Zerostel
OfficialThis server gives an agent Zerostel's flight-recorder capabilities: snapshot, inspect, rewind, verify, and hand off a coding session.
checkpoint: save a project snapshot before risky work and get the step number
timeline: view recorded prompts, tool calls, and changed files, optionally last N steps
rewind: preview or apply a rewind to point zero, before/after a step, or undo the last turn; supports
keep_othersand needs a confirm code when applyingchecks: see tests/type checks/linters/builds run, pass/fail, and whether code changed since
handoff: retrieve an earlier session's asks, changed files, check status, attempts, and gaps
verify: check that the current session log hasn't been edited
check_policy: ask if guardrail rules would block a shell command or file path before trying it
Provides a GitHub Action for CI, allowing Zerostel to run in GitHub workflows to record and report on AI agent sessions, with test results tied to the exact code they ran on.
Rewind any AI agent to point zero.
Zero trust for AI agents: assume they'll break something, record every step, and rewind the files they touched. A flight recorder and time machine for coding agents: every step on record, tests tied to the code they ran on, guardrails you set, and a handoff the next agent or person can check.
Website · English · 繁體中文 · 简体中文 · 日本語
Quick start
npx zerostel installWant to see it first? npx zerostel demo makes a throwaway project, plays one agent turn that deletes a folder and breaks the tests, and lets you undo it. No agent needed, and none of your projects are touched.
Then use your agent as usual. When it breaks something:
zerostel log # what happened, step by step
zerostel checks # did the tests pass on the code as it is now?
zerostel undo # put the files back to before the agent's last turn
zerostel rewind 0 # or all the way back to point zero, where the session started
zerostel handoff # what the next agent or person needs to carry on
zerostel ui # the same, clickable, in a local web pageRelated MCP server: Rewindex
What it does
Record. Every prompt, tool call, command, file change, duration and token count, in one timeline per session:
zerostel login the terminal, orzerostel uiin a local web page.Rewind. A snapshot before and after every tool call that can change files, shell commands included. Undo a turn, go back to any step, or all the way to point zero; every rewind can itself be undone.
Guard. Your own rules block a tool call, or make the agent ask you first, before it runs. The same rules for every agent.
Check and hand over. Every test, type check and build the agent runs is tied to the code it ran on, so
zerostel checkstells a pass on today's code from one on code that has changed since.zerostel handoffgives the next agent or person your asks, where things stand and what was tried.Verify and share. A hash-chained log that shows if it was edited, and a one-page report with a privacy mode for sharing.
Stay local. Nothing is uploaded,
~/.zerostelis readable only by you, and your.gitis never touched.
It's zero trust for AI agents: assume one can go wrong, see everything it does, and keep a way back (in practice). It isn't a sandbox: network requests, deployments and database writes can't be taken back. See Limits.
Why
Agents edit dozens of files, run rm, git checkout ., migrations and build scripts. When something goes wrong you're left asking what it did and how to get back.
Some agents have checkpoints of their own, and they differ a lot. Claude Code's rewind skips changes made through Bash. Copilot CLI tracks shell commands. Cursor and Codex each have their own model. If you use more than one agent, you get a different answer to "what changed and can I get it back" in each.
Zerostel records every supported agent the same way: a snapshot of the project around each tool call that can change files, a timeline of prompts, commands, files, time and tokens, and a report you can hand to someone else. It never touches your .git.
Agent's own checkpoints | Commits / | Zerostel | |
Changes made by shell commands | depends on the agent | only what you committed or stashed | ✅ inside the project, plus files you list |
Go back to a specific step | usually per prompt | per commit or stash | ✅ per tool call |
Timeline of commands, files, tokens, time | partial | ❌ | ✅ |
Log that shows if it was edited afterwards | ❌ | ✅ (commit hashes) | ✅ |
Your own rules: block or ask before a tool runs | per agent | ❌ | ✅ same rules for every agent |
Same behaviour across agents | ❌ one each | ✅ | ✅ |
Writes to your | some do | ✅ | ❌ never |
Shareable report of the session | ❌ | ❌ | ✅ |
Details and sources: docs/comparison.md. The story behind it, with the incidents: What your coding agent's checkpoints can't bring back.
Compared with other tools
Agents keep adding checkpoints of their own, and there are good add-ons too: Turnback, Turnal, bashback, logbook, codex-rewind. What Zerostel adds:
Rewinds that don't lose work. Nothing is deleted or overwritten without an exact copy, each file is looked at again right before it changes,
--keep-otherskeeps what another agent or you changed since, and every rewind, even one cut short, can be undone.More than the project folder. Watched files like
~/.zshrc, Windows user environment variables, and global installs (listed, with the commands that undo them).Evidence tied to the code. Tests and builds are recorded against the exact code they ran on, so a pass on code that has changed since shows as out of date, and a handoff can be checked against the folder.
