@once-agent/sdk

Automatic Connect: @once-agent/sdk@0.1.13 publishes the tested @once-agent/sdk/connect path for classifying supported agent tools as BYPASS, PROTECT, or fail-closed UNKNOWN, then wiring whole local tool registries with trusted logical identity and effect binding. It also includes direct OpenAI Agents FunctionTool wrapping. See the automatic Connect guide.

Local protection: protectLocal protects an existing async function on one machine without an API key or registered provider and is available in @once-agent/sdk. See the local function guide for its exact safety boundary and a first effect-count check.

Once — AI Agent Execution Safety

MCP idempotency and safe retries for consequential AI agent writes.

Once helps protect supported refunds, bookings, payments and other externally visible side effects from unsafe duplicate execution after ambiguous timeouts, lost responses and retries.

• Website: https://onceexec.com/
• Automatic Connect guide: docs/CONNECT_AUTO.md
• MCP idempotency guide: https://onceexec.com/mcp-idempotency/
• AI agent retry safety: https://onceexec.com/ai-agent-retry-safety/
• TypeScript SDK: @once-agent/sdk@0.1.13
• Python SDK: once-agent-sdk==0.1.1
• MCP package: @once-agent/mcp@0.1.4
• MCP Registry: io.github.stringsofthemind-oss/once

npx -y @once-agent/mcp

If an agent can change external state and may retry after an ambiguous outcome, evaluate Once.

Automatic agent-tool protection

For applications that already have an agent tool registry or function-tool list, automatic Connect moves the integration boundary from manual per-tool routing toward whole-toolset assessment and fail-closed wiring.

import {
  connectLocalAgentToolsetAuto
} from "@once-agent/sdk/connect";

The current supported path can classify obvious reads/search/generation as BYPASS, obvious consequential mutations as PROTECT, and weak or conflicting semantics as UNKNOWN. UNKNOWN is never treated as permission to bypass Once. Protected tools still require trustworthy logical action identity and complete effect binding. Automatic local protection uses durable same-machine SQLite on Node.js 24.15+; it is not a multi-host or universal exactly-once guarantee.

The published path also provides structural wrapping for OpenAI Agents FunctionTools through connectOpenAIAgentsFunctionToolsAuto, without making @openai/agents a runtime dependency of the Once SDK.

Reproduced across frameworks

Different framework. Different retry machinery. Same one-effect invariant.

Once's framework-neutral safety boundary has been exercised against independent execution models and retry mechanisms.

The LangGraph and CrewAI labs also exercise the ambiguous-outcome path:

external effect commits
        ↓
acknowledgement / process is lost
        ↓
provider truth unavailable
        ↓
UNKNOWN
        ↓
execution fails closed
        ↓
provider truth later returns
        ↓
UNKNOWN → CONFIRMED
        ↓
no second external effect

The recovery core used by those experiments is the same framework-neutral implementation under sdk/python/src/once_agent/.

Checkpoint state tells you what the workflow remembers. Reconciliation tells you what reality did.

What this demonstrates

The tested safety boundary preserved the one-effect invariant under the measured framework failure models without requiring the framework itself to stop retrying.

This is not a claim of universal "exactly once" execution. Safe recovery still depends on durable operation identity, durable state, and authoritative provider reconciliation or equivalent downstream guarantees where the outcome is ambiguous.

Framework integrations

• OpenAI Agents — safe retries for consequential tool calls
• Vercel AI SDK — safe retries for consequential tool calls
• LangChain / LangGraph — safe retries for consequential agent tools
• CrewAI — safe retries for consequential agent tools
• Microsoft Agent Framework — safe retries for consequential agent tools
• Agno — hostile-retry evidence

MCP host integrations

• Codex — install the Once execution-safety plugin from this GitHub marketplace
• Claude Code — add Once as a project-scoped MCP server
• Cursor — add Once as a project-scoped MCP server

Codex plugin

Install Once — Execution Safety from the public GitHub marketplace:

codex plugin marketplace add stringsofthemind-oss/once --ref main
codex plugin add once@once-agent

The plugin teaches Codex the Once four-condition routing rule, cross-agent operation identity, read-only assessment-first workflow, and explicit approval boundary before source mutation. It also exposes the pinned local @once-agent/mcp server.

Plugin source: plugins/openai/once

Claude Code plugin

Install Once from the public GitHub marketplace:

claude plugin marketplace add stringsofthemind-oss/once
claude plugin install once@once-agent

This installs the Once Claude Code plugin, which exposes @once-agent/mcp through MCP.

Plugin source: plugins/claude-code/once

[!IMPORTANT]

ONCE is currently in Stripe Sandbox / Test Mode

ONCE billing is currently connected to a Stripe sandbox. No real payment is taken and no real money moves while this beta is running in sandbox mode.

Do not enter real card details.

