Rate Limiting

Edge and application-level limits that protect the runtime and your LLM budget.

DragonClaw uses two layers of rate limiting.

Layer 1: Nginx

Nginx can apply IP-based request limits before traffic reaches Node.js.

This is the first defense against scraping, brute force traffic, and accidental bursts.

Layer 2: Gateway

The gateway applies user-aware limits.

Default settings:

• Per user: 20 requests per minute

• Global: 100 requests per minute

• Window: 60s

Error shape

When a client is limited, DragonClaw returns:

{
  "error": "Rate limited",
  "retryAfterMs": 45000
}

HTTP status is 429 Too Many Requests.

Why two layers matter

• Nginx stops edge abuse early

• The gateway enforces fair use across connectors and sessions

• Both together reduce surprise LLM spend