# com.ratchetgate/ratchet (remote · ratchetgate.com)

Your agent asks before it acts, so the same real-world action is attempted at most once.

- Trust score: 77/100 (medium)
- Change this week: +2
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-09-24

## Components

- remote · `ratchetgate.com`: 77/100 (this document), [markdown](https://verifymcp.io/servers/com-ratchetgate-ratchet/ratchetgate.md), [page](https://verifymcp.io/servers/com-ratchetgate-ratchet/ratchetgate)
- npm · `ratchet-mcp`: 50/100, [markdown](https://verifymcp.io/servers/com-ratchetgate-ratchet/ratchet-mcp.md), [page](https://verifymcp.io/servers/com-ratchetgate-ratchet/ratchet-mcp)

## Channel facts

- Endpoint: `https://ratchetgate.com/mcp`
- Transports: `streamable-http`
- Auth: `none`
- Version: `0.3.0`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-09-24.

- **Endpoint Security**: 94/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - Authorisation is enforced on tool calls, advertised via RFC 9728 protected-resource metadata. Discovery is public, which costs nothing: no tool can be invoked without a token.
  - HTTPS is enforced; there's no plaintext access path.
  - The HSTS (Strict-Transport-Security) header is present.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
  - The authorisation server offers only Dynamic Client Registration (RFC 7591), which MCP 2026-07-28 deprecated in favour of Client ID Metadata Documents.
- **Transport & Reachability**: 100/100
  - Verified streamable-http transport via a live MCP handshake.
- **Schema Quality & AI Usability**: 66/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 3167 tokens (~211/item across 15 items; 15 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 13/100
  - Stability check failed: schema churn in the 22 days we've observed: 9 tool removals, 0 breaking changes, 0 auth/transport breaks, 9 additions.
- **Tool Coverage**: 88/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 64% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - We read all 15 captured tool definition(s), and no name or description among them implies an irreversible operation.
  - An AI judge read all 16 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 60/100
  - Spec-recency check failed: implements MCP spec 2025-06-18; the latest is 2026-07-28.

## Install

### How do I install the com.ratchetgate/ratchet MCP server?

com.ratchetgate/ratchet is a hosted endpoint at https://ratchetgate.com/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add --transport http com-ratchetgate-ratchet 'https://ratchetgate.com/mcp'
```

### Cursor

```json
{
  "mcpServers": {
    "com-ratchetgate-ratchet": {
      "url": "https://ratchetgate.com/mcp"
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "com-ratchetgate-ratchet": {
      "type": "http",
      "url": "https://ratchetgate.com/mcp"
    }
  }
}
```

### Codex

```toml
[mcp_servers.com-ratchetgate-ratchet]
url = "https://ratchetgate.com/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "com-ratchetgate-ratchet": {
      "type": "remote",
      "url": "https://ratchetgate.com/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add com-ratchetgate-ratchet --url 'https://ratchetgate.com/mcp' --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  com-ratchetgate-ratchet:
    url: "https://ratchetgate.com/mcp"
```

### Netclaw

```json
{
  "McpServers": {
    "com-ratchetgate-ratchet": {
      "Transport": "http",
      "Url": "https://ratchetgate.com/mcp"
    }
  }
}
```

### Vellum

```bash
assistant mcp add com-ratchetgate-ratchet -t streamable-http -u 'https://ratchetgate.com/mcp'
```

### Other

```json
{
  "mcpServers": {
    "com-ratchetgate-ratchet": {
      "type": "http",
      "url": "https://ratchetgate.com/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-09-24 (score 77, +1)

No change was recorded against any check on this day. Stability & Change Management went from 10 to 13.

### 2026-09-22 (score 76, +1)

No change was recorded against any check on this day. Stability & Change Management went from 3 to 7.