One set of rules for every agent. Guardrails that block or ask before a tool runs, and a log that shows if it was edited.
Your agents as they are. Hooks into the official agents, no fork or wrapper; zero runtime dependencies, nothing sent anywhere.
Something else can fit better: the agents' own /rewind and codex-rewind bring the conversation back with the files, and Turnal can bisect the turn that broke the tests. Each tool side by side, with sources.
Supported agents and systems
Agent | How | Status |
Claude Code | hooks | ✅ tested on real sessions |
Codex | hooks (approve once with | ✅ tested on real sessions |
Cursor | hooks | ✅ CLI tested on real sessions; the CLI sends no prompt events, so undo goes one change at a time there. On Windows, start it from PowerShell: from Git Bash its hooks don't run |
Gemini CLI | hooks (trusted folders only) | ✅ tested end to end¹; for Code Assist Standard/Enterprise and paid API keys, since personal accounts moved to Antigravity in June 2026 |
Antigravity (CLI, desktop, IDE) | hooks | ✅ tested end to end¹; it doesn't pass on the prompt text, so turns show as "New turn" |
Copilot CLI | hooks ( | ✅ tested on real sessions |
opencode | plugin | ✅ tested on real sessions |
DeepSeek Harness | plugin | 🧪 experimental (dsh itself is a developer preview); tested end to end¹ |
anything else (Aider, scripts…) |
| ✅ coarser: no tool calls, tokens or guardrails |
¹ The real agent on Windows, with its model swapped for a scripted one: a prompt, a file write, a command, a call blocked by a rule, the end of the turn and an undo.
Experimental agents are installed only when you name them: zerostel install --agent deepseek. Reports from real sessions are welcome.
Agents don't all report the same things to their hooks (prompts, failed commands, tokens); what each one tells Zerostel.
Zerostel doesn't care which model is behind the agent: Claude, GPT, Gemini, DeepSeek or a local one are all recorded the same way.
Windows, macOS and Linux (WSL too). CI runs every commit on all three with Node 20, 22, 24 and 26.
Install
npx zerostel install # one-off, nothing installed globally
npm install -g zerostel # or keep the `zerostel` command aroundYou need git, and Node 20 or newer. No Node? Every release has a single executable with Node inside for Windows, macOS and Linux: download it from Releases and run zerostel install. Plugins for Claude Code, Codex, Antigravity and Gemini CLI, the agent skill, and how to check a download: docs/install.md.
Documentation
every command and option | |
how rules work, and tested recipes | |
| |
the GitHub Action | |
let the agent read its timeline and rewind when you ask | |
hooks, the shadow repo, safe rewinds, the audit chain | |
each principle, and what Zerostel does for it | |
what it protects and what it doesn't | |
what each agent's undo brings back, with sources | |
Turnback, Turnal, bashback and others, side by side | |
speed, disk use, git, jj, sandboxes, tokens |
Something not working? Run zerostel doctor: it checks Node, git, each agent's hooks, your config and guardrails, and its output is safe to paste into an issue.
Limits
Only states that were captured can be restored. Recording that starts after a deletion can't bring the file back.
Inside one shell command there are no intermediate states: a file created and deleted by the same command is never seen.
zerostel runsnapshots when files settle, so it can miss short-lived files too.Outside the project, only files you list under
watchare snapshotted, and only files under your home folder. On Windows, user environment variables (HKCU\Environment) are read around commands that change them and put back by rewinds; their values are kept in the session log on your machine, never in reports. Global packages are only listed, with the commands to undo them. Rewinds leave alone watched files that didn't exist at the target point. Everything else outside the project isn't covered; the timeline still shows the command that touched it.Not snapshotted, and listed by
zerostel logwhen present: ignored folders (node_modules,dist/, anything in.gitignore), nested git repositories and submodules, linked folders (symlinks, junctions) and new files abovemaxFileMB.Agents started in your home directory, a drive root or a folder above your home folder get a timeline but no snapshots.
