Loading today’s stories
Build1 distinct publisher3 min readUpdated
A dev.to write-up describes a one-shot HTTP worker for Notion built on cheap models. The harness held. What broke was three variables, tool surface, model and prompt, treated as one.
The Engineer · Build desk
Compiled by The EngineerSomething wrong?How this is made
A team writing on dev.to has published the build log for a one-shot HTTP worker that talks to Notion through MCP, and reports that version one worked while version two got cheaper and more readable and then failed in a new way [s1c1][s1c2]. Their diagnosis is the part worth stealing: the harness was fine, and the tool surface, the model and the prompt were not the same problem, but they kept treating them as one [s1c3].
Start with the shape, because it is the opposite of what most agent products sell. The requirement was that another service can say "read this Notion page, write a summary somewhere, stop", with no chat history, no personality accreting over weeks, no always-on process, and no cost when nobody is calling [s1c4]. That is one HTTP request, tools scoped to that request, a JSON result, and then the instance goes away [s1c5]. The stated constraints are as much social as technical: an external caller owns the schedule, the agent is allowed to actually use tools, secrets live in the environment and never in the request body, and idle time is free [s1c7].
The obvious objection is a cron script hitting the Notion API. The authors' answer is that the task changes every call: this week a weekly digest, next week "list in-progress rows and do not write", and they did not want a new Python file per job, but one worker that takes a prompt plus a list of tool servers [s1c8]. They also name the failure mode on the other side, starting from a coding agent with shell, files, memory and a learning loop and shrinking it, where you spend months deleting features you never wanted [s1c9].
Mechanically it is unglamorous. The caller POSTs /run with a system prompt, a user prompt and which tools; the agent starts if needed and dies when idle; Notion sits behind an MCP server holding an integration token; the response returns the result, tools used, tokens and cost [s1c10]. The call is synchronous because a weekly digest can wait two minutes, which removed the need for a job queue in v1 [s1c11]. The agent is not the Notion client, keeping the image thin and the Notion token out of the agent process [s1c12]. Callers name pages in English, so the model searches, picks a title match, and stops if it cannot, refusing to write rather than guess on an ambiguous name [s1c13][s1c6]. The default model was a very cheap DeepSeek flash model behind an OpenRouter-style gateway, on the order of a few cents per million tokens, because nobody wanted a Claude bill on every internal trigger [s1c14].
Auth is where they took the deliberate loss. The self-hosted route was chosen because Notion's hosted connector is built for Claude Desktop and wants OAuth [s1c16]. Rather than per-caller service accounts and short-lived tokens, which they call miserable once the next caller is a script on a laptop, they shipped a shared API key checked at the app and failing closed, accepting the loss of per-caller identity for v1 [s1c17][s1c18][s1c19].
The rule they wrote down was to change model, tool server and prompt before touching the loop, and they say they still almost violated it [s1c15]. That list of three is exactly the list they later admit to debugging as a single variable [1]. When quality wobbled, the temptation was to reach for a "real agent" with memory, skills, a terminal and a personality that improves [s1c20]; the text available to us stops mid-sentence there, so treat the resolution as unreported.
Follow any of these and your For You feed starts watching them — no settings page required.
Ranked by verification strength, evidence, and original report placement.
When quality wobbled, the tempting move described was to 'use a real agent': something with memory, skills, a terminal and a personality that improves. The supplied text ends mid-sentence at that point.
A post published on dev.to, headlined 'Building a Disposable Notion Agent on Cheap Models', describes building a one-shot HTTP worker that talks to Notion through MCP.
Per the post's TL;DR: version one worked; version two got cheaper and more readable, then failed in a new way.
The authors state: 'The harness was fine. The tool surface, the model, and the prompt were not the same problem, and we kept treating them as one.'
The requirement was that another service could say 'read this Notion page, write a summary somewhere, stop', with no chat history, no personality that accretes over weeks, no always-on process, and no cost if nobody is calling it.
The authors call the shape a 'one-shot agent': one HTTP request, tools for that request, a JSON result, then the instance can go away.
Evidence-backed comparisons of source perspectives and observed adoption signals. Read the methodology
Which Builder, Operator, and Investor concerns the observed source mix emphasized—not a truth score.
Evidence, demonstrated adoption, hype gap, incentives, and confidence are assessed independently, each on its own current evidence. How these are measured.
Single self-reported build log, no measurements
Everything rests on one first-person dev.to post about the authors' own system. The architectural and auth decisions are described in enough detail to be reproducible, which is real evidence of a shipped design, but there are no cost figures beyond an approximate token price, no latency or success-rate data, no description of the version-two failure mode, no code or repository reference, and no independent corroboration. The supplied body is also truncated mid-sentence before the MVP walkthrough, so part of the argued chain is unavailable.
One internal deployment, self-reported
Adoption evidence is limited to the authoring team's own system: a v1 in service against a weekly Notion digest task and a v2 that regressed. There are no other implementers, no user counts, no request volumes, and no external validation of the one-shot pattern. The underlying components named - MCP, a self-hosted official Notion MCP server, an OpenRouter-style gateway - are used here as integration choices, not as adoption datapoints this source measures.
Claims run slightly under the evidence
The post is deflationary rather than promotional: it explicitly declines the 'agent that lives in Slack and remembers you' pitch, describes its own build as dumber and a little ugly, volunteers a regression, names the debugging error as its own, and lists accepted security debt such as losing per-caller identity. That is less assertive than the material would allow. The mild countervailing pressure is that a general pattern and a general lesson are drawn from one project with no measurements, so the generalisation slightly outruns what a single case can establish - netting out just below aligned.
Practitioner self-publishing, no disclosed commercial tie
The visible incentive is ordinary developer-platform reputation building: an author publishing their own architecture and lessons on dev.to, which rewards a clean narrative and a memorable coinage such as 'one-shot agent'. Vendors are named as choices rather than promoted - Notion, MCP, an OpenRouter-style gateway, a cheap DeepSeek model, and Claude framed as the bill to avoid - and the supplied text discloses no sponsorship, employer stake or product being sold. Self-reporting on one's own system is the main distortion risk here, not commercial capture.
Design detail is credible, outcomes are unverifiable
Confidence is moderate-low. What the post claims about its own design decisions is specific, internally consistent and plausible, and the candour about failure raises trust in the narration. But there is one source, no second publisher, no numbers behind the cost or quality claims, no detail on the version-two failure, and a body that cuts off mid-walkthrough - so the architectural description is reasonably reliable while the causal lesson and any generalisation beyond this team remain weakly supported.
invest
DeepSeek V4 Flash costs a tenth as much and passes 53.8% of agent tasks1 distinct publisher
invest
Vercel's eve bets the agent plumbing layer consolidates the way Next.js did1 distinct publisher
build
Codex at OpenAI: stop polishing the prompt, start building the harness1 distinct publisher
security
A year of Sophos AI cases: 30 of 38 were fake installers, not autonomous attackers1 distinct publisher
Distinct publishers with included, body-backed reporting in this cluster.
dev.to
1 article · August 19, 2026