What “supported” means in Once
Installation boundary: default MCP exposes eight developer assessment/setup tools and does not automatically protect sibling GitHub, Adobe or other connectors. Registered actions are opt-in; the proxy protects only reviewed/configured upstream boundaries. The default helper supports Node 20+; local SQLite proxy/actions require 24.15+. The original durable ledger is execution authority: replacement, reset or rollback may permit an effect again, even at the same path. UNKNOWN never grants permission to redispatch. Authoritative compatibility and continuity matrix.
Once uses several different integration layers. This page separates them so “supported” is not mistaken for a universal runtime guarantee.
| Framework / host | Integration example | Hostile-retry evidence | Discovery / classification | Protected runtime path |
|---|---|---|---|---|
| OpenAI Agents | Yes | No dedicated hostile-retry lab claimed here | Yes — FunctionTool structural wrapping / Connect path | Yes, when tools are routed through the supported Once local or hosted execution boundary |
| Vercel AI SDK | Yes | No dedicated hostile-retry lab claimed here | Yes — documented discovery support | Yes, when the consequential tool is routed through a supported Once boundary |
| LangChain / LangGraph | Yes | Yes — LangGraph hard-process-death / fresh-process recovery lab | Yes — documented discovery support | Yes, for the tested / integrated path |
| CrewAI | Yes | Yes — native BaseTool hostile-retry lab | Runtime discovery adapter not claimed as equivalent to protection | Yes, for the tested / integrated path |
| Microsoft Agent Framework | Yes | No dedicated hostile-retry lab claimed here | Framework integration documented | Yes, when routed through a supported Once boundary |
| Agno | Evidence-focused example | Yes — retries after successful tool execution followed by model HTTP 500 | Do not infer discovery-adapter support from the hostile-retry lab | Yes, for the released SDK path used by the lab |
| Google ADK | Controlled parallel-replay lab | Pinned released/base/proposed-fix comparison; forced replay, UNKNOWN and same-machine boundary concurrency | Runtime discovery is separate from protection | Tested host-owned boundary only; no whole-framework recovery or production-provider qualification |
| Claude Code | MCP / plugin setup | Not a framework hostile-retry benchmark | MCP-assisted assessment and setup | MCP installation alone is not protection; runtime must sit on the side-effect path |
| Cursor | Project-scoped MCP setup | Not a framework hostile-retry benchmark | MCP-assisted assessment and setup | MCP installation alone is not protection |
| Codex | Plugin / marketplace setup | Not a framework hostile-retry benchmark | Plugin teaches routing / assessment and exposes MCP | Plugin installation alone is not the runtime safety boundary |
Current automatic local protection boundary
@once-agent/sdk/connect can classify supported local tool descriptors as BYPASS, PROTECT, or fail-closed UNKNOWN, resolve trusted logical identity, bind effect-bearing data, and connect supported same-machine tool registries. Automatic protected local execution uses durable same-machine SQLite on Node.js 24.15+.
This is not a multi-host or universal exactly-once guarantee. A framework being listed here does not mean every tool, provider, transport, HTTP method, or deployment topology is automatically protected.
Evidence boundary
Dedicated framework evidence includes the LangGraph, CrewAI and Agno hostile-retry labs and the Google ADK controlled replay comparison. These have different failure models and limits; none qualifies every deployment or provider. The controlled booking lifecycle reference demonstrates a mock create/modify/cancel contract, not a production booking adapter.
Project identity · Provider reconciliation matrix · Research · Security policy and private reporting · GitHub