doubleoh-mcp

The DoubleOh fix loop as an MCP server. Any MCP-capable agent — Claude Code, Claude Desktop, and the growing list of clients — gets the loop as seven tools with zero integration code.

{
  "mcpServers": {
    "doubleoh": {
      "command": "bunx",
      "args": ["doubleoh-mcp"],
      "env": { "DOUBLEOH_API_KEY": "oo_live_…" }
    }
  }
}

The tools

• doubleoh_skills_for — before attempting a task it has failed at before, the agent asks what has been learned and receives step-by-step procedures from past human fixes, with each one's track record.
• doubleoh_request_fix — when stuck, the agent asks for a human. If the fleet already knows the wall, the procedure comes back instantly instead and nobody is paged. Duplicate walls are answered with "already being fixed, N runs blocked" — an agent in a retry loop never spams a team.
• doubleoh_report_skill — after following a skill, the agent reports whether it worked. Skills that keep failing stop being served.

Refusals (a private URL, a quota) come back as readable tool results, not protocol errors — the model is told what went wrong in a sentence it can act on.

Guard any MCP server

The model can't bypass what it never holds. Rules and receipts only bind an agent that asks first, and in a benchmark Claude Haiku 4.5 called change_bank_details directly in three runs of three. A guarded tool asks on every call, whatever the model does: the dangerous function is wrapped, and the model only ever gets the wrapped one.

doubleoh-mcp guard starts the MCP server it fronts, lists its tools and re-exposes them. Every side-effecting call opens a receipt, waits for a person when one must decide, runs downstream only when allowed, and confirms with the result. Every tool is guarded unless guard.json lists it under readOnly; the seven DoubleOh tools stay available.

{ "mcpServers": { "bank": {
    "command": "npx",
    "args": ["-y", "doubleoh-mcp", "guard", "--config", "guard.json", "--", "npx", "-y", "your-bank-mcp"],
    "env": { "DOUBLEOH_API_KEY": "oo_live_..." } } } }

guard.json (every tool is guarded unless listed under readOnly):
{ "readOnly": ["lookup_vendor"],
  "tools": { "pay": { "action": "Pay {vendor} {amount} {currency}", "amount": "amount", "currency": "currency" } },
  "waitForPersonSeconds": 0 }

In tools.<name>: action and target are templates ({tool}, {args}, {field.path}), amount (major units) or amountCents and currency are arg paths, defaultCurrency a fixed currency. waitForPersonSeconds lets a call wait for the answer; by default it returns "waiting for approval" at once.

On start the proxy writes to stderr (your MCP client's log) which tools it guards and which pass through, and names any readOnly entry that matches no tool. Guarded tools drop their outputSchema: their answer may be a sentence ("waiting for a person") instead of the declared shape. DOUBLEOH_MODE=dry answers every guarded call with what your rules would decide and runs nothing; DOUBLEOH_MODE=mock needs no key and allows everything, to try the wiring offline. --help lists it all.

DOUBLEOH_BASE_URL points at a self-hosted deployment; it defaults to the hosted service.