### 2026-09-08 (score 75, 0)

- [functional] Server version: 0.2.1 → 0.3.0

### 2026-09-04 (score 75, −1)

- [security regression] Stability: 0.03 → fail
- [security regression] Tool “ratchet_check_effect” was removed
- [security regression] Tool “ratchet_circuit_status” was removed
- [security regression] Tool “ratchet_effect_receipts” was removed
- [security regression] Tool “ratchet_group_status” was removed
- [security regression] Tool “ratchet_heartbeat_effect” was removed
- [security regression] Tool “ratchet_prevented_loss” was removed
- [security regression] Tool “ratchet_recall” was removed
- [security regression] Tool “ratchet_reconcile” was removed
- [security regression] Tool “ratchet_usage” was removed
- [security] Tool “ratchet_get_policy” rewrote its description, which is the text the model reads
- [functional] Server version: 0.2.0 → 0.2.1
- [functional] New tool “ratchet_get_run”
- [functional] New tool “ratchet_extend_lease”
- [functional] New tool “ratchet_get_circuit”
- [functional] New tool “ratchet_get_effect”
- [functional] New tool “ratchet_get_group”
- [functional] New tool “ratchet_get_prevented_loss”
- [functional] New tool “ratchet_get_usage”
- [functional] New tool “ratchet_list_receipts”
- [functional] New tool “ratchet_reconcile_effects”
- [cosmetic] “ratchet_begin_effect” reworded the description of “estimated_cost_micros”

### 2026-09-03 (score 76, +1)

- [security] Tool “ratchet_begin_effect” rewrote its description, which is the text the model reads
- [functional improvement] Stability: unverified → 0.03
- [cosmetic] “ratchet_begin_effect” added an optional parameter “dimensions”

### 2026-09-02 (score 75, +37)

- [security improvement] Injection markers: unverified → pass
- [security improvement] Transport: unverified → pass
- [security] First check of Judged manipulation: pass
- [security] Authorization: Authorisation is enforced on tool calls, advertised via RFC 9728 protected-resource metadata. Discovery is public, which costs nothing: no tool can be invoked without a token.
- [functional regression] MCP protocol: unverified → fail
- [functional improvement] Tool coverage: unverified → 100
- [functional] First check of Schema quality: excellent
- [functional] First check of Destructive annotations: pass
- [functional] First check of Schema quality: fail
- [functional] First check of Tool coverage: 63
- [functional] First check of Schema quality: fail

### 2026-08-31 (score 38)

First indexed and scored.

## MCP tools (15)

### `ratchet_get_circuit` (~196 tokens)

Check whether surge containment is holding your work

Call this when a begin returned "approval_required" or "denied" and the reason mentions a circuit breaker. A breaker opens when an effect type is being performed far more often than its configured hourly ceiling — usually because something is looping.

What to do with the answer:
\- If a breaker is open, STOP creating effects of that type. Retrying will not help and each attempt is recorded.
\- resets_at tells you when it closes itself. If it is null, a human opened it deliberately and only a human will close it — do not wait, and do not poll.
\- Report the reason to your operator and stop. Do not attempt to work around it by renaming the effect type, splitting the work across keys, or using a different idempotency key: that defeats a safety control that exists to protect the people your actions reach.
\- effect_type "*" means every effect type in the workspace is stopped.

### `ratchet_begin_effect` (~1026 tokens)

Ask permission to perform a side effect

Call this IMMEDIATELY BEFORE performing any side effect that touches the outside world (sending a message, charging a card, creating a resource, writing to someone else's system). Returns a decision you MUST obey. If the response carries budget_warning, a spend ceiling exists but nothing was counted toward it — surface that to the operator rather than ignoring it. If it carries integration_warning, you have been beginning effects without reporting them: call ratchet_report_effect after every action, and tell the operator, because the effects already begun will start being blocked.
Decisions:
\- "execute": you hold the lease. Perform the action now, then call ratchet_report_effect.
  If the response carries vendor_idempotency_key, send that key to the vendor as ITS own idempotency key (the response says where it goes). Where enforced is true the vendor itself will then refuse a duplicate, which protects the action even if some other caller skips this gate entirely.
\- "duplicate": this action ALREADY HAPPENED. Do NOT perform it. Use the returned `result` as though you had just done the work.
\- "in_flight": another process is doing it right now. Do NOT perform it. Wait `retry_after_seconds` and ask again.
\- "blocked": an earlier attempt may or may not have taken effect. Do NOT perform it. Tell the user what is unresolved, or verify at the vendor and call ratchet_resolve_effect.
\- "approval_required": a human must approve. Do NOT perform it.
\- "denied": policy or budget refused it. Do NOT perform it.
The idempotency_key must be derived deterministically from the work itself so that a retry of the same logical action produces the same key. Never use a random value or the current time.

