Safeagent

io.github.azender1由 GitHub 帳號 azender1 發布v0.1.22更新於 Oct 27, 2026

Exactly-once execution guard for AI agents. Prevents duplicate payments and webhooks on retry.

已驗證STDIO僅桌面開發者工具安全與監控

服務詳細資訊

識別碼: io.github.azender1/safeagent
傳輸: STDIO
執行環境: Desktop only
信任: Verified
發布於: Sep 16, 2026

安全提示

MCP 服務會接收對話中的工具呼叫請求，並可能執行外部操作。啟用前請先了解該服務能做什麼，並只授予它所需的權限。

註冊中心已驗證此條目所屬的 GitHub 帳號 azender1。這並不表明該帳號就是產品方。

SourceWeft 的檢查只涵蓋條目是否完整、端點是否回應；不審查伺服器的程式碼，也不審查其工具的行為。

在 README 中新增徽章

向讀者展示該 MCP 服務已收錄於 SourceWeft，徽章連結到本頁。

[![Listed on SourceWeft](https://sourceweft.com/badge/mcp/io.github.azender1%2Fsafeagent.svg)](https://sourceweft.com/mcp/io.github.azender1%2Fsafeagent?utm_source=readme&utm_medium=badge)

概覽

AI 產生的概覽

本機 Python 執行守衛，讓助理依穩定的 request_id 認領、結算與稽核動作，避免重試時重複執行。

可以做什麼: 以穩定的 request_id 認領動作，首次回傳 PROCEED，重複呼叫回傳 SKIP
動作執行後結算認領，將狀態由 PENDING 推進為 COMMITTED 並保存結果
依代理、動作類型、狀態或時間範圍查詢認領紀錄
使用每個 IP 限 10 次的免費測試認領端點
改用內嵌 SQLite 資料表在本機執行相同的認領邏輯，不需網路呼叫
適用情境: 適用於代理會重試付款、郵件、Webhook、下單或資源開通等具副作用的步驟，且重複執行代價高昂的情境。也適合希望在外部呼叫前後留下持久認領紀錄，或在 Python 代理中直接採用本機 SQLite 守衛模式的開發者。
執行需求: 以本機 Python 套件形式透過 stdio 執行（pip install safeagent-exec-guard）。託管 API 需經網路存取一個公開端點；未宣告任何 API 金鑰、標頭或環境變數。README 另提供不需網路呼叫的內嵌 SQLite 方案。

安裝前請注意

README 說明其保證僅涵蓋本機認領狀態，而非外部結果：PENDING 代表未決，端到端恰好一次仍須依賴服務商原生冪等或對帳。request_id 與動作中繼資料會傳送至第三方託管服務，已完成動作還會錨定到外部帳本。免費測試端點每個 IP 限 10 次。

安裝

在 SourceWeft 中

開啟儀表板中的 Safeagent，將其新增到工作區。
為需要使用其工具的對話啟用該服務。

Desktop only，透過 STDIO。 STDIO 服務會啟動本機處理程序，因此需要 SourceWeft 桌面主機。

其他 MCP 客戶端

參照儲存庫中的啟動說明。

README

SafeAgent — Execution Guard for AI Agents

[Mycelium Provider]

POST /claim · safeagent-production.up.railway.app
Dashboard: safeagent-dashboard-2.vercel.app

bash

# Claim an action — free, no payment header requiredcurl -s -X POST https://safeagent-production.up.railway.app/claim \  -H "Content-Type: application/json" \  -d '{"request_id":"order:TQQQ:buy:6:2026-05-19T13:31:00-04:00","action":"order"}'# → {"status":"PROCEED","request_id":"..."}
# Settle after the action firescurl -s -X POST https://safeagent-production.up.railway.app/settle/order:TQQQ:buy:6:2026-05-19T13:31:00-04:00 \  -H "Content-Type: application/json" \  -d '{"result":{"status":"completed"}}'# → {"status":"committed","request_id":"..."}
# Retry with the same request_id — returns SKIPcurl -s -X POST https://safeagent-production.up.railway.app/claim \  -H "Content-Type: application/json" \  -d '{"request_id":"order:TQQQ:buy:6:2026-05-19T13:31:00-04:00","action":"order"}'# → {"status":"SKIP","request_id":"...","existing":{...}}
# Free test endpoint — same logic, limited to 10 calls per IPcurl -s -X POST https://safeagent-production.up.railway.app/claim/test \  -H "Content-Type: application/json" \  -d '{"agent_id":"bot-1","action_type":"order","scope":"TQQQ:buy:bar:2026-05-19T13:31:00-04:00"}'# → {"status":"PROCEED","request_id":"...","test":true,"calls_remaining":9}

