MCP.Market

Oneshot MCP server

by oneshotpacks.com·com.oneshotpacks/oneshot-mcp·v0.1.2

Search receipt-verified agent build packs, with each pack's real M-of-N pass rate.

A86/100grade A
What users say
No reviews yet
Be the first
Safety scan
A86/100

full report

Adoption
New

0 stars32 downloads/wk

Reviews

Write one

Nobody has reviewed Oneshot yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Oneshot tools (3)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

  • get_pack

    Full detail for one OneShot pack by slug: what you get, architecture-decision highlights, the scale envelope, FAQ, the exact receipt facts (per-check pass/fail, model, token and wall-time cost) when the pack has been verified, price, a refund-policy pointer, and the buy URL. Reports 'unverified' honestly when no execution receipt exists yet -- never implies a verification the receipt doesn't suppo

  • list_packs

    The whole OneShot catalog, compact: slug, title, one-liner, niche, price, and verification status per pack, plus the refund-policy summary once. Use this for an overview, then call get_pack on a specific slug for full detail.

  • search_packs

    Search the OneShot catalog of receipt-verified agent build packs by keyword (stack, problem, or niche -- e.g. "stripe billing subscription" or "offline sync"). Returns matching packs with title, one-liner, price, verification status stated exactly as the receipt supports (e.g. "3 of 3 clean-room runs passed", or "unverified" if no receipt exists yet -- never invented), a receipt summary, and the s

Public scan report

scanner v0.1.9 · 2026-09-24 · same rubric, same numbers if you re-run it

no findings
  • Code scan5 source files scanned25/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitylocal package, no credentials required12/15
  • Maintenancelast push 53 days ago12/15
  • Maintainer identitynamespace and repository owner differ; GitHub account older than a year; website matches verified namespace7/10
Overall 86/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How Oneshot compares

Against every graded AI and agents MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
86/100
higher than 75% of 4,460 AI and agents servers
Tools
3
the typical AI and agents server has 6
Tools that change things
0%
typical: 0%. Fewer write tools means less an agent can break
Downloads a week
32
more than 20% of 1,538 AI and agents servers with a package

What its tools let an agent do: 3 read

Install Oneshot in Claude Code, Cursor or VS Code

Runs npx -y oneshot-mcp on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add oneshot-mcp -- npx -y oneshot-mcp
Add to Cursor

What the publisher says

From the Oneshot repository's README, as published. We do not edit it. Read it on GitHub

oneshot-mcp

An MCP server that lets your coding agent query the OneShot catalog of receipt-verified build packs without you leaving your editor. Mid-build, your agent can ask "is there a verified pack for this?" instead of you having to remember to check the storefront.

Why you'd add this (honestly)

This is a vendor catalog: it lets your agent query OneShot's own paid build packs, plus their verification data, from inside your normal workflow. It's worth adding because it's useful independent of whether you ever buy anything -- searchpacks and listpacks tell you plainly whether a receipt-verified pack exists for what you're building, with real "M of N runs passed" numbers, not marketing copy. get_pack puts the price, refund terms, and exact receipt facts in front of you before you decide anything. But be clear-eyed about what it is: this is OneShot listing its own products to your agent, not an independent recommendation engine. It never calls a pack "best" or invents a verification a receipt doesn't support, and every result carries the price and refund pointer -- but the catalog is ours, and every entry in it is something we sell.

Tools

niche) over the catalog. Returns matching packs: title, one-liner, price, verification status stated exactly as the receipt supports (e.g. "3 of 3 clean-room runs passed", or "unverified" if no receipt exists yet), a receipt summary, the refund-policy pointer, and the storefront URL. Never ranks or calls a result "best" -- describes each match and leaves the decision to the caller.

  • searchpacks({ query, limit? })** -- keyword search (stack, problem, or

architecture-decision highlights, scale envelope, FAQ, exact receipt facts (per-check pass/fail, model, token/wall-time cost) when verified, price, refund pointer, and the buy URL.

  • getpack({ slug })** -- full detail for one pack: what you get,

niche, price, and verification status per pack, plus the refund-policy summary once.

  • listpacks()** -- the whole catalog, compact: slug, title, one-liner,

Data source: fetch-with-fallback (not a bundled catalog)

Two options were on the table: read packs/*/pack.yaml + receipt/receipt.json

the npm package. Chosen: live reads, preferring the storefront's /catalog.json over a local checkout, in that order:

  • LISTING.md live at runtime, or ship a generated catalog.json baked into

3s timeout). Accepts either a bare array of pack objects or { "packs": [...] }.

  1. Try GET $ONESHOTCATALOGURL (default https://oneshotpacks.com/catalog.json,

shape -- fall back to reading packs//pack.yaml + LISTING.md + receipt/receipt.json directly off disk under $PACKSDIR (default ../packs, resolved from the current working directory -- matches storefront/lib/packs.ts's own convention when both this package and packs/ sit at the repo root).

  1. If that fails for any reason -- network error, non-2xx, not JSON, wrong

(catalog_source: "none" + an explanatory note) instead of serving stale bundled data. This server never fabricates catalog contents.

  1. If neither source has anything, listpacks/searchpacks say so plainly

A baked-in catalog.json was rejected because it goes stale the moment a pack is re-verified or newly listed, and every server update would then require a new npm release just to refresh data the storefront already has live. Live reads cost one fetch + a YAML parse -- the same low cost the storefront's own loader pays -- and stay fresh without a redeploy of this server, which is the whole point per docs/03-marketing-distribution.md Lever 2.

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

Oneshot: common questions

Is Oneshot MCP server safe?
Yes, by our scan: it is graded A (86/100). Read the Oneshot safety report
How do I install Oneshot?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does Oneshot need an API key?
Not as far as the registry entry and our scan can tell: no credentials are declared or required.
Is Oneshot maintained?
The last commit was 93 days ago (2026-08-02). The latest release is v0.1.2.
What can I use instead of Oneshot?
Servers from other publishers that do the same job: Emilia Protocol MCP server, Agoragentic Agent OS MCP server and three.ws Billing MCP server.
How does Oneshot compare with other AI and agents MCP servers?
safety score 86/100 (higher than 75% of 4,460 AI and agents servers); tools 3 (the typical AI and agents server has 6); tools that change things 0% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.

Alternatives to Oneshot

Same job from other publishers: the closest match first, then the best rated.

  • Emilia Protocol
    Exact-action approval for consequential agent actions: request, track, and verify signed receipts.
    B
  • Agoragentic Agent OS MCP
    Triptych OS (Agent OS) MCP for governed routing, receipts, and USDC settlement on Base.
    B
  • three.ws Billing
    An agent's account economics — plan quotas, metered usage, invoices, receipts, and earnings.
    B
  • Ausca
    Pay-per-call APIs and MCP services for agents, no accounts or keys, with verifiable receipts.
    A
  • Emulo
    Mine your AI coding session logs into a you.md profile with dated receipts, for an agent to read.
    A