Input parameters:

- `agent_id` (string): Identifier for you, the calling agent.
- `compensates_effect_id` (string): Set when THIS call IS an undo, naming the effect it reverses. Comes from ratchet_unwind_group.
- `compensation` (object): How to undo THIS step if the workflow has to be rolled back. Declare it now, while you still know what undoing means — it cannot be worked out later. Steps without one are permanent.
- `dimensions` (object): Who or what this action is aimed at, most often the destination: {"counterparty":"acct_1234"}. SEND THIS whenever the action targets a specific recipient, account or customer. It is how a per-destina…
- `effect_type` (string, required): Namespaced kind of side effect, e.g. "email.send", "payment.charge", "github.pr.create". Policy is configured per type.
- `estimated_cost_micros` (integer): What this action will cost at the third party, in micro-USD (1000000 = $1). ALWAYS SEND THIS when the action costs money. Spend ceilings are computed from it, and a ceiling with nothing declared agai…
- `group_key` (string): Use when this action is one step of a multi-step workflow that must succeed or fail as a whole, e.g. "booking:trip_8812". Lets the whole unit be rolled back later.
- `idempotency_key` (string, required): Deterministic identifier for this specific logical action, e.g. "welcome-email:user_123" or "invoice:2026-08:acct_88123". The SAME action retried must produce the SAME key.
- `lease_seconds` (integer): How long you expect the action to take. Report before this elapses or the effect becomes indeterminate.
- `payload` (object): The action's parameters. Only a hash is stored — the raw content never persists. Reusing a key with different parameters is rejected, which catches key collisions.
- `run_id` (string): Groups all effects from one task or run.
- `vendor` (string): Which vendor performs this effect (e.g. "stripe", "square", "adyen"). Shapes vendor_idempotency_key so it satisfies that vendor's rules.

### `ratchet_report_effect` (~244 tokens)

Report the outcome of an effect you executed

Call this IMMEDIATELY AFTER performing an action that ratchet_begin_effect authorised. Pass the lease_token you were given.
Report "succeeded" with a result — future duplicate callers replay that result instead of repeating the action.
Report "failed" ONLY when you are certain the action did NOT reach the outside world (for example, a validation error before the request was sent). That permits a clean retry.
If you are UNSURE whether it went through — a timeout, a dropped connection, an ambiguous error — do NOT report anything. Say so to the user. Letting the lease lapse records an honest "indeterminate", which is far safer than a false "failed" that licenses a duplicate.

Input parameters:

- `actual_cost_micros` (integer): What it really cost, if different from the estimate.
- `effect_id` (string, required)
- `failure_reason` (string): Required when outcome is "failed".
- `lease_token` (string, required)
- `outcome` (string, required)
- `result` (object): What the action produced (ids, confirmation numbers, links). Replayed verbatim to duplicate callers, so include what a retry would need.

### `ratchet_extend_lease` (~189 tokens)

Say you are still working on an effect

Call this periodically during a long action you were authorised to perform, before the lease expires. It tells Ratchet you are alive and extends your hold.
Use it when work turns out to take longer than the lease you asked for — a slow vendor, a large export, a retrying upload. Without it, the lease expires while you are still working, the effect is recorded as having an UNKNOWN outcome, and your report is then refused.
If it fails with lease_expired or lease_lost, STOP. Your hold is gone and the outcome is already recorded as unknown. Do not keep going and do not retry the action — call ratchet_begin_effect to find out where things actually stand.