# Claim an action — free, no payment header requiredcurl -s -X POST https://safeagent-production.up.railway.app/claim \  -H "Content-Type: application/json" \  -d '{"request_id":"order:TQQQ:buy:6:2026-05-19T13:31:00-04:00","action":"order"}'# → {"status":"PROCEED","request_id":"..."}
# Settle after the action firescurl -s -X POST https://safeagent-production.up.railway.app/settle/order:TQQQ:buy:6:2026-05-19T13:31:00-04:00 \  -H "Content-Type: application/json" \  -d '{"result":{"status":"completed"}}'# → {"status":"committed","request_id":"..."}
# Retry with the same request_id — returns SKIPcurl -s -X POST https://safeagent-production.up.railway.app/claim \  -H "Content-Type: application/json" \  -d '{"request_id":"order:TQQQ:buy:6:2026-05-19T13:31:00-04:00","action":"order"}'# → {"status":"SKIP","request_id":"...","existing":{...}}
# Free test endpoint — same logic, limited to 10 calls per IPcurl -s -X POST https://safeagent-production.up.railway.app/claim/test \  -H "Content-Type: application/json" \  -d '{"agent_id":"bot-1","action_type":"order","scope":"TQQQ:buy:bar:2026-05-19T13:31:00-04:00"}'# → {"status":"PROCEED","request_id":"...","test":true,"calls_remaining":9}

Indexed on Bazaar.

Measured CrewAI retry A/B

A credential-free experiment exercises CrewAI 1.15.21's actual same-process `ToolUsage._use` retry against SafeAgent 0.1.23. Across 30 post-effect/pre-confirmation trials, the unguarded path recorded two effects per logical action; the SafeAgent path recorded one effect and retained a `PENDING` claim for reconciliation.

Scope: scripted deterministic LLM and harmless effect recorded through an out-of-process capability-separated ledger. This does not validate process death, fresh-worker recovery, a real external provider, or SafeAgent Control reconciliation.

Method, source, tests, hashes, and 180-trial evidence

SafeAgent Control founding pilots

Two bounded, read-only reconciliation pilots are open for outside operators. There is no fee unless SafeAgent Control identifies a previously unknown, reproducible discrepancy that the operator agrees is actionable.

Scope and outcome-based terms

Mycelium Trails

This implementation is a Mycelium Provider. Each completed action submits a trail to ARGENTUM with a content-addressed action_ref (JCS+SHA-256 over the four preimage fields). The returned mycelium_trail_id is included in every receipt for independent verification.

Verified on Soma

SafeAgent is the first verified external integrator on Soma — the Mycelium agent catalog. Every production execution is anchored on-chain via Mycelium Trails and independently verifiable without going through the operator.

Integrator badge — verified external client running Mycelium Trails in production
Live trails — https://argentum-api.rgiskard.xyz/dashboard/trails?client=safeagent-prod
Public audit — any auditor can verify SafeAgent executions independently

What it does

SafeAgent is a durable execution-claim guard. It suppresses concurrent and repeated attempts that use the same stable request_id, and preserves unresolved attempts for reconciliation instead of silently retrying them.

Every action gets a stable request_id derived from the logical action. A new key returns PROCEED; a settled key returns SKIP with its stored result. A key left PENDING after a timeout or crash remains blocked because local state alone cannot prove whether the provider accepted the action. Recover it only after checking provider evidence or using provider-native idempotency.

State machine: CLAIMABLE → PENDING → COMMITTED; later claims observe PENDING or SKIP.

