upstash-ratelimit-js skill for Claude Code: add rate limiting with @upstash/ratelimit

Upstash's own skill that makes Claude add rate limiting to APIs, middleware and edge functions with the @upstash/ratelimit SDK.

Installs: 24K; on skills.sh
Stars: 34; on GitHub
Files: 5; besides SKILL.md
Updated: Oct 2026; last repo commit

upstash-ratelimit-js points Claude to the @upstash/ratelimit TypeScript SDK, which stores its counters in Upstash Redis. SKILL.md gives a quick start and links five guides: algorithms, features, methods, pricing and Redis command cost, and traffic protection. It triggers on rate limit, throttle, 429 and quota requests. The folder bundles no scripts, and the code it writes needs an Upstash Redis URL and token.

Good for

Developers protecting login, signup or AI endpoints from abuse
Teams on Next.js, Vercel Edge or Cloudflare Workers
Anyone choosing between fixed window, sliding window and token bucket limits

Install upstash-ratelimit-js

Claude Code

Copy this prompt.

Install the upstash-ratelimit-js skill in Claude Code. Run this command:

/plugin marketplace add upstash/skills
/plugin install upstash@upstash

Then check that it loaded and tell me how to use it.

2
Paste it into Claude Code. It shows the change and asks before running it.

Pick one route, not both. The plugin and npx upstash add the Upstash MCP server along with the skills, and the skills CLI route installs only this skill. The README says the skills themselves need no credentials.

From the project README. Source.

What's in the skill

When it loads

Rate limiting for serverless and edge apps with the @upstash/ratelimit TypeScript/JavaScript SDK backed by Upstash Redis. Use when adding a rate limiter or throttling to an API route, Next.js middleware, Vercel Edge, Cloudflare Workers, or any HTTP endpoint; returning 429 Too Many Requests; choosing between fixed window, sliding window, and token bucket algorithms; limiting per user, IP, API key, or tenant with prefixes and custom keys; protecting login, signup, form, or AI endpoints from abuse, bots, and brute force; using deny lists, ephemeral caching, analytics, timeouts, and multi-region rate limits; or estimating the Redis command cost of rate limiting. Also use when the user says rate limit, rate-limiting, throttle, quota, request limits, or traffic protection.

Sections in SKILL.md

Bundled docs and source
Quick Start
Other Skill Files

Key facts

Author: Upstash (named in the SKILL.md metadata and the plugin manifest); the vendor's own repo
License: MIT (LICENSE file, SKILL.md and plugin manifest)
Installs on skills.sh: 23,966 as of 2026-11-02
GitHub stars: 34 for the whole upstash/skills repo, 2026-11-02
What is inside: 6 files including SKILL.md: algorithms.md, features.md, methods-getting-started.md, pricing-cost.md, traffic-protection.md
Part of: The Upstash plugin: 14 skills in the repo and the hosted Upstash MCP server
Needs: An Upstash Redis database; the quick start passes a URL and token to the Redis client
Last repo commit: 2026-10-27
Works in: Claude Code, Codex, Cursor, Gemini CLI, OpenCode, Zed and any Agent Skills client, per the README

What it includes

Install the SDK, connect to Redis, create a limiter
Shows a sliding window limiter of 5 requests per 10 seconds and a limit call keyed on a user ID.
Try: “Add a 10 requests per minute rate limit per IP to my Next.js API route.”
Write · Quick start
Looks in node_modules for SDK docs and source first
Before writing or debugging, Claude checks node_modules/@upstash/ratelimit/docs and src, and uses the skill's guides when they are absent.
Files · Bundled docs check
Fixed window, sliding window and token bucket
Describes the available rate-limiting algorithms and how each behaves.
Read · algorithms.md
Caching, timeout, analytics, multiple limits, multi-region, dynamic limits
Eight sections: caching, timeout, analytics and dashboard, multiple limits, custom rates, multi-region, dynamic limits and common pitfalls.
Read · features.md
limit, blockUntilReady, resetUsedTokens, getRemaining, dynamic limits
The SDK method reference: limit, blockUntilReady, resetUsedTokens, getRemaining, setDynamicLimit and getDynamicLimit.
Read · methods-getting-started.md
Redis command cost of rate limiting
Explains pricing and Redis cost implications so you can estimate what a limiter costs.
Read · pricing-cost.md
Deny lists, auto IP deny list and common mistakes
Covers deny lists, an automatic IP deny list with its update flow, dashboard integration and common mistakes.
Read · traffic-protection.md

