The accident that always happens eventually
Give an AI agent a side-effecting tool — send an email, create a charge, write a record — and sooner or later a retry runs it twice. A timeout fires, the framework retries, and now your customer got two emails and your ledger has two charges.
This is not a "be more careful" problem. It's a missing mechanism: the idempotency key.
The pattern
- Generate one key per logical operation (e.g. a UUID).
- Before executing, record the key server-side.
- If the same key arrives again, don't execute — return the first result.
The minimal shape:
# key = uuid per operation
# INSERT (key, result) with UNIQUE(key)
# on conflict: return the stored result without re-running
For production, add:
- Payload binding — hash the payload with the key, so reusing a key with a different body is caught.
- Approval gate — dangerous actions wait for a human approval; nothing runs before it.
- Outbox — never send directly. Queue first; a dispatcher sends only approved rows, exactly once.
- Circuit breaker — hard caps on steps and spend, so a stuck loop can't burn $50+ overnight (a real, common accident).
Check your own code — free tool
I published a free MCP server, safe-agent-mcp, that statically checks a code snippet for the six signals above (it never executes your code), audits API-key privilege from permission descriptions only, and explains each guard pattern:
- GitHub: https://github.com/naoanao/safe-agent-mcp
- PyPI:
pip install safe-agent-mcp(package: safe-agent-mcp) - Official MCP Registry:
io.github.naoanao/safe-agent-mcp
The full production pack (100 real-world traps catalog, working code, sabotage-test playbook) is here: https://growl-ai.com/store/en — Safe AI Agent Pack ($69 / team $199).
Top comments (0)