Common failure modes SafeAgent prevents:

Scenario	Without SafeAgent	With SafeAgent
Stripe charge times out after acceptance	Retry may charge twice	Same key remains PENDING until provider reconciliation
Welcome email on signup retried	User gets two welcome emails	Second send returns SKIP
Webhook delivered twice (Stripe/GitHub/Twilio guarantee at-least-once)	Event processed twice	Second processing returns SKIP
Workspace provisioned on retry	Two workspaces created	Second provision returns SKIP
AI agent tool call retried after crash	Duplicate side effect	Same key stays blocked; outcome is explicitly unresolved

Guarantee boundary: SafeAgent proves local claim state, not the external outcome. COMMITTED means the caller settled a receipt. PENDING means unresolved—not failed and not confirmed successful. End-to-end exactly-once effects require provider-native idempotency and/or reconciliation with the provider's authoritative records.

The stack

SafeAgent is the durable claim and duplicate-suppression layer in an agent execution integrity stack:

Polaris (commit-gated authorization)└── AgentGraph safety verdict (pre-execution safety gate)    └── SafeAgent (durable claim guard)  ← you are here        └── Mycelium Trails (on-chain anchor)

Polaris (commit-gated authorization)└── AgentGraph safety verdict (pre-execution safety gate)    └── SafeAgent (durable claim guard)  ← you are here        └── Mycelium Trails (on-chain anchor)

Each layer is independently authored and independently verifiable. None trusts the others.

API

POST /claim

Gate an action. Returns PROCEED on first call, SKIP on any repeat.

Request body:

request_id — stable identifier derived from what the agent is doing. Same inputs = same key.
action — the action type being gated (e.g. payment.send, email, trade, order)

Response:

Retry with the same payload:

json

{ "status": "SKIP", "request_id": "order:TQQQ:buy:6:2026-05-19T13:31:00-04:00", "existing": {...} }

{ "status": "SKIP", "request_id": "order:TQQQ:buy:6:2026-05-19T13:31:00-04:00", "existing": {...} }

POST /settle/{request_id}

Settle a claim after the action fires. Advances status from PENDING to COMMITTED.

bash

curl -s -X POST https://safeagent-production.up.railway.app/settle/order:TQQQ:buy:6:2026-05-19T13:31:00-04:00 \  -H "Content-Type: application/json" \  -d '{"result":{"status":"completed","txid":"abc123"}}'

curl -s -X POST https://safeagent-production.up.railway.app/settle/order:TQQQ:buy:6:2026-05-19T13:31:00-04:00 \  -H "Content-Type: application/json" \  -d '{"result":{"status":"completed","txid":"abc123"}}'

POST /claim/test

Free test endpoint — same logic, no payment required. Limited to 10 calls per IP total.

bash

curl -s -X POST https://safeagent-production.up.railway.app/claim/test \  -H "Content-Type: application/json" \  -d '{"agent_id":"bot-1","action_type":"order","scope":"TQQQ:buy:6:bar:2026-05-19T13:31:00-04:00"}'

curl -s -X POST https://safeagent-production.up.railway.app/claim/test \  -H "Content-Type: application/json" \  -d '{"agent_id":"bot-1","action_type":"order","scope":"TQQQ:buy:6:bar:2026-05-19T13:31:00-04:00"}'

GET /audit

Full claim history. Filter by agent_id, action, status, or timestamp range.

Parameters: agent_id, action, status, from_ts, to_ts, limit (max 1000), offset.

Integration

Python

python

import requests
def claim(request_id: str, action: str) -> dict:    r = requests.post(        "https://safeagent-production.up.railway.app/claim",        headers={"Content-Type": "application/json"},        json={"request_id": request_id, "action": action}    )    return r.json()  # {"status": "PROCEED"|"SKIP", "request_id": "..."}
def settle(request_id: str, result: dict) -> dict:    r = requests.post(        f"https://safeagent-production.up.railway.app/settle/{request_id}",        headers={"Content-Type": "application/json"},        json={"result": result}    )    return r.json()
# Usageresponse = claim("payment:customer-123:invoice-456", "payment.send")if response["status"] == "PROCEED":    result = send_payment(...)    settle("payment:customer-123:invoice-456", {"status": "completed"})elif response["status"] == "SKIP":    print("Already executed, skipping")

