An AI agent retries a call after a timeout. It never learns whether the first attempt landed — so the charge, the email, the write happens twice. We read the handler code of 86 MCP servers to find out how often that is really true: 15 fire twice, and six of those are official vendor servers. We build the layer that makes it happen exactly once, and proves it did.
Start here if you only want to stop double-charging customers on retries: npx effectfence probe --calls 12 against a server you already run — it fires the ambiguous failures on purpose and counts how many times you actually paid for one purchase. One is safe; two is the bug. Building the payment path yourself? Start with seal. Rails: none of this is Stripe-specific — the primitives sit between the agent and any irreversible call. Field work to date: x402 (USDC on Base, Solana, Stellar, and EVM facilitators), Stripe, and plain HTTP settlement.
Every number here can be checked by a stranger. The duplicate-record finding is a public issue with a reproduction on a vendor's own server; the money-path findings — including a duplicate-refund path in a payment provider's official MCP server — went to those vendors privately, because a public writeup of those is a recipe. And the failures are printed next to the successes: 84 repos we could not scan, four times our own scanner was wrong, fourteen bugs in our own code. A vendor who has never found a bug in their own system has not looked.
Products
One place to start (above), five open-source kernels behind it, and one service. Nothing on this list is a promise — each one has a command you can run or a URL you can open right now.
Write authority for agents that move money. One atomic admission per intent across processes, confirmation where the payment provider's own records — not ours — decide whether a receipt is final, and approvals where nobody can sign off on their own spend. Where the provider can't answer, it stays UNKNOWN and never quietly becomes fine.
The idempotency kernel. Exactly-once execution under real concurrency, receipts that prove what ran, and a hash-chained ledger an outsider can verify without trusting you.
Stands in front of an MCP server you already run and fences every tool call, with no change to your agent. Identical duplicates execute once; the rest are handed the recorded result instead of firing again. probe proves the race on your own server first — fire twelve identical calls and count how many effects actually landed — npx effectfence probe --calls 12.
An agent can claim anything. Its transcript already records what actually ran. Coherence reads that file, pulls out every checkable claim — “tests pass”, “pushed to main” — and rules on each one against the real exit code beside it. A claim whose evidence went through a pipe is marked weak, not green, and a file it could not read is never reported as clean. See it with no setup: coherence audit --demo.
Point it at a codebase and it reports tool calls that could fire the same effect twice — evidence and candidates, never a verdict, because an outsider usually cannot prove a double-fire from code alone.
Finds billing leaks across Shopify and Stripe for agencies — the revenue that quietly stops arriving, surfaced before the client notices.
Answers whether an opening date is real — permit and compliance clearance you can share with a landlord, a lender, or an investor.
One money path — charge, payout, send, refund — made safe to run unattended, and provable to your security reviewer. Fixed scope, fixed price, 7–10 days, one path done properly rather than a survey nobody acts on. If we cannot show you a real double-fire or reconciliation gap on a path you actually run, there is no invoice. You keep the findings either way.
Research
Published with aggregates only and no names, with every failed lookup excluded rather than counted as a zero — and a section on what a scanner fundamentally cannot see from outside a codebase. The caveats run before the analysis, not after.
A thousand real processes released by one barrier at a single Postgres, where the "payment" increments a counter that cannot lie — if two callers run, the counter says two and the run fails loudly. World confirmation is measured against live Stripe test mode rather than a mock, because a mock agrees with whatever you already believe. The hostile tests are the point: forged approval tickets, replayed tickets, someone changing the amount after it was approved, someone approving their own spend, two approvers racing to be the second vote in the same millisecond.
Six bugs in our own kernel were found this way and every one is written up in the open, including the two that a green test suite was hiding. Where a guarantee has a limit, the limit is printed next to it — a certificate says only what was actually proven, and "we don't know" never quietly becomes "it's fine."
In progress
Listed with honest status. Nothing here is sold, promised, or dated — it moves up to the products list only when there's a command you can run.
Measured, not assumed: what real providers actually do when you retry them. Resend is measured; everything else is marked unknown until it's been tested.
A per-tool declaration of retry behaviour, proposed as a superset of MCP's existing annotations rather than a competitor to them. Draft RFC — holes welcome.
Org-wide, verifiable evidence of what agents did to the world. Design stage — nothing shipped, nothing for sale.
The only question is whether you find it before your customers do. Scan your own code in one command — free, no signup, nothing sent anywhere.