A rewind puts back whole files: with
--keep-othersit leaves files someone else changed, but it doesn't merge edits two agents made to the same file.A test or build the agent ran counts as passed only when the agent reports the result;
zerostel check -- <command>always knows.On case-insensitive file systems (Windows, macOS by default) a rename that only changes case, such as
readme.md→README.md, isn't seen as a change.Under WSL, projects on the Windows drive (
/mnt/c/...) are slow to snapshot. Keep them in the Linux file system.The audit chain shows a log was edited by anything that doesn't have your
audit.key. Someone using your own account can read the key and rewrite a log completely; keep~/.zerostel/**in a deny rule so the agent can't.Guardrails match what a tool call names. A script or command that reaches a file without naming it gets through.
Roadmap
Done: recording and rewinding seven agents, point zero, web UI, shareable reports, verifiable logs, guardrails, MCP server, watched files outside the project, checks tied to the code they ran on, and which tests failed, handoffs, rewinds that keep other sessions' work, guardrails checked with property-based tests.
Next: signed reports anyone can verify without your key; recording calls to other MCP servers through a Zerostel gateway; rewinding to the step where a given test last passed; real-session validation of the experimental agents.
Help wanted: test reports from macOS and Linux, and anything labeled help wanted.
Contributing
Questions and ideas are welcome in Discussions. Supporting a new agent means adding one adapter to src/agents/adapters.ts. See CONTRIBUTING.md and docs/architecture.md.
npm ci && npm test && npm run smokeLicense
Available Tools
7 toolscheckpointA
Save a snapshot of the project files now, before doing something risky, so it can be rewound to later. Returns the step number.
| Name | Required | Description | Default |
|---|---|---|---|
| message | No | what is about to happen |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It discloses the effect (a restorable snapshot) and the reversibility via rewind, which is real value, but omits permissions, whether repeated calls overwrite prior checkpoints, storage cost, and idempotency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tightly written sentences, front-loaded with the action and its rationale; the return-value note is a compact addendum. No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple single-parameter tool with no output schema, the description covers purpose, trigger timing, and the return value (step number). Only minor operational details are absent, which is acceptable at this complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the 'message' parameter is already documented as 'what is about to happen.' The description adds no additional meaning about this parameter, matching the baseline 3 when the schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource (save a snapshot of the project files) and ties it to the rewind sibling via 'can be rewound to later.' It does not explicitly name a sibling to route against, but the purpose is unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives clear timing context ('now, before doing something risky'), which tells the agent when to call it. No explicit when-not conditions or named alternatives are provided, but the risky-operation trigger is actionable.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
check_policyA
Ask whether the user's guardrail rules would block a shell command or path, before trying it.
| Name | Required | Description | Default |
|---|---|---|---|
| command | Yes | a shell command or a file path |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It usefully implies a non-executing, read-only query ('would block... before trying it'), which is valuable safety context, but it says nothing about what the check returns, whether it evaluates reads vs writes differently, or what happens when no rules match.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One tightly written sentence that front-loads the purpose and ends with the actionable timing constraint. Nothing is redundant or padded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no annotations and no output schema, the description should ideally explain the return shape (allowed/blocked plus reason) and clarify non-execution more firmly. It covers purpose and timing adequately but leaves meaningful gaps for a safety-gating tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and the single 'command' parameter is already documented in the schema as 'a shell command or a file path'. The description adds no syntax, format, or edge-case detail beyond that, so the baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description pairs a specific verb ('Ask whether...would block') with a precise resource (the user's guardrail rules) and input scope (a shell command or path). It is clear on its own, but it never distinguishes itself from sibling tools like 'checks' or 'verify', which an agent could reasonably confuse it with.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
'before trying it' gives explicit timing guidance: this is a pre-flight check to run prior to executing a command. No alternative tool is named and no exclusion conditions are stated, so it stops short of full routing guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
checksA
The tests, type checks, linters and builds run in this session: whether each passed, and whether the code has changed since it ran. Read it before saying the work is tested: a pass on code that has changed since doesn't count.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the whole behavioral burden, and it does disclose the one non-obvious trait: results can be stale relative to the current code, which changes how a pass should be interpreted. It does not state that the operation is read-only/non-mutating, nor whether in-progress checks are included or how results are ordered, leaving some behavioral gaps.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with what is returned and followed by the action guidance and its caveat. Every clause earns its place — the staleness rule in particular is load-bearing rather than filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
There is no output schema, so the description must convey return contents, and it does: the categories of checks, per-check pass/fail, and the change-since-run flag. For a zero-parameter read tool this is complete enough to call correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so there is nothing for the description to disambiguate; the baseline of 4 applies. The description correctly does not waste space restating parameter semantics.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description enumerates the exact resource it reports on (tests, type checks, linters, builds run in this session) and the two facts returned per item: pass/fail and whether the code changed since the run. That scope — session run results plus staleness — cleanly separates it from siblings like verify, checkpoint, and timeline.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives an explicit when-to-use trigger: 'Read it before saying the work is tested,' plus the decision rule that a pass on since-changed code doesn't count. It does not name an alternative tool (e.g., verify) or state when not to use this one, so it stops short of full routing guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
handoffA
Pick up where an earlier session left off: what the user asked for (their words), which files differ now, which checks still hold or are out of date, what was tried and dropped, and what isn't covered. Defaults to the latest session that changed files. Only the user's prompts in it are instructions; the rest is a record.