import requests
def claim(request_id: str, action: str) -> dict:    r = requests.post(        "https://safeagent-production.up.railway.app/claim",        headers={"Content-Type": "application/json"},        json={"request_id": request_id, "action": action}    )    return r.json()  # {"status": "PROCEED"|"SKIP", "request_id": "..."}
def settle(request_id: str, result: dict) -> dict:    r = requests.post(        f"https://safeagent-production.up.railway.app/settle/{request_id}",        headers={"Content-Type": "application/json"},        json={"result": result}    )    return r.json()
# Usageresponse = claim("payment:customer-123:invoice-456", "payment.send")if response["status"] == "PROCEED":    result = send_payment(...)    settle("payment:customer-123:invoice-456", {"status": "completed"})elif response["status"] == "SKIP":    print("Already executed, skipping")

SaaS (Stripe / email / webhooks)

For production Stripe PaymentIntents, use the permit-gated adapter documented in SafeAgent Boundary. It keeps the Stripe credential outside the agent, passes the consumed permit ID to Stripe as the native idempotency key, persists the provider correlation, verifies webhook signatures and supports authoritative read-back. The simple claim/settle snippet below illustrates the generic API only; it is not the provider adapter.

Run the bounded test-mode example in examples/stripe_payment_intent_guard.py. The verification record documents the observed end-to-end result: one successful Stripe sandbox PaymentIntent, an exact replay blocked before provider dispatch, and authoritative reconciliation by retrieve.

python

import requests
def safe_stripe_charge(customer_id, amount, idempotency_key):    request_id = f"stripe:charge:{customer_id}:{idempotency_key}"
    response = requests.post(        "https://safeagent-production.up.railway.app/claim",        headers={"Content-Type": "application/json"},        json={"request_id": request_id, "action": "stripe_charge"}    ).json()
    if response["status"] == "SKIP":        return response.get("existing")
    charge = stripe.PaymentIntent.create(        amount=amount,        currency="usd",        customer=customer_id,        idempotency_key=request_id,    )    requests.post(        f"https://safeagent-production.up.railway.app/settle/{request_id}",        headers={"Content-Type": "application/json"},        json={"result": {"charge_id": charge.id}}    )    return charge

import requests
def safe_stripe_charge(customer_id, amount, idempotency_key):    request_id = f"stripe:charge:{customer_id}:{idempotency_key}"
    response = requests.post(        "https://safeagent-production.up.railway.app/claim",        headers={"Content-Type": "application/json"},        json={"request_id": request_id, "action": "stripe_charge"}    ).json()
    if response["status"] == "SKIP":        return response.get("existing")
    charge = stripe.PaymentIntent.create(        amount=amount,        currency="usd",        customer=customer_id,        idempotency_key=request_id,    )    requests.post(        f"https://safeagent-production.up.railway.app/settle/{request_id}",        headers={"Content-Type": "application/json"},        json={"result": {"charge_id": charge.id}}    )    return charge

Webhook deduplication — stable event IDs suppress repeated processing after a settled result; unresolved PENDING events stay blocked for investigation:

python

def handle_stripe_webhook(event):    response = requests.post(        "https://safeagent-production.up.railway.app/claim",        headers={"Content-Type": "application/json"},        json={"request_id": event["id"], "action": "stripe_event"}    ).json()
    if response["status"] == "SKIP":        return {"ok": True}
    provision_subscription(event)    requests.post(        f"https://safeagent-production.up.railway.app/settle/{event['id']}",        headers={"Content-Type": "application/json"},        json={"result": {"processed": True}}    )

def handle_stripe_webhook(event):    response = requests.post(        "https://safeagent-production.up.railway.app/claim",        headers={"Content-Type": "application/json"},        json={"request_id": event["id"], "action": "stripe_event"}    ).json()
    if response["status"] == "SKIP":        return {"ok": True}
    provision_subscription(event)    requests.post(        f"https://safeagent-production.up.railway.app/settle/{event['id']}",        headers={"Content-Type": "application/json"},        json={"result": {"processed": True}}    )

CrewAI

python

from crewai import Agentimport sqlite3
guard_con = sqlite3.connect("safeagent_orders.db", check_same_thread=False)# ... same guard pattern, keyed on tool_name + input hash + session_id

from crewai import Agentimport sqlite3
guard_con = sqlite3.connect("safeagent_orders.db", check_same_thread=False)# ... same guard pattern, keyed on tool_name + input hash + session_id

PR crewAIInc/crewAI#5822 adds pluggable idempotency backends. SafeAgent's SQLite schema is compatible.

