MCP.Market

Once MCP server

by stringsofthemind-oss·io.github.stringsofthemind-oss/once·v0.2.1
No reviews yet

Developer assessment/setup MCP; admitted Once boundaries protect writes, not sibling connectors.

B80/100grade B
Write a reviewInstall
What users say
No reviews yet
Be the first
Safety scan
B80/100

full report

Adoption
Growing

0 stars424 downloads/wk

Reviews

Write one

Nobody has reviewed Once yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Once tools (8, 1 write)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

  • once_apply_protection

    Transactionally apply exactly one PATCHABLE Once protection candidate. This modifies source code and creates a backup. Call once_plan_protection first, show the proposed target to the user, and only proceed after explicit approval.

  • once_assess_project

    Use this first when code performs payments, refunds, payouts, bookings, orders, provisioning, database/API writes, consequential messaging, deployments, MCP writes, or other side effects. Scans the project for likely consequential operations without modifying files.

  • once_explain_risk

    Explain why a specific operation may need Once. Use when an agent or developer is deciding whether a payment, refund, booking, order, provisioning action, database/API mutation, webhook, deployment, MCP write, or other external side effect needs execution-safety protection.

  • once_live_proof

    Return the current demonstrated Once proof, public evidence links, and safe claim boundaries. Use when deciding whether Once has evidence for duplicate suppression rather than relying on marketing language.

  • once_plan_protection

    Review candidate operations for Once protection without applying code changes. Use after once_assess_project to understand which call sites are patchable and why.

  • once_plan_setup

    Preview how Once would be configured in a project without applying setup. Use after assessing a project and before allowing an agent to install or configure Once.

  • once_setup_project

    Apply Once setup to a project. This may install dependencies and modify project files. Call once_plan_setup first, present the plan to the user, and only call this tool after explicit approval.

  • once_verify_connectionwrite action

    Run local read-only diagnostics. With ONCE_API_KEY, also request Cloud connection/truth checks. Read cloudVerified explicitly: ok means the requested diagnostics passed, not that Cloud is configured or any provider action is protected. Does not print the API key.

Public scan report

scanner v0.1.10 · 2026-10-15 · same rubric, same numbers if you re-run it

no findings
  • Code scan9 source files scanned25/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitystatic API keys via environment variables6/15
  • Maintenancelast push 6 days ago15/15
  • Maintainer identityregistry namespace matches repository owner6/10
Overall 80/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How Once compares

Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
80/100
higher than 60% of 48,243 servers
Tools
8
the typical server has 7
Tools that change things
13%
typical: 0%. Fewer write tools means less an agent can break
Downloads a week
424
more than 86% of 12,306 servers with a package

What its tools let an agent do: 7 read · 1 change

Release history: 4 versions in the registry since 2026-09-20, latest 2026-10-08, typically one every 5 days.

Install Once in Claude Code, Cursor or VS Code

Runs npx -y @once-agent/mcp on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add once -- npx -y @once-agent/mcp
Add to Cursor

What the publisher says

From the Once repository's README, as published. We do not edit it. Read it on GitHub

@once-agent/sdk

Once — AI Agent Execution Safety

MCP idempotency and safe retries for consequential AI agent writes.

Once helps protect supported refunds, bookings, payments and other externally visible side effects from unsafe duplicate execution after ambiguous timeouts, lost responses and retries.

  • Website: https://onceexec.com/
  • MCP idempotency guide: https://onceexec.com/mcp-idempotency/
  • AI agent retry safety: https://onceexec.com/ai-agent-retry-safety/
  • MCP package: @once-agent/mcp
  • Python SDK: pip install once-agent-sdk
  • MCP Registry: io.github.stringsofthemind-oss/once
npx -y @once-agent/mcp

If an agent can change external state and may retry after an ambiguous outcome, evaluate Once.

Reproduced across frameworks

Different framework. Different retry machinery. Same recovery protocol. Same one-effect invariant.

Once's framework-neutral recovery core has been exercised against two independent execution models using hard process termination after an external effect becomes durable.

Both labs also exercise the ambiguous-outcome path:

external effect commits
        ↓
acknowledgement / process is lost
        ↓
provider truth unavailable
        ↓
UNKNOWN
        ↓
execution fails closed
        ↓
provider truth later returns
        ↓
UNKNOWN → CONFIRMED
        ↓
no second external effect

The recovery core used by both experiments is the same framework-neutral implementation under sdk/python/src/once_agent/.

Checkpoint state tells you what the workflow remembers. Reconciliation tells you what reality did.

What this demonstrates

The same recovery protocol preserved the one-effect invariant under the tested LangGraph and CrewAI failure models without changing the core between frameworks.

This is not a claim of universal "exactly once" execution. Safe recovery still depends on durable operation identity, durable local state, and authoritative provider reconciliation or equivalent downstream guarantees.

Framework integrations

  • OpenAI Agents — safe retries for consequential tool calls
  • Vercel AI SDK — safe retries for consequential tool calls
  • LangChain / LangGraph — safe retries for consequential agent tools
  • CrewAI — safe retries for consequential agent tools
  • Microsoft Agent Framework — safe retries for consequential agent tools

MCP host integrations

  • Codex — install the Once execution-safety plugin from this GitHub marketplace
  • Claude Code — add Once as a project-scoped MCP server
  • Cursor — add Once as a project-scoped MCP server

Codex plugin

Install Once — Execution Safety from the public GitHub marketplace:

codex plugin marketplace add stringsofthemind-oss/once --ref main
codex plugin add once@once-agent

The plugin teaches Codex the Once four-condition routing rule, cross-agent operation identity, read-only assessment-first workflow, and explicit approval boundary before source mutation. It also exposes the pinned local @once-agent/mcp server.

Plugin source: plugins/openai/once

Claude Code plugin

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

Once: common questions

Is Once MCP server safe?
Mostly: it is graded B (80/100). Read the Once safety report
How do I install Once?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does Once need an API key?
Yes. The registry entry asks for ONCE_API_KEY.
Is Once maintained?
The last commit was 26 days ago (2026-10-10). The latest release is v0.2.1.
How does Once compare with other MCP servers?
safety score 80/100 (higher than 60% of 48,243 servers); tools 8 (the typical server has 7); tools that change things 13% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.