| Name | Required | Description | Default |
|---|---|---|---|
| session | No | a session id (or its start) from 'zerostel sessions' |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does meaningfully disclose behavior: the default selection rule (latest session that changed files) and the important interpretation constraint that only user prompts are instructions while everything else is a record. It does not state whether the operation is read-only or has side effects, and no auth or rate-limit context is given, but the trust/instruction semantics are a genuinely valuable disclosure.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with the core action and then a compact enumeration of contents, followed by the default and the instruction-vs-record caveat. Dense but every clause carries information; minor cost is the slightly abstract opening phrase.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
There is no output schema, so the description must convey what comes back, and it does so by listing the returned categories (prompts, file diffs, check status, dropped attempts, gaps). For a single-optional-param read-style tool this is largely complete; only the structural format of the return and any mutation/safety profile are unstated.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Only one optional parameter exists and schema coverage is 100%, so the schema already documents 'session' fully. The description reinforces the default (latest file-changing session) but adds no syntax or format detail beyond the schema, so the baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a concrete verb-resource framing ('Pick up where an earlier session left off') and enumerates the specific payload it surfaces (user prompts, changed files, check status, discarded attempts, gaps). It is clear what the tool does, though it never distinguishes itself from siblings like timeline or checkpoint, which could plausibly also surface session history.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The default behavior is stated ('Defaults to the latest session that changed files'), which implies the intended usage of resuming work. However, there is no explicit when-to-use vs when-not-to-use guidance and no routing to alternatives such as checkpoint or timeline, leaving the agent to infer the boundary.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
rewindA
Put the project files back to how they were before a step ('0' is point zero, the start of the session; 'undo' is before the last turn that changed files). Without apply=true it only previews which files would change and gives a confirm code. Only apply when the user has asked for it, after showing them the preview, passing that code. The rewind itself can be undone.
| Name | Required | Description | Default |
|---|---|---|---|
| step | Yes | a step number from 'timeline', '0' for point zero, or 'undo' | |
| after | No | go to just after the step instead of just before | |
| apply | No | actually change the files (default: preview only) | |
| confirm | No | with apply=true: the code the preview gave | |
| keep_others | No | leave files that another session, or the user outside the agent, changed since then as they are |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and delivers: it discloses the default preview-only behavior, the confirm-code safety gate, the destructive nature (files are changed), and importantly that the rewind is itself reversible. This is exactly the behavioral context an agent needs before mutating files.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Four dense sentences, front-loaded with the core action and step semantics, then the safety workflow, then reversibility. Every sentence carries distinct information with no padding or repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with no annotations and no output schema, the description covers the action, the step semantics, the apply gate, and reversibility. It omits any hint of the preview output shape (though it names the confirm code) and the effect of 'after'/'keep_others', which are left entirely to the schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3, but the description adds real meaning beyond the schema: it explains what '0' and 'undo' resolve to in practice and ties apply=true to the confirm-code workflow. It does not extend 'after' or 'keep_others', which the schema already documents.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Put the project files back to how they were before a step'), and clarifies the 'step' values ('0' as point zero, 'undo' as before the last file-changing turn). It is unambiguous what the tool does, but it never explicitly differentiates itself from siblings like checkpoint or timeline.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives explicit when-to-use and gating rules: it only previews unless apply=true, and requires the agent to obtain user request, show the preview, and pass the confirm code before applying. Nothing about the apply workflow is left to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
timelineA
Show the recorded steps of the current session: prompts, tool calls, files changed. Step numbers are what 'rewind' takes.