WisePick

WisePick is a deterministic routing layer for agent runtimes. The integration splits capability selection from durable, idempotent execution — WisePick answers what and which provider, SafeAgent answers whether this logical work already ran.

Stack:

Adapter: adapters/safeagent_adapter.py
Integration docs: docs/integrations/safeagent.md
Integration thread: SafeAgent #9

Local guard (embedded SQLite)

The same durable claim behavior without the network call. Drop this into any Python agent:

python

import jsonimport sqlite3
_SA_DB = "safeagent_orders.db"_sa_con = sqlite3.connect(_SA_DB, check_same_thread=False)_sa_con.execute("""CREATE TABLE IF NOT EXISTS orders (    request_id TEXT PRIMARY KEY,    result     TEXT,    status     TEXT DEFAULT 'PENDING',    created_at TEXT DEFAULT (datetime('now')))""")_sa_con.commit()
def place_order_with_guard(symbol, qty, side, bar_ts):    request_id = f"order:{symbol}:{side}:{qty}:{bar_ts}"
    cur = _sa_con.execute(        "INSERT OR IGNORE INTO orders (request_id, status) VALUES (?, 'PENDING')",        (request_id,)    )    _sa_con.commit()
    if cur.rowcount == 0:        row = _sa_con.execute(            "SELECT status, result FROM orders WHERE request_id = ?",            (request_id,)        ).fetchone()        if row and row[0] == 'COMMITTED':            print(f"SAFEAGENT SKIP: {request_id}")            return row[1]        raise RuntimeError(            f"SAFEAGENT BLOCKED: unresolved PENDING claim for {request_id}"        )
    result = place_order(symbol, qty, side)
    _sa_con.execute(        "UPDATE orders SET status='COMMITTED', result=? WHERE request_id=?",        (json.dumps(str(result)), request_id)    )    _sa_con.commit()    return result

import jsonimport sqlite3
_SA_DB = "safeagent_orders.db"_sa_con = sqlite3.connect(_SA_DB, check_same_thread=False)_sa_con.execute("""CREATE TABLE IF NOT EXISTS orders (    request_id TEXT PRIMARY KEY,    result     TEXT,    status     TEXT DEFAULT 'PENDING',    created_at TEXT DEFAULT (datetime('now')))""")_sa_con.commit()
def place_order_with_guard(symbol, qty, side, bar_ts):    request_id = f"order:{symbol}:{side}:{qty}:{bar_ts}"
    cur = _sa_con.execute(        "INSERT OR IGNORE INTO orders (request_id, status) VALUES (?, 'PENDING')",        (request_id,)    )    _sa_con.commit()
    if cur.rowcount == 0:        row = _sa_con.execute(            "SELECT status, result FROM orders WHERE request_id = ?",            (request_id,)        ).fetchone()        if row and row[0] == 'COMMITTED':            print(f"SAFEAGENT SKIP: {request_id}")            return row[1]        raise RuntimeError(            f"SAFEAGENT BLOCKED: unresolved PENDING claim for {request_id}"        )
    result = place_order(symbol, qty, side)
    _sa_con.execute(        "UPDATE orders SET status='COMMITTED', result=? WHERE request_id=?",        (json.dumps(str(result)), request_id)    )    _sa_con.commit()    return result

Case study: crash-retry duplicate prevention

A trading bot fires a market order to buy 6 shares of TQQQ. The broker accepts it. The bot crashes before updating state. On restart — same signal, same bar — the bot fires again. The broker fills it twice. The agent now holds 12 shares when it intended to hold 6.

This is not theoretical. It happens on any unhandled exception between order submission and state persistence.

SafeAgent derives a stable key before touching the broker:

First call: PROCEED. Side effect fires. Settle writes COMMITTED.
Crash and retry: SKIP. Broker never touched again.

Case study: live duplicate blocking — May 21, 2026

Six confirmed SKIP events from a live session on the full stack: DashClaw, SafeAgent, Mycelium Trails, Base/Arbitrum, broker Alpaca.

