Undo layer Synartesis GitHub →

Model Context Protocol proxy · SQLite journal

Every action
bound to the
one that
undoes it

one commandnode 22 or newer
$ npm install -g synartesis

Point a client at it →

Synartesis one run, as it happened
  1. 1 fs.read_text_file applied {"path":"~/notes/roadmap.md"}
  2. 2 fs.write_file applied undo: write_file {"content":"# Roadmap\n\n- ship 0.3\n"}
  3. 3 fs.write_file applied undo: write_file {"content":"draft\n"}
  4. 4 fs.create_directory gated note: this action cannot be undone

on disk ~/notes/roadmap.md

# Roadmap

- ship 0.3
- rewrite the parser

1 call is waiting on a person

Twenty steps,
taken back

One real run against a toy CRM. The agent edits the wrong records and deletes one, synartesis undo puts every reversible call back, and the invoice email is held rather than sent, because that is the one thing nobody can take back.

Four ways
a call can go

You write down, once, what each tool does and how to take it back. Anything you have not written down is treated as irreversible — a silent passthrough on an unknown destructive call is the one outcome worth avoiding most.

·

Readonly

Changes nothing. A lookup, a search, a list.
Recorded, forwarded.
←

Reversible

The prior state was read before the write went out.
Written back on undo.
≈

Compensable

Cannot be reversed, but a second call neutralises it.
Offset on undo.
!

Irreversible

An email that has been read. A message somebody kept.
Held until a person says yes.

What happens
on every call

In this order, because the order is the guarantee. A pre-read that runs after the write would capture nothing worth having.

Classify

The tool name is matched against your policy. No match means irreversible.

Ask, if it cannot be undone

The call is refused at once with the command that approves it, rather than left hanging. Every window a person needs is longer than a client will wait.

Read what is about to be overwritten

If that read fails, the write does not happen. A reversible action without a snapshot is only silently irreversible.

Journal, then forward

The row lands before the call goes out. A row still marked pending means the process died mid-call and the outcome is genuinely unknown.

Resolve the undo now, not later

The reversing call is worked out and stored while the old value is still readable. At undo time it may not be readable anywhere.

The part that matters

It refuses

Anything can write an old value back. Declining to is the hard part. Before undoing a step, Synartesis re-reads the record and compares it against the state that step left behind. If somebody has been there since, it stops on that step and shows the lines that differ. It is not all-or-nothing: undo walks newest first, so whatever it had already put back stays put back. Resolve the conflict and undo --replan carries on from there.

synartesis undoexit 1
$ synartesis undo

  U N D O  7b3db59c

    1  halt       crm.update_customer  drift detected

  halted at sequence 1  drift detected
  the resource is not in the state this run left it in.
    at line 1:
    - churn risk
    + spoke to her Tuesday
    1 removed, 1 added.

  R E S U L T  partial

The whole
interface

One screen, and the commands underneath it for anything that is really a script. Synartesis keeps one policy and one journal in ~/.synartesis, so none of this needs a flag, a path, or a directory to be standing in.

synartesisno arguments, from anywhere
$ synartesis

   S Y N A R T E S I S  ~/.synartesis/journal.db

  everything an agent has done through this journal

  ❯ claude-code          2026-08-22 05:00:31  complete    3 actions  1 awaiting approval
    claude-code           2026-08-22 04:41:09  rolled_back 2 actions

  [enter] open   [p] preview undo   [u] undo   [j/k] move   [g] held   [q] quit

Everything acts on whatever the cursor is on, so no id is ever carried from one command to the next by hand. g shows what is held, where a and d answer it. u asks once more before it goes, because undo is the one direction that cannot itself be undone.

synartesis init Ask a server what it can do, and draft a policy with everything guarded.
synartesis check Confirm the policy calls tools that exist, before wiring it into a client.
synartesis list Every run an agent has made, most recent first.
synartesis show One run, step by step, each with the exact call that would reverse it.
synartesis gates What is waiting on a person right now.
synartesis watch The live view on its own, for a second terminal you leave open.
synartesis approve --all Let it through. The agent makes the same call again and it goes.
synartesis undo Walk a run backwards, newest first, stopping at anything it cannot honestly reverse.
synartesis deny Refuse it, with a reason that stays on the record.
synartesis proxy What your agent runs. Not something you type, except to see why it will not start.
synartesis close End a run left open by a proxy that was killed. Nothing guesses at this: several proxies can share one journal.
synartesis prune Keeping what was in a file is what puts it back, so the journal grows. This deletes runs finished more than 30 days ago and reclaims the space.

What it
will not do

It cannot un-send what has been seen. An email that was read, a message somebody screenshotted, a file deleted where nothing keeps backups. That is why the gate exists rather than a promise it could not keep.

It only sees what goes through MCP. An agent making its own HTTP calls, running a shell command, or driving a browser outside the protocol is invisible to it. Synartesis intercepts a protocol, not an intention.

It stops rather than guessing. Undo halts at the first step it cannot reverse honestly, leaving a clean partial state and telling you exactly where it stopped.

It cannot snapshot something very large. A resource of more than roughly three megabytes cannot be read back through a stdio connection — the reply is too large to carry. Synartesis says so, and refuses the write rather than applying a change it could not capture. Nothing is lost; the call does not go through.

It can only undo what the system underneath allows. GitHub has no delete for issues, so creating one is guarded, not reversible. That is the shape of the world, and the job is to be honest about it.

ΣΥΝΑΡΤΗΣΙΣ

sunartesis — a fastening together. An agent writes to your systems through Synartesis, and Synartesis keeps hold of the other end.