoint on the vendor's domain", "value": "cloud.hatchet.run", "points": 15, "max": 15, "state": "ok" }, { "check": "Terms of service", "value": "read, states 3 of the 7 things a reader expects", "points": 6.6, "max": 10, "state": "part" }, { "check": "Privacy policy", "value": "read, states 8 of the 8 things a reader expects", "points": 10, "max": 10, "state": "ok" }, { "check": "Status page", "value": "status.hatchet.run", "points": 10, "max": 10, "state": "ok" }, { "check": "Changelog", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "security.txt", "value": "not found", "points": 0, "max": 10, "state": "no" } ], "policies": [ { "kind": "terms", "url": "https://hatchet.run/policies/terms", "state": "read", "readAt": "2026-10-09", "statedDate": "2025-07-17", "words": 643, "points": 6.6, "max": 10, "expected": [ { "key": "terms.date", "label": "Gives the date it was last updated", "found": true, "quote": "Last updated: July 17, 2025", "says": "Last updated 2025-07-17" }, { "key": "terms.law", "label": "Names the governing law or courts", "found": true, "quote": "Governing Law: The laws of the State of Delaware", "says": "The law of the State of Delaware" }, { "key": "terms.liability", "label": "States a limit on its liability", "found": false }, { "key": "terms.termination", "label": "Says how the agreement or account can be ended", "found": false }, { "key": "terms.changes", "label": "Says how changes to the terms are announced", "found": true, "quote": "Provider may update Product pricing by giving at least 15 days notice to Customer (including by email or notification within the Product), and the change will apply in the next Subscription Period.", "says": "Gives 15 days of notice before a change" }, { "key": "terms.use", "label": "Lists what users may not do", "found": false }, { "key": "terms.sla", "label": "Refers to a service level or uptime commitment", "found": false } ], "notes": [ { "date": "2026-10-08", "text": "The order form is governed by key terms on the page and by the Cloud Service Agreement Standard Terms Version 2.1, incorporated by reference.", "quote": "Framework Terms: This Order Form incorporates and is governed by the Framework Terms that are made up of the Key Terms below and the Hatchet Technologies, Inc. Cloud Service Agreement Standard Terms Version 2.1, which are incorporated by reference." }, { "date": "2026-10-08", "text": "Hatchet may change pricing with at least 15 days' notice, and the change applies from the next subscription period.", "quote": "Provider may update Product pricing by giving at least 15 days notice to Customer (including by email or notification within the Product), and the change will apply in the next Subscription Period." }, { "date": "2026-10-08", "text": "Notice of non-renewal is due at least 30 days before the current subscription period ends.", "quote": "Non-Renewal Notice Period: At least 30 days before the end of the current Subscription Period." } ] }, { "kind": "privacy", "url": "https://hatchet.run/policies/privacy", "state": "read", "readAt": "2026-10-09", "statedDate": "2026-08-18", "words": 3947, "points": 10, "max": 10, "expected": [ { "key": "privacy.date", "label": "Gives the date it was last updated", "found": true, "quote": "Last updated: August 18, 2026", "says": "Last updated 2026-08-18" }, { "key": "privacy.collected", "label": "Says what personal data is collected", "found": true, "quote": "(“Hatchet Technologies, Inc.,” “we,” “us” or “our”) handles personal information that we collect through our website and other digital properties that link to this Privacy Policy (collectively, the “Service”), as well as through social media, our marketing activities, and other activities described in this Privacy Pol…" }, { "key": "privacy.retention", "label": "Says how long data is kept", "found": true, "quote": "Account data: Retained while your account is active and for up to 12 months after account closure for customer support and legal compliance", "says": "Names a period of 12 months" }, { "key": "privacy.processors", "label": "Says who else receives the data", "found": true, "quote": "We, our service providers, and our business partners may automatically log information about you, your computer or mobile device, and your interaction over time with the Service, our communications and other online services, such as:" }, { "key": "privacy.sale", "label": "Says whether personal data is sold or shared for advertising", "found": true, "quote": "We do not sell your personal information for money.", "says": "Says it does not sell personal data" }, { "key": "privacy.rights", "label": "Says what rights people have over their data", "found": true, "quote": "Right to rectification: You can request that we correct or update inaccurate or incomplete personal data." }, { "key": "privacy.contact", "label": "Gives a privacy contact", "found": true, "quote": "For questions about your data protection rights or to exercise your rights, please contact us at:" }, { "key": "privacy.transfers", "label": "Says where data is transferred or stored", "found": true, "quote": "…not have an adequacy decision from the European Commission, we implement appropriate safeguards such as Standard Contractual Clauses approved by the European Commission and additional technical and organizational security measures to protect your data.", "says": "Relies on standard contractual clauses" } ] } ] }, "pageJsonUrl": "https://www.anchorterminal.com/tools/hatchet.json", "live": { "slug": "hatchet", "probe": { "target": "https://cloud.hatchet.run", "method": "get", "lastAt": "2026-10-10T02:54:57.34456059Z", "lastOk": true, "lastStatus": 200, "lastMs": 598, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 681, "p95ms24h": 1647, "samples24h": 115, "samples30d": 115, "days": [ { "date": "2026-10-09", "probes": 85, "ok": 85 }, { "date": "2026-10-10", "probes": 30, "ok": 30 } ] }, "vendorStatus": { "page": "https://status.hatchet.run", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-10-10T00:50:40.047363861Z" }, "versions": [ { "registry": "github", "name": "hatchet-dev/hatchet", "version": "v0.110.5", "released": "2026-10-06", "seenAt": "2026-10-09T16:57:30.943852136Z" }, { "registry": "npm", "name": "@hatchet-dev/typescript-sdk", "version": "1.36.0", "seenAt": "2026-10-09T16:57:29.775672491Z" }, { "registry": "pypi", "name": "hatchet-sdk", "version": "1.41.1", "released": "2026-09-24", "seenAt": "2026-10-09T16:57:29.581369924Z" } ], "githubStars": 8088, "npmWeekly": 300149, "pypiWeekly": 392095, "pages": [ { "url": "https://docs.hatchet.run/reference/changelog", "kind": "changelog", "status": 200, "checkedAt": "2026-10-09T18:37:27.789775482Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "f6e9eec278c6" }, { "url": "https://hatchet.run/pricing", "kind": "pricing", "status": 200, "checkedAt": "2026-10-09T18:40:07.756761277Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "3096d0aaa49f" }, { "url": "https://hatchet.run/policies/privacy", "kind": "privacy", "status": 200, "checkedAt": "2026-10-09T18:40:03.629481363Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "1926d0170834" }, { "url": "https://hatchet.run/policies/terms", "kind": "terms", "status": 200, "checkedAt": "2026-10-09T18:40:05.775842594Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "22e8ffadb15d" } ], "updatedAt": "2026-10-10T02:54:57.34456059Z" } } }