_{Generated by make demo-svg. For an animated GIF, install VHS and run vhs docs/assets/demo.tape.}

Why Unwind exists

Human oversight of agents is failing because approval prompts are undifferentiated. They are undifferentiated because nothing in the stack knows which actions are reversible. So every MCP client falls back to the same binary "Allow / Deny" dialog for reading a file and for wiring money — and when the prompts come too often, people develop an approve-approve-approve reflex. A prompt injection that triggers one approval you click through has bypassed human oversight entirely.

Unwind supplies the missing primitive — reversibility inference — and then exploits it twice: it auto-allows the reversible majority with a real undo log behind them, and reserves interruption for the irreversible minority. The approval signal stops being noise and starts meaning something.

Unwind is not an undo button. That's the demo, not the thesis. The thesis is that reversibility classification is the enabling mechanism that makes human oversight of agents work at all. See PROJECT.md.

The 20-second demo

An agent, wired through Unwind, runs loose across four servers:

🤖 agent> delete the "Q3 Planning" Notion page          → deleted
🤖 agent> drop the `sessions` table in the sqlite db     → dropped
🤖 agent> email the vendor to cancel the contract        → sent
🤖 agent> force-push my local branch over origin/main     → pushed

You realize the agent misunderstood. You type one word:

you> unwind

Unwind replays the undo log in reverse order, honestly reporting each outcome:

✔ force-push        restored      (reflog checkpoint re-pointed origin/main)
✔ drop table        restored      (table + rows recreated from pre-state snapshot)
✔ delete page       restored      (page un-trashed within retention window)
✖ send email        could not undo — this was R3 (mitigable only).
                    The message was already delivered. I should have asked
                    before sending. Here's the retraction draft and why.

Three actions come back. The fourth is flagged honestly — because a false undo guarantee is worse than none. That last line is the whole thesis in one screenshot, and it's honest.

One-line install

pip install rollback-mcp        # pip
uvx rollback-mcp --help         # zero-install, via uv
docker run ghcr.io/bhaskargurram-ai/unwind --help

The Node/TypeScript stdio shim (ts/) is real and tested, but it is not published to npm. Build and run it from source:

git clone https://github.com/bhaskargurram-ai/unwind && cd unwind/ts
npm install && npm run build
node dist/cli.js run -- npx -y @modelcontextprotocol/server-filesystem /work

Then wrap any upstream MCP server by prefixing its launch command with unwind run --:

# Before: your client spawns the filesystem server directly
npx -y @modelcontextprotocol/server-filesystem /work

# After: Unwind wraps it transparently
unwind run -- npx -y @modelcontextprotocol/server-filesystem /work

Unwind is invisible when idle: any method it doesn't understand is forwarded byte-faithfully, and unwind run --passthrough-only -- <cmd> is a panic switch that disables all classification.

MCP client configuration

Every snippet below wraps the reference filesystem server. Swap the command after -- for any server you already run. The pattern is identical everywhere: keep your existing server command, prefix it with unwind run --.

{
  "mcpServers": {
    "filesystem": {
      "command": "unwind",
      "args": ["run", "--", "npx", "-y", "@modelcontextprotocol/server-filesystem", "/work"]
    }
  }
}

{
  "mcpServers": {
    "filesystem": {
      "command": "unwind",
      "args": ["run", "--", "npx", "-y", "@modelcontextprotocol/server-filesystem", "/work"]
    }
  }
}

{
  "mcpServers": {
    "filesystem": {
      "command": "unwind",
      "args": ["run", "--", "npx", "-y", "@modelcontextprotocol/server-filesystem", "/work"]
    }
  }
}

{
  "servers": {
    "filesystem": {
      "command": "unwind",
      "args": ["run", "--", "npx", "-y", "@modelcontextprotocol/server-filesystem", "/work"]
    }
  }
}

{
  "mcpServers": {
    "filesystem": {
      "command": "unwind",
      "args": ["run", "--", "npx", "-y", "@modelcontextprotocol/server-filesystem", "/work"]
    }
  }
}