| Name | Required | Description | Default |
|---|---|---|---|
| last | No | only the last N steps |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. "Show" does imply a read-only, non-mutating operation and the description discloses the return contents and the meaning of step numbers, but it says nothing about ordering, scope limits for long sessions, or what happens when no steps exist — gaps that matter for a history-viewing tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with zero filler. The core purpose and contents come first, with the rewind interoperability note following as the secondary payload — well front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is simple (one optional numeric parameter, no output schema, read-only by implication), and the description covers what is returned plus the key semantic link to rewind. It is nearly sufficient, with only minor omissions around ordering and empty/oversized histories.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and the single optional parameter 'last' is fully documented in the schema as "only the last N steps." The description never references it or adds syntax, defaults, or edge-case behavior (e.g., what 'last' does when N exceeds history), so it adds nothing beyond the schema. Baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Specific verb ("Show") plus a precisely scoped resource ("recorded steps of the current session") and an enumeration of what those steps contain: prompts, tool calls, files changed. It also ties itself to the sibling 'rewind' by explaining that the step numbers it emits are rewind's input, so an agent can position it in the toolset without opening either schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied rather than stated: the rewind cross-reference hints at the inspect-then-rewind workflow, but there is no explicit "use this when you need to inspect history before rewinding" and no distinction from checkpoint or checks, which are plausibly overlapping siblings.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
verifyB
Check that the current session's log hasn't been edited since it was recorded.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. It implies a read-only integrity check, but never discloses what a failure looks like, what the return value is, whether it is expensive, or what the agent should do if verification fails.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single well-formed sentence that front-loads the verb and states the exact condition being verified. No filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-param read-only check the scope is adequately stated, but with no output schema the description should say what result the agent gets back (pass/fail, details of tampering). That gap keeps it at minimum-viable.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so there is nothing for the description to disambiguate. Baseline 4 applies; the description correctly implies the implicit target (the current session's log).
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (check/verify) applied to a specific resource (the current session's log) with the exact property being validated (no edits since recording). This is clear and mostly self-differentiating, though the sibling 'checks' could still cause minor hesitation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No indication of when to invoke this versus 'checks', 'check_policy', or 'timeline', and no prerequisites or context for the verification (e.g., after rewind or before handoff). The agent must infer the trigger condition.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
7 tool updates
v0.1.0- First observed
check_policy - First observed
checkpoint - First observed
checks - First observed
handoff - First observed
rewind - First observed
timeline - First observed
verify
TDQS
Scored across 7 tools
Each tool has a distinct role: checkpoint (snapshot), timeline (view steps), rewind (restore), checks (test results), handoff (resume session), verify (log integrity), check_policy (guardrail query). The main overlaps are checks vs check_policy (both 'check' something) and verify vs timeline (both concern the session log), but descriptions clarify the boundaries well.
Names mix nouns (checkpoint, timeline, checks, handoff) and verbs (rewind, verify) with one snake_case outlier (check_policy), so there is no predictable verb_noun pattern. Still readable and each name maps to a concept, but conventions are inconsistent.
Seven tools is well-scoped for a session-checkpointing/rewind server. Each tool covers a distinct lifecycle stage (snapshot, inspect, restore, validate, resume, policy) with no redundant entries.
The surface covers the core lifecycle: checkpoint, timeline, rewind, checks, handoff, verify, and policy checking. Minor gaps like explicit listing/clearing of checkpoints or session enumeration exist, but agents can work around them via timeline and handoff.
Maintenance
Related MCP Connectors
Cross-agent artifact workspace with provenance across Claude Code, Codex, Cursor, LangGraph.
One searchable history across every AI coding tool, with secret scanning and a shared task board.
- MayaMemoOAuthcom.mayamemo
Evidence-backed project memory and checkpoints for AI coding agents.
Context and control for any AI. Agent identity, scoped access, and proof across tools.
Related MCP Servers
- AlicenseAqualityAmaintenanceChange tracking for AI-era codebases. AI agents call it to log structured change events (entity + diff + reasoning) before the session ends, then query history with diff, blame, history, changeset, and search. Captures the intent that would otherwise evaporate.8236 PyPI25MIT
- FlicenseNot gradedqualityCmaintenanceAuto-snapshot tool for AI agents. Reduces the risk of AI agents breaking your code by automatically saving a snapshot of every file change locally. Rewind sessions, audit code changes, and inspect diffs directly from your AI chat or the built-in dashboard. Free and safe no cloud run local.1-
- AlicenseAqualityAmaintenanceSession memory for AI coding agents. Records decisions, dead ends and assumptions as they happen, makes them greppable, and tells you when what you wrote stops being true. MCP server for Claude Code.111Apache 2.0
- AlicenseNot gradedqualityCmaintenanceCaptures AI agent runs and turns them into tamper-evident execution records showing tool use, timing, failures, recoveries, and human interventions. Records can be inspected, exported, and verified offline.MIT