What “supported” means in Once
Installation boundary: default MCP exposes eight developer assessment/setup tools and does not automatically protect sibling GitHub, Adobe or other connectors. Registered actions are opt-in; the proxy protects only reviewed/configured upstream boundaries. The default helper supports Node 20+; local SQLite proxy/actions require 24.15+. The original durable ledger is execution authority: replacement, reset or rollback may permit an effect again, even at the same path. UNKNOWN never grants permission to redispatch. Authoritative compatibility and continuity matrix.
Once uses several different integration layers. This page separates them so “supported” is not mistaken for a universal runtime guarantee.
| Framework / host | Integration example | Hostile-retry evidence | Discovery / classification | Protected runtime path |
|---|---|---|---|---|
| OpenAI Agents | Yes | No dedicated hostile-retry lab claimed here | Yes — FunctionTool structural wrapping / Connect path | Yes, when tools are routed through the supported Once local or hosted execution boundary |
| Vercel AI SDK | Yes | No dedicated hostile-retry lab claimed here | Yes — documented discovery support | Yes, when the consequential tool is routed through a supported Once boundary |
| LangChain / LangGraph | Yes | Yes — LangGraph hard-process-death / fresh-process recovery lab | Yes — documented discovery support | Yes, for the tested / integrated path |
| CrewAI | Yes | Yes — native BaseTool hostile-retry lab | Runtime discovery adapter not claimed as equivalent to protection | Yes, for the tested / integrated path |
| Microsoft Agent Framework | Yes | No dedicated hostile-retry lab claimed here | Framework integration documented | Yes, when routed through a supported Once boundary |
| Agno | Evidence-focused example | Yes — retries after successful tool execution followed by model HTTP 500 | Do not infer discovery-adapter support from the hostile-retry lab | Yes, for the released SDK path used by the lab |
| Claude Code | MCP / plugin setup | Not a framework hostile-retry benchmark | MCP-assisted assessment and setup | MCP installation alone is not protection; runtime must sit on the side-effect path |
| Cursor | Project-scoped MCP setup | Not a framework hostile-retry benchmark | MCP-assisted assessment and setup | MCP installation alone is not protection |
| Codex | Plugin / marketplace setup | Not a framework hostile-retry benchmark | Plugin teaches routing / assessment and exposes MCP | Plugin installation alone is not the runtime safety boundary |
Current automatic local protection boundary
@once-agent/sdk/connect can classify supported local tool descriptors as BYPASS, PROTECT, or fail-closed UNKNOWN, resolve trusted logical identity, bind effect-bearing data, and connect supported same-machine tool registries. Automatic protected local execution uses durable same-machine SQLite on Node.js 24.15+.
This is not a multi-host or universal exactly-once guarantee. A framework being listed here does not mean every tool, provider, transport, HTTP method, or deployment topology is automatically protected.
Evidence boundary
The strongest public framework-specific duplicate-effect evidence currently comes from the LangGraph, CrewAI, and Agno hostile-retry labs. Other entries may be integration examples or discovery support rather than equivalent crash-test evidence.
Project identity · Provider reconciliation matrix · Research · GitHub