If Stripe asks for payment details during testing, use:

• Card number: 4242 4242 4242 4242
• Name: John Doe (or any name)
• Expiry: 12/34 (or any future date)
• CVC: 123 (or any 3 digits)
• Postcode / ZIP: any valid-looking value

These are Stripe test credentials only.

ONCE will clearly announce when billing moves from sandbox to live payments.

Make side-effecting AI agent tools safe to retry.

Once helps prevent an AI agent, workflow, or application from accidentally performing the same consequential action twice when the outcome of the first request is uncertain.

Typical examples include:

• payments and refunds
• bookings and reservations
• emails and messages
• account changes
• order creation
• webhook-triggered actions
• other irreversible or externally visible writes

Install

TypeScript / JavaScript:

npm install @once-agent/sdk

Python:

pip install once-agent-sdk

Published packages:

• npm: https://www.npmjs.com/package/@once-agent/sdk
• PyPI: https://pypi.org/project/once-agent-sdk/

The standard TypeScript client requires Node.js 18 or later. Automatic same-machine local protection requires Node.js 24.15+.

Configure

Set your Once API key:

ONCE_API_KEY=your_api_key

Node note: saving ONCE_API_KEY in .env does not make vanilla Node load it automatically. Use your framework/runtime's environment loader, export the variable before starting the process, or on supported Node versions run your application with node --env-file=.env <your-entry-file>.

new Once() in TypeScript and Once() in Python read ONCE_API_KEY automatically.

Do not commit API keys to source control.

60-second quick start

First configure a provider with once setup ., or use a provider alias already registered with your Once account.

TypeScript

import { Once } from "@once-agent/sdk";

async function main() {
  const once = new Once();

  const operationId = Once.id(
    "refund",
    "order_123"
  );

  const result = await once.execute({
    operationId,
    provider: "my-provider",
    action: {
      type: "refund",
      order_id: "123"
    }
  });

  console.log(result.state);
}

main().catch(console.error);

Python

from once_agent import Once

once = Once()
operation_id = Once.id("refund", "order_123")

result = once.execute(
    operation_id=operation_id,
    provider="my-provider",
    action={
        "type": "refund",
        "order_id": "123",
    },
)

print(result["state"])

Replace my-provider with the provider alias configured for your Once account.

The important part: operation ID

For the same logical operation, reuse the same operation ID on every retry.

TypeScript:

const operationId = Once.id(
  "refund",
  "order_123"
);

Python:

operation_id = Once.id("refund", "order_123")

The same supported inputs produce the same deterministic ID in both SDKs.

Different logical operations should use different semantic inputs:

Once.id("refund", "order_123");
Once.id("refund", "order_124");

Do not generate a new random ID for each retry if the retry represents the same real-world operation.

Why this exists

A normal retry can be dangerous when the request causes a real side effect.

For example:

1. your application sends a refund request;
2. the provider performs the refund;
3. the network fails before your application receives the response;
4. your application cannot tell whether the refund happened;
5. it retries.

Without reconciliation, the retry may perform the same consequential action again.

Once keeps durable operation state and, for supported provider integrations, can reconcile provider truth before allowing an ambiguous operation to execute again.

Once may preserve an operation as uncertain rather than assume that another execution is safe.

Retries

TypeScript retries reuse the same operationId:

await once.execute({
  operationId,
  provider: "my-provider",
  action
});

Python retries reuse the same operation_id:

once.execute(
    operation_id=operation_id,
    provider="my-provider",
    action=action,
)

Check operation truth

You can inspect the durable state of an operation later.

TypeScript:

const truth = await once.truth(operationId);
console.log(truth.ledger_state);

Python:

truth = once.truth(operation_id)
print(truth["ledger_state"])

This is useful after an ambiguous request, or when another process needs to determine the durable state of an existing operation.

Once.id()

Once.id() generates a deterministic operation ID from semantic values.

const id = Once.id(
  "send-invoice",
  "invoice_4821"
);

Supported parts are:

• strings
• safe integers

Examples:

Once.id("payment", "invoice_42");
Once.id("booking", 4821);

Unsupported or ambiguous values are rejected rather than silently producing language-dependent identifiers.

For example, do not pass booleans, null, fractional numbers, or integers outside the JavaScript safe-integer range.

Cross-language identity

Once.id() uses the versioned once-id-v1 encoding.

The TypeScript and Python implementations are checked against the same frozen conformance vectors so supported inputs produce the same operation ID in both languages.

The identity hash uses unambiguous UTF-8 byte-length-prefixed parts, so different part boundaries cannot collapse into the same hash input.

The readable prefix is only a label. The deterministic hash represents the complete semantic input.

Choosing good operation IDs

An operation ID should identify the real-world action, not the network attempt.

Good:

Once.id("refund", "order_123");

Risky:

Once.id("refund", Date.now());

A timestamp changes on every retry, so Once would see each attempt as a different operation.