From the official docs

Permissions

Medium risk

Claude edits the code in front of your API, so a wrong key or limit can lock out real users, and the plugin route connects an MCP server to your Upstash account. Test limits on low traffic and install only the skill if you do not want the MCP server.

What it can do

Read your data
Create and change things
Delete things
Read-only mode

Watch out for

The plugin route adds the Upstash MCP server
The plugin and npx upstash also set up the hosted server at https://mcp.upstash.com/mcp, with OAuth sign-in. The repo's AGENTS.md lists tools to create and inspect databases, run Redis commands, read logs and backups, and manage QStash schedules. Use the skills command if you only want the skill. github.com
It edits request-handling code
A rate limiter sits in front of your API routes and middleware. A wrong key or limit can block real users, so test it with low traffic and review the diff. github.com
The limiter needs Redis credentials
The examples pass a Redis URL and token or call Redis.fromEnv(). Keep the token in environment variables and out of git. github.com

Technical details

Turning on read-only	No read-only mode for the skill.
Talks to	https://mcp.upstash.com/mcp (plugin route)
Sign-in and keys	The code Claude writes reads your Upstash Redis URL and token. The plugin's MCP server signs in with OAuth or a developer API key.
Data retention	SKILL.md names no logging or telemetry.
Scopes	Claude writes rate-limit code in your project and reads node_modules/@upstash/ratelimit docs Plugin route: hosted Upstash MCP server with access to your Upstash account

Questions

What does upstash-ratelimit-js do?

It makes Claude add rate limiting with the @upstash/ratelimit SDK: pick an algorithm, limit per user, IP or API key, return 429, and estimate the Redis cost.

How do I install upstash-ratelimit-js?

Use the install box at the top of this page. The plugin route also adds the Upstash MCP server, and the skills command installs only this skill.

Is it official?

Yes. It is in Upstash's own skills repo, and SKILL.md names Upstash as author.

Do I need upstash-redis-js too?

SKILL.md does not require it. The SDK needs an Upstash Redis database, and the Redis client skill is a separate, optional guide. The redis-js skill has a rate-limiting pattern guide that points to @upstash/ratelimit.

Which algorithms does it cover?

SKILL.md names fixed window, sliding window and token bucket, and links an algorithms guide that describes all available ones.

Is upstash-ratelimit-js safe to install?

The skill folder is Markdown only and bundles no scripts. Claude will write rate-limit code in front of your API routes and middleware, and the plugin route adds an MCP server tied to your Upstash account; see the safety section. Our advice: test new limits on low traffic, because a wrong key or limit can block real users.

Does it work in the Claude app or Codex?

The README documents Claude Code, Codex, Cursor, Gemini CLI, OpenCode and Zed, and the install box lists each. Our advice: use Claude Code or Codex for changes to your project; the Claude app upload is a plain reference.

Information

updated Nov 2, 2026

Repository: upstash/skills
Folder: skills/upstash-ratelimit-js

upstash/skills skills.sh

Sources

Docs, issue trackers and discussions this page is built from.

Show all 14

README · github.com
marketplace.json · github.com
plugin.json · github.com
upstash-ratelimit-js on skills.sh · skills.sh
upstash-ratelimit-js SKILL.md · github.com
LICENSE · github.com
features.md · github.com
upstash-ratelimit-js algorithms.md · github.com
upstash-ratelimit-js methods-getting-started.md · github.com
upstash-ratelimit-js pricing-cost.md · github.com
upstash-ratelimit-js traffic-protection.md · github.com
upstash-redis-js SKILL.md · github.com
mcp.json · github.com
AGENTS.md · github.com