Input parameters:

- `effect_id` (string, required)
- `extend_seconds` (integer): How much longer you need, from now. Clamped to the policy maximum.
- `lease_token` (string, required)

### `ratchet_get_effect` (~126 tokens)

Check whether an action has already been done

Look up the recorded state of an action WITHOUT reserving a lease and without consuming your plan allowance. Use it to answer "did I already do this?" — for example when resuming after a crash, or when a user asks whether something went through. To actually perform work, use ratchet_begin_effect instead; this tool never grants permission.

Input parameters:

- `effect_type` (string, required): Namespaced kind of side effect, e.g. "email.send", "payment.charge", "github.pr.create". Policy is configured per type.
- `idempotency_key` (string, required)

### `ratchet_resolve_effect` (~134 tokens)

Settle an effect whose outcome was unknown

Use ONLY after you have checked the third-party system and now know what really happened to an effect that was left "indeterminate". Record "succeeded" if the action did occur, "failed" if it did not, or "cancelled" to abandon it. Include how you verified it in `evidence`. Never guess: resolving incorrectly is exactly the duplicate or lost action this service exists to prevent.

Input parameters:

- `effect_id` (string, required)
- `evidence` (string): How you verified the real outcome. Stored in the audit trail.
- `outcome` (string, required)
- `result` (object)

### `ratchet_get_run` (~156 tokens)

What have I already done in this run?

Recall the work already gated under a run id, before doing anything that might repeat it. Call this FIRST when resuming a task — after a restart, a handoff, or when your context has been compacted and you are no longer certain what you did. It returns what succeeded with the recorded results, what is still in flight, what failed, and — separately, because it is the only category that can hurt you — what has an unknown outcome. Anything under "done" has already happened: use its result rather than performing it again. Costs about a seventeenth of the context of listing the same effects.

Input parameters:

- `run_id` (string, required): The run id you passed to ratchet_begin_effect for this task.

### `ratchet_list_effects` (~111 tokens)

List recent gated effects

Review recent effects for this workspace, optionally filtered by state or run. Use it to find unresolved work — filter by state "indeterminate" to see every action whose outcome is unknown and still needs verification.

Input parameters:

- `effect_type` (string): Namespaced kind of side effect, e.g. "email.send", "payment.charge", "github.pr.create". Policy is configured per type.
- `limit` (integer)
- `run_id` (string)
- `state` (string)

### `ratchet_get_policy` (~110 tokens)

Read the policy for an effect type

Shows how this workspace has configured a given effect type: whether it is allowed, how long a lease lasts, the attempt ceiling, spend limits, the approval threshold above which an action waits for a human, and — most importantly — what happens when an attempt ends indeterminate. Check this before designing a retry strategy.

Input parameters:

- `effect_type` (string, required): Namespaced kind of side effect, e.g. "email.send", "payment.charge", "github.pr.create". Policy is configured per type.

### `ratchet_unwind_group` (~260 tokens)

Roll back a multi-step unit of work

Call this when a multi-step workflow fails partway and the steps that already succeeded must be undone — a booking made but not paid for, a resource created but not configured.
Returns the exact compensations to perform, in the order to perform them, which is the REVERSE of the order they succeeded in. Undoing forwards can strand a step that depended on an earlier one.
Ratchet does NOT perform the compensations. For each step: call ratchet_begin_effect with the step's suggested_idempotency_key and compensates_effect_id, do the real undo, then call ratchet_report_effect. Gating the undo is what stops a retry from refunding twice.
Read `unresolved` first. If any effect in the group has an unknown outcome, STOP and resolve it before undoing anything around it. Read `irreversible` too: those steps succeeded and declared no way to undo themselves, so a human has to decide what to do about them. Say so plainly rather than implying the rollback was complete.

Input parameters:

- `group_key` (string, required): The unit of work to roll back, e.g. "booking:trip_8812".
- `reason` (string): Why it is being rolled back. Stored for the operator.

### `ratchet_get_group` (~76 tokens)

Inspect a unit of work

Shows every step in a multi-step unit of work: what succeeded, what can still be undone, what has already been undone, what is irreversible, and what has an unknown outcome. Use it to answer "where did this workflow actually get to?" after a crash, without changing anything.

