Agent Rewind

Agent Rewind

The flight recorder + undo button for AI agents.

AI agents take real, irreversible actions — they delete files, send emails, callAPIs. When one goes off the rails, there is no black box to read and no undobutton to press. Agent Rewind is both: a transparent proxy between your agentand its tools that records every action, snapshots state before anythingdestructive runs, holds oversized operations for human approval, and gives youper-action Undo, Rewind-to-a-point-in-time, and a kill switch theagent cannot talk its way around.

See it in 60 seconds

git clone https://github.com/moholo-founder/agent-rewind.git
cd agent-rewind && pnpm install && pnpm demo

Open http://localhost:4820. A scripted rogue agent wipes a 200-messageinbox, deletes files, and queues embarrassing emails — then you press⏪ Rewind and watch everything come back, with a per-action report thatnever claims more than it restored.

Use it with your agent

Any MCP client (Claude Code, Claude Desktop, Cursor, ...) — one config block:

{
  "mcpServers": {
    "agent-rewind": { "command": "npx", "args": ["-y", "agent-rewind"] }
  }
}

Every tool call your agent makes through the proxy is journaled, snapshotted,policy-gated, and reversible from the timeline UI at http://localhost:4821.

Native Claude Code sessions (built-in Bash/Edit/Write, no MCP involved) —hooks mode:

agent-rewind hooks install    # wires this project's .claude/settings.json
agent-rewind ui               # operator console

File edits become undoable (snapshotted before they land), dangerous shellpatterns escalate to an explicit permission prompt, and the STOP switchrefuses every native tool until a human resumes.

What you get

• Live timeline — every action as it happens: who, what, blast radius,risk class, status, before/after diffs.
• Undo — one click restores what an action destroyed, byte-identical,from content-addressed snapshots captured before execution.
• Rewind — pick a point in time, preview exactly what will be undone,confirm, and unwind it all in strict reverse order of execution.
• Kill switch — STOP refuses every side-effecting call until a humanresumes. The flag lives in Agent Rewind's own storage, outside the agent'scontext — context compaction and creative reasoning cannot clear it.
• Blast-radius holds — actions over a per-connector threshold (delete 40files, wipe 200 messages) wait in an approval tray instead of executing.
• Append-only journal — tamper-resistant evidence (SQLite triggers refusedeletes and rewrites), with secrets redacted at write time.
• Honest failure — an undo that fails says so, loudly, per action.Fully restored is only ever claimed when it is true.

How it works

[ agent / MCP client ]
        │  MCP
        ▼
  Agent Rewind proxy — classify → gate (allow / hold / block) →
                       snapshot pre-state → execute → journal + live UI
        │  MCP
        ▼
[ your tool servers: filesystem, email, ... ]

Reversibility is per-connector: each tool declares its class (read /reversible / destructive) and ships a compensator — capture what the actionwill destroy, and how to restore it. Reads pass through untouched. Unknowntools are held for approval, never silently executed. v1 ships a sandboxedfilesystem connector and a self-contained mock email connector (delayed outbox with a recall window — after delivery, undo honestly reportsnot-reversible). The interface is designed so real connectors (Gmail,Slack, Stripe) drop in without touching core.

Zero native dependencies — pure JavaScript on Node 22.13+ (SQLite vianode:sqlite). Install is seconds, no compiler. CI-verified on Linux, macOS,and Windows.

License

Source-available under the Business Source License 1.1,© 2026 Moholo Inc. Free for individuals, nonprofits, education, andorganizations under 25 people / US $2M revenue — including production. Largerorganizations need a commercial license([email protected]). Every version becomes Apache 2.0 open source four yearsafter release. See TERMS.md and CONTRIBUTING.md.

Roadmap

• Real connectors: Gmail, Slack, Stripe (OAuth), with per-field redaction
• Reversible-shell tier: filesystem snapshots (APFS/btrfs) bracketing agentsessions, so even arbitrary Bash can be rolled back
• Enterprise: audit export, SSO, retention policies, multi-operator
• HTTP/SSE MCP transport; held-action persistence across restarts

Developer docs, architecture details, and the build history live indocs/DEVELOPMENT.md.