{
  "mcpServers": {
    "filesystem": {
      "command": "unwind",
      "args": ["run", "--", "npx", "-y", "@modelcontextprotocol/server-filesystem", "/work"]
    }
  }
}

extensions:
  filesystem:
    type: stdio
    cmd: unwind
    args: ["run", "--", "npx", "-y", "@modelcontextprotocol/server-filesystem", "/work"]
    enabled: true

{
  "context_servers": {
    "filesystem": {
      "command": {
        "path": "unwind",
        "args": ["run", "--", "npx", "-y", "@modelcontextprotocol/server-filesystem", "/work"]
      }
    }
  }
}

The R0–R4 reversibility taxonomy

Reversibility is ordinal and environment-relative — the same write_file is R1 on a git-backed tree and R4 on a versionless one. Class is always a function of (tool, environment), never the tool alone.

Misclassifying R4 as R1 is catastrophic; misclassifying R1 as R4 merely annoys. Unwind treats these asymmetrically and fails safe — unknown tool, failed classification, timeout, or crashed classifier all escalate to a human. It never auto-allows on uncertainty.

Alongside the class, every call carries three orthogonal dimensions: blast radius (how many entities are affected), externality (did third parties observe it?), and a reversibility half-life — email recall closes in ~30s, trash retention in ~30 days, a payment void before settlement. Reversibility is time-decaying, so the undo log is expiry-aware.

How it compares

Every open-source MCP gateway is a preventive control — it decides whether to allow or block a call. None of them can recover from one. That's the entire opening.

Not a gateway

Unwind is not another gateway, and never will be. Auth, RBAC, rate limiting, secret scanning, and container isolation are permanently out of scope — that space is saturated and well served by the projects above. Unwind does the one thing none of them do: recovery. It runs standalone, or as optional middleware inside any of those gateways, so it complements them rather than competes. If a feature doesn't sharpen reversibility classification or exploit it, it's out of scope.

The Unwind MCP tools

Unwind is itself an MCP server. It exposes its own tools so the agent can reason about and reverse its own actions — this is what makes Unwind agentic rather than a passive filter:

Documentation & links

• 📚 Docs: https://bhaskargurram-ai.github.io/unwind/
• 🔬 ReversiBench — the reversibility benchmark & live sandbox: bench/ (in progress)
• 🗂️ Reversibility index — a browsable R-class catalog of popular MCP servers: coming soon
• 🛠️ Contributing: CONTRIBUTING.md · Roadmap: ROADMAP.md · Support: SUPPORT.md
• 🔒 Security policy: SECURITY.md · Governance: GOVERNANCE.md

Project status & expectations

Unwind is early beta (0.1.x). The transparent proxy and the R1 undo path are the foundation; compensation synthesis, calibrated escalation, and the full ReversiBench harness are landing across the roadmap. We report reversibility fidelity graded, never as a boolean, and we would rather flag an action as "couldn't undo" than promise a rollback that won't hold. We target realistic adoption and never over-promise undo — because a false undo guarantee manufactures the exact auto-approve reflex this project exists to cure. Benchmark numbers are published only once they come from the live sandbox with bootstrap confidence intervals; until then this README describes capabilities qualitatively rather than quoting figures.

Community

Questions, ideas, and show-and-tell are welcome in GitHub Discussions. A Discord is coming soon. Please read the Code of Conduct.

Citation

If Unwind or ReversiBench is useful in your research, please cite it. A machine-readable CITATION.cff is included.

@article{gurram2026unwind,
  title   = {Unwind: Reversibility Inference and Compensation Synthesis for Agentic Tool Use},
  author  = {Gurram, Bhaskar},
  year    = {2026},
  eprint  = {TBD},
  archivePrefix = {arXiv},
  note    = {arXiv preprint. DOI: TBD}
}

arXiv ID and DOI are TBD and will be filled in on preprint release.

License

Licensed under the Apache License 2.0.