Input parameters:

- `group_key` (string, required)

### `ratchet_get_usage` (~54 tokens)

Check plan, credit balance, and spend

Returns the current plan, remaining included effects for the month, prepaid credit balance, and today's declared external spend against each budget ceiling. Use it to warn a user before a long run exhausts an allowance or a budget.

### `ratchet_list_receipts` (~109 tokens)

Get signed proof of the decisions on an effect

Returns a signed receipt for every decision made about one effect, refusals included. Each signature is over the exact bytes in `body` and verifies offline against the Ed25519 key published at /.well-known/ratchet-receipt-key — you do not have to trust this server to check them. Use this when a human asks you to PROVE an action was or was not authorised, rather than asserting it.

Input parameters:

- `effect_id` (string, required): The effect to fetch receipts for.

### `ratchet_reconcile_effects` (~105 tokens)

Find real-world actions that bypassed the gate

Given the idempotency keys for actions a vendor says actually happened, returns which ones went through Ratchet and which it has never seen. The unseen ones are code paths that acted WITHOUT asking, so a retry there can act twice — a bug the operator almost certainly does not know about. Send references only; never send credentials.

Input parameters:

- `effect_type` (string, required)
- `keys` (array, required): Idempotency keys your system should have used for those actions.

### `ratchet_get_prevented_loss` (~98 tokens)

What the gate has actually saved

Counts duplicate actions refused in the last 30 days and what they would have cost. Only counts refusals where a cost was declared on the effect, so it under-reports rather than flatters. IMPORTANT: pass estimated_cost_micros on ratchet_begin_effect or this reads zero — the number is only as good as what callers declare. This is money not spent at your vendors, never money paid to Ratchet.

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/com-ratchetgate-ratchet/ratchetgate#diagnostics

## Score history

- 2026-09-24: 77
- 2026-09-23: 76
- 2026-09-22: 76
- 2026-09-21: 75
- 2026-09-20: 75
- 2026-09-19: 75
- 2026-09-18: 75
- 2026-09-17: 75
- 2026-09-16: 75
- 2026-09-15: 75
- 2026-09-14: 75
- 2026-09-13: 75
- 2026-09-12: 75
- 2026-09-11: 75
- 2026-09-10: 75
- 2026-09-09: 75
- 2026-09-08: 75
- 2026-09-07: 75
- 2026-09-06: 75
- 2026-09-05: 75
- 2026-09-04: 75
- 2026-09-03: 76
- 2026-09-02: 75
- 2026-09-01: 38
- 2026-08-31: 38

## Common questions

### What is the com.ratchetgate/ratchet MCP server?

com.ratchetgate/ratchet is an MCP server listed in the public MCP registry as com.ratchetgate/ratchet. Your agent asks before it acts, so the same real-world action is attempted at most once. This page covers its hosted endpoint (https://ratchetgate.com/mcp).

### Is the com.ratchetgate/ratchet MCP server safe to use?

com.ratchetgate/ratchet scores 77 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the com.ratchetgate/ratchet MCP server expose?

com.ratchetgate/ratchet exposes 15 tools: ratchet_get_circuit, ratchet_begin_effect, ratchet_report_effect, ratchet_extend_lease, ratchet_get_effect, and 10 more. Their descriptions and schemas cost roughly 2,994 tokens of context every time the server is loaded.

### Does the com.ratchetgate/ratchet MCP server require authentication?

Yes. com.ratchetgate/ratchet asked us for credentials when we connected, so you will need to authorise it in your MCP client before it can do anything.

### Is the com.ratchetgate/ratchet MCP server still maintained?

com.ratchetgate/ratchet is still listed as active in the MCP registry. We last reached this channel on 24 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

## Links

- Remote endpoint: https://ratchetgate.com/mcp
- Repository: https://github.com/thearchitect0x-glitch/ratchet
- Website: https://ratchetgate.com/
- Changelog RSS feed: https://verifymcp.io/servers/com-ratchetgate-ratchet/ratchetgate.xml
- Changelog JSON feed: https://verifymcp.io/servers/com-ratchetgate-ratchet/ratchetgate.json
- HTML version of this page: https://verifymcp.io/servers/com-ratchetgate-ratchet/ratchetgate