0942 ET: duplicate buy TQQQ qty=6 blocked, $452
0947 ET: duplicate add TQQQ qty=6 blocked, $452
0949 ET: duplicate sell TQQQ qty=12 on flip, $902
1000 ET: duplicate entry TQQQ qty=6 blocked, $454
1014 ET: duplicate sell TQQQ qty=18 on V20 flip, $1,350
1106 ET: duplicate SQQQ add during scale-in, $43

Full session data: https://gist.github.com/azender1/b9112b6519c935df4a75cb05cd250e26

Conformance

SafeAgent participates in the A2A cross-implementation conformance corpus. Byte-verified fixtures across four independent implementations:

kenneives (agentgraph) — verifier-attestation-v0: 30/30 ✓
evidai (LemonCake) — gated-preflight-v1: 33/33 ✓
haroldmalikfrimpong-ops (agentid) — independent verifier ✓
SafeAgent — claim-lifecycle conformance v1.1 ✓

A2A #1920 closed. All four implementations satisfy freshness and replay requirements.

Canonical `action_ref` derivation

JCS (RFC 8785), aligned with argentum-core, Nobulex, and APS:

python

import hashlibimport rfc8785
def compute_action_ref(    agent_id: str,    action_type: str,    scope: str,    timestamp: str,  # RFC 3339 UTC, 3-digit ms: "2026-05-15T10:00:00.123Z") -> str:    payload = {        "agent_id": agent_id,        "action_type": action_type,        "scope": scope,        "timestamp": timestamp,    }    canonical = rfc8785.dumps(payload)    return hashlib.sha256(canonical).hexdigest()

import hashlibimport rfc8785
def compute_action_ref(    agent_id: str,    action_type: str,    scope: str,    timestamp: str,  # RFC 3339 UTC, 3-digit ms: "2026-05-15T10:00:00.123Z") -> str:    payload = {        "agent_id": agent_id,        "action_type": action_type,        "scope": scope,        "timestamp": timestamp,    }    canonical = rfc8785.dumps(payload)    return hashlib.sha256(canonical).hexdigest()

timestamp is an RFC 3339 UTC string with exactly 3 millisecond digits. The trailing Z is mandatory.

Conformance fixtures: giskard09/argentum-core tag action-ref-v1.0

Deployment

Railway · Serverless OFF · always-on
PyPI: pip install safeagent-exec-guard
npm: npm install n8n-nodes-safeagent
MCP Registry: io.github.azender1/safeagent
Dashboard: safeagent-dashboard-2.vercel.app

License

Apache-2.0

來源：README.md，提交 2dfd694

工具

SourceWeft 尚未在沙箱中啟動過該軟體包，因此其工具未知。

版本歷史

v0.1.22最新Sep 16, 2026

評分

已滿足適用檢查項的 50%

該評分衡量此收錄條目的完整程度，依據註冊中心條目、端點與公開來源計算得出。它不是對伺服器本身的評價，也不表示伺服器安全或目前可用：可連通性是帶日期的檢查結果，評分也不包含安裝量或使用者評價。

近 30 天內可連通25 分
請保持端點能夠回應 MCP 握手；SourceWeft 每 30 天探測一次。
已宣告認證方式10 分
請在註冊中心條目中宣告憑證請求標頭，或保持端點能夠回應探測，以便判定其認證方式。
已列出工具15 分
請讓伺服器在無憑證時回應 tools/list，或發布可在沙箱中無憑證啟動的軟體包。
描述必需15 分
圖示10 分
文件15 分
授權條款10 分

Safeagent

概覽

安裝

在 SourceWeft 中

其他 MCP 客戶端

README

SafeAgent — Execution Guard for AI Agents

Measured CrewAI retry A/B

SafeAgent Control founding pilots

Mycelium Trails

Verified on Soma

What it does

The stack

API

POST /claim

POST /settle/{request_id}

POST /claim/test

GET /audit

Integration

Python

SaaS (Stripe / email / webhooks)

CrewAI

WisePick

Local guard (embedded SQLite)

Case study: crash-retry duplicate prevention

Case study: live duplicate blocking — May 21, 2026

Conformance

Canonical action_ref derivation

Deployment

License

工具

版本歷史

評分

Canonical `action_ref` derivation