Plain answers

Your agent asks Ratchet for permission immediately before it does something irreversible — send the email, charge the card, book the flight. Ratchet answers execute, duplicate, blocked, or a few others, and records that answer durably. If the same action is attempted again, from any process or machine, it gets the recorded answer instead of a second go-ahead.

In plain words: it is a bouncer with a very good memory. Your agent asks "may I?", and the bouncer says yes once.

Both, because there are two ways in. A person creates a workspace with an email and gets the free plan. An agent can call the gate with no credential at all — a workspace and key come back alongside the decision. They are the same product. Claiming an agent-made workspace with an email later turns it into the first kind.

In plain words: you can sign up, or your agent can just start using it and you can put your name on it afterwards.

Those are two different states of the same workspace.

A workspace created by an agent with no email attached is capped at 100 gated effects, total — not per month. It is a real workspace, not a demo, but nobody owns it: we have no way to reach whoever made it, so it cannot be allowed to grow without limit.

Attaching an email is called claiming. A claimed workspace is on the free plan: 1,000 gated effects every month, and it resets each month. Claiming keeps the same workspace, the same key and all the history — nothing migrates and nothing breaks.

In plain words: unclaimed is a hotel room key with 100 uses on it. Adding your email turns it into your own key, and you get 1,000 a month instead. Same room, same key, no move-out.

No. A gated effect is the first time you ask about a particular action — the call that creates the record. Everything after that about the same action is free: the duplicate checks, the report of what happened, the reads, the replays. An action retried forty times is one gated effect, not forty-one calls.

In plain words: you pay once per real-world thing, not once per question about it. Retries are free — which is the whole point, because retries are what you are trying to survive.

Never. Ratchet holds no vendor credentials, has no outbound access to your systems, and cannot retry anything on your behalf. It answers a question; your code does the work and reports back what happened. That boundary is deliberate and it is the main safety property of the design.

In plain words: we are the bouncer, not the barman. We never touch the drinks.

The permission it was holding expires with nothing reported, and the effect becomes indeterminate. We do not guess. We will not mark it succeeded because it probably worked, and we will not mark it failed because it probably did not. Your policy for that effect type decides what happens next: stop and wait for a human, retry if the action is genuinely safe to repeat, or go and check the vendor first.

In plain words: if nobody knows whether the card was charged, we say "nobody knows" instead of picking. Guessing here is how people get billed twice.

Because it is not achievable, by anyone, in a system where messages can be lost. Any service promising it is either redefining the words or is wrong. What is achievable is at-most-once initiation — the same action is never authorised twice — plus a recorded outcome that later callers replay, plus an explicit state for the case where the truth is genuinely unknown.

In plain words: we can promise never twice. Nobody can promise exactly once, and we would rather say so than sell you a word.

It is the name you give one piece of real-world work, so that two attempts at the same work can be recognised as the same. Build it from what makes the action unique and nothing else: invoice:2026-08:acct_8812, not a timestamp and not a random value. If two attempts should be the same action, they must produce the same string — byte for byte.

In plain words: it is a label on the job. Two workers holding the same label are doing the same job, so only one should start.

Yes — Ratchet ships as an MCP server, published to the registry and installable with npx -y ratchet-mcp. That is the primary way agents use it. Claude Code, Claude Desktop, Cursor, Windsurf, Zed, Cline, Continue, Goose, VS Code agent mode, JetBrains AI, Warp, Raycast and a dozen more speak it; Works with lists them all with the setup for each.

Yes to all three, and the site has two different lists which is what makes this confusing. Here is the distinction.

Works with is where your agent runs — Claude Code, Cursor, LangChain, n8n, a model provider. 90 of them.

The vendor directory is what your agent acts on — Stripe, Figma, Slack, GitHub. It records whether that vendor refuses a repeated request by itself. Figma is in there: its REST API documents no idempotency key, so the answer is no, and the gate stays advisory for it.

Neither list is a limit. Ratchet gates anything your code can call, including services in neither list. The vendor directory only records which vendors add enforcement of their own on top of ours.

In plain words: one list is where your robot lives. The other is what your robot touches. Everything works either way.

Two calls around something you already do. Ask before, report after. No SDK is required — it is HTTP — and there is nothing to rewrite. The five-minute setup shows the before and after side by side.

Yes. You can set a hard ceiling if you know your numbers — at most 40 charges an hour. Most people do not know their numbers, so instead you set a multiple: never more than three times normal. Ratchet computes normal itself, as the median of the last seven days of that effect type, recomputed continuously in the background.

The median rather than the average, deliberately — one runaway hour would drag an average upward and quietly raise the ceiling that was supposed to catch it. A learned ceiling also never falls below 30, so a quiet effect type is not tripped by one unusually busy afternoon, and it does nothing at all until there are at least six hours of real history to learn from.

In plain words: you can say "never more than three times normal" without knowing what normal is. It works that out, and it ignores the bad days when it does.

Your agent decides, and it should decide deliberately rather than by accident. Ratchet is a gate, so the safe default is to stop: if you cannot get permission, do not perform the irreversible action. For effects where not acting is worse than acting twice, you can choose to proceed and reconcile afterwards. What matters is that this is a choice you make once, in code, rather than a question your agent improvises during an outage.

No. We store a SHA-256 fingerprint of the payload, never the payload. We can tell you that two attempts differ; we cannot tell you, or anyone else, what was in them. API keys are stored as a peppered HMAC and cannot be recovered, only replaced. The security page is specific about what we do and do not hold, including what we cannot claim.

In plain words: we keep a fingerprint, not a copy. It is enough to spot a duplicate and useless for anything else.