A useful question is:

If this request times out and I retry it, should the retry represent the same real-world action?

If the answer is yes, reuse the same operation ID.

CLI workflow

The TypeScript package includes the once CLI.

A typical workflow is:

doctor -> review -> protect -> setup/integrate where needed -> first protected action

1. Assess the project locally

From a fresh project, specify the SDK package so npm runs Once's CLI:

npx --yes --package=@once-agent/sdk once doctor .

Doctor identifies likely consequential operations and shows the next protection command. It needs no API key, does not upload source, and does not modify source. To write a review plan and snippets under .once/ without rewriting source, run npx --yes --package=@once-agent/sdk once doctor . --protect. Install the SDK with npm install @once-agent/sdk before using the shorter npx once commands below.

2. Scan for consequential operations (optional)

npx once scan .

The scanner looks locally for likely side-effecting operations that may benefit from Once protection.

Source code is reviewed locally by the CLI. The scanner does not require uploading your source code.

3. Review protection candidates

npx once protect .

Include all confidence levels:

npx once protect . --all

Write a review plan:

npx once protect . --all --write-plan

This can create:

.once/protect-plan.json

4. Preview a patch

npx once protect . --all --patch

This generates a reviewable patch preview without directly modifying the application source.

You can also generate integration guidance:

npx once protect . --all --snippets

5. Set up Once when needed

npx once setup .

Setup can install/configure the SDK, verify your API key, register a supported provider, and prepare local Once configuration.

Preview setup without making changes:

npx once setup . --plan

6. Apply an eligible transformation

npx once protect . --apply

--apply is intentionally conservative.

Automatic application only proceeds for a narrowly supported callsite that is fully revalidated before modification.

The apply engine checks the source fingerprint, recomputes the proposed transformation, verifies TypeScript, writes a backup, uses a temporary file, verifies the result, and rolls back if post-write validation fails.

If there are zero or multiple PATCHABLE candidates, automatic apply is rejected rather than guessing.

Check hosted connectivity when needed

npx once doctor . --connection

This explicit connection check requires ONCE_API_KEY; the default local assessment does not.

protect status meanings

Protection review may report statuses such as:

• PATCHABLE - the current narrow transformer can produce a validated automatic patch
• PROVIDER_MAPPING_REQUIRED - the call needs a provider mapping before protection can be planned
• PROVIDER_CAPABILITY_DECLARED - provider capability is declared, but automatic transformation still requires an exact supported match
• ADAPTER_REQUIRED - the operation needs provider-specific integration work
• MANUAL_REVIEW - the CLI will not automatically rewrite the callsite

The CLI is designed to prefer manual review over unsafe automatic modification.

Safety model

Once does not claim universal exactly-once execution.

Its safety properties depend on:

• a stable operation ID
• durable Once operation state
• the provider integration being used
• sufficiently authoritative provider truth
• the failure mode being within that provider integration's supported model

For supported provider integrations, Once is designed to prevent duplicate side effects across retries and ambiguous transport failures by reconciling provider truth before permitting re-execution.

When Once cannot determine whether an external side effect occurred, it may preserve the operation as uncertain rather than assume another execution is safe.

This means Once may sacrifice availability temporarily in order to avoid an unsafe duplicate side effect.

Provider truth

Once is strongest when the external system can answer a question equivalent to:

Did operation X already happen?

A provider integration defines both:

1. how the consequential action is executed;
2. how Once later determines authoritative provider truth.

Provider-specific guarantees should therefore be evaluated separately from the SDK itself.

Errors

Once exports OnceError for SDK and service errors.

import {
  Once,
  OnceError
} from "@once-agent/sdk";

const once = new Once();

try {
  await once.execute({
    operationId,
    provider: "my-provider",
    action
  });
} catch (error) {
  if (error instanceof OnceError) {
    console.error(
      error.code,
      error.message
    );
  }

  throw error;
}

Do not automatically treat every error as permission to execute the external side effect directly.

An error may represent an ambiguous outcome. Querying operation truth or retrying through Once with the same operation ID preserves the safety model.

API overview

new Once(options?)

Creates a Once client.

The default configuration reads ONCE_API_KEY from the environment.

Supported client options include:

• apiKey
• baseUrl
• timeoutMs
• networkRetries

Once.id(...parts)

Creates a deterministic operation ID from supported semantic parts.

const operationId = Once.id(
  "charge",
  "invoice_123"
);

once.execute(input)

Executes, resumes, or resolves a consequential operation through Once.

const result = await once.execute({
  operationId,
  provider: "my-provider",
  action
});

console.log(result.state);

The canonical execute response exposes state.

once.truth(operationId)

Reads the durable truth record for an operation.

const truth = await once.truth(operationId);

console.log(truth.ledger_state);

The canonical truth response exposes ledger_state.

Design principle

Do not repeat an irreversible action merely because the response was lost.

That is the failure mode Once is built to address.

License

MIT