02Open source · Agent safety · MCP

Unwind

A reversibility layer for agentic tool use. A transparent MCP proxy that works out which agent actions can be taken back, quietly reverses the ones that go wrong, and interrupts you only for the ones that genuinely can't be undone.

Sole author · v0.1.0 · early beta · public since Aug 2026

Source ↗Docs ↗pip install unwind-mcp
R0–R4
reversibility classes
3
distribution channels
v0.1.0
early beta release
Apache-2.0
license

In short

  • Human oversight of agents fails because approval prompts are undifferentiated — nothing in the stack knows which actions are reversible, so people develop an approve-approve-approve reflex. Unwind supplies the missing primitive.
  • Contributed the R0–R4 reversibility taxonomy, treating reversibility as ordinal and environment-relative: the same write_file is self-reversible on a git-backed tree and irreversible on a versionless one.
  • Fails safe asymmetrically — misclassifying an irreversible action as reversible is catastrophic while the reverse is merely annoying, so unknown tools, failed classification, and timeouts all escalate to a human.
  • Apache-2.0 with full open-source governance: CODEOWNERS, security policy, code of conduct, citation metadata, OpenSSF Scorecard, CI with coverage, and a published docs site.
01

The thesis

Human oversight of agents fails because approval prompts are undifferentiated, and they are undifferentiated because nothing in the stack knows which actions are reversible. That produces an approve-approve-approve reflex, which a single prompt injection can exploit. Reversibility classification is the missing primitive that makes human oversight work at all.

02

What it does

  • A transparent MCP proxy that sits between any AI agent and any MCP server, infers which tool calls are reversible, maintains a durable cross-server undo log, synthesizes inverse operations, and interrupts the human only for genuinely irreversible actions.
  • The R0–R4 reversibility taxonomy — nullipotent, self-reversible, compensable, mitigable-only, irreversible — treats reversibility as ordinal and environment-relative. The same write_file is R1 on a git-backed tree and R4 on a versionless one.
  • Orthogonal dimensions for blast radius, externality, and a time-decaying reversibility half-life.
03

Failing safe, asymmetrically

Misclassifying an irreversible action as reversible is catastrophic; the reverse is merely annoying. So unknown tools, failed classification, timeouts, and classifier crashes all escalate to a human. Unwind never auto-allows under uncertainty.

04

Positioning

Every competing MCP gateway — Docker MCP Gateway, ToolHive, agentgateway, IBM ContextForge, MCPJungle — is a preventive control: it decides whether to allow a call, and none can recover from one. Unwind deliberately declines auth, RBAC, and rate limiting as out of scope and does the one thing none of them do: recovery.

05

Shipping discipline

  • Apache-2.0 with CODEOWNERS, GOVERNANCE.md, SECURITY.md, CONTRIBUTING.md, a Code of Conduct, CITATION.cff, OpenSSF Scorecard, CI with coverage reporting, pre-commit hooks, a devcontainer, Docker/compose, and a published MkDocs site.
  • Distributed three ways: PyPI (unwind-mcp), npm (unwind-mcp), and a ghcr.io container.
  • ReversiBench, a reversibility benchmark with a live sandbox, is in progress — figures will be published only with bootstrap confidence intervals from the live harness rather than quoted early.
06

Honest status

Made public in August 2026 at v0.1.0, early beta, one contributor. A new repository has no adoption history yet; the code, governance, and packaging are the verifiable part today.