Rewind

Undo for AI agents, with proof. Rewind records every tool call, stops at the first failure, undoes what it can in reverse, and reads everything back to prove it, over MCP.

Comment

Inspiration

Alexa+ and other assistants are starting to actually do things for us: change the thermostat, edit the family list, message everyone, arm the alarm. Every one of those is a tool call with a real effect. And real systems fail halfway. When step three of four breaks, you're left with a half-changed home and an assistant that can only say sorry.

I kept thinking about that moment. "I'll undo that" from a language model isn't proof that anything was undone. I wanted the piece of agent infrastructure I couldn't find: something that sits between the agent and its tools and makes failure recoverable and proves it.

What it does

Rewind is a self-hosted MCP server (spec 2025-11-25, Streamable HTTP). Agents call their tools through it instead of calling them directly, and for every step it does four things:

  1. Records. It checks policy, takes a lease on the resource, and snapshots it before and after the write.
  2. Contains. The first failure stops the run. A timeout counts as "unknown", so it's never retried blindly; Rewind reads the resource back to find out what actually happened.
  3. Compensates. It undoes only the steps that have a registered undo, newest first. Each undo is compare-and-set, so if someone changed the thing in the meantime, Rewind won't overwrite their change.
  4. Verifies. It reads every resource back and compares it to the original. A handler saying "OK" doesn't count.

If something can't be undone, like a message that's already been sent, Rewind tells you that by name instead of pretending. Every run ends in one of seven plain outcomes, from "recovered, verified" to "needs manual review".

The Alexa+ experience. The demo is a simulated smart home you can talk to:

  • Speak or type. Tap the light ring and say something like "turn the heat down to 18, remind me to water the plants, then lock up", or type it.
  • Watch it act and rewind. A real MCP agent carries it out through Rewind. The assistant tells you what it's about to do, the last step fails on purpose, and you watch Rewind put the house back.
  • Hear the outcome. The assistant reads it out loud.
  • Things that need a person. A household message stops and waits for your approval. Asking it to disarm the alarm gets blocked by policy before anything happens.

There's more around it:

  • a recovery playground on the landing page that runs the same planning code in the browser;
  • an execution inspector with a replay of every step;
  • teams with owner, admin, member and viewer roles;
  • API keys for MCP clients, SSO, two-factor sign-in, account lockout;
  • an append-only audit log, signed webhooks and metrics.

How I built it

  • MCP server: the official MCP TypeScript SDK (v2) on Express 5 and Node 24, with stateless Streamable HTTP and API key auth. It has 11 tools, covering operations, executions, traces and recovery.
  • The engine: deterministic on purpose. It's a state machine with snapshots, leases, a reverse-dependency recovery planner, compare-and-set undo, and read-back checks. There's no language model anywhere in the safety path: a model can ask, but Rewind decides.
  • Voice:
    • Speech in runs on the device with OpenAI's open-source Whisper model, through Hugging Face Transformers.js and ONNX Runtime Web in a Web Worker, so audio never leaves your computer. In browsers where the built-in speech recognition is reliable I use that, with a watchdog that falls back to Whisper.
    • Speech out uses the best natural voice the browser has, or Amazon Polly when AWS is connected.
    • The light ring follows your voice and the assistant's voice in real time.
  • AWS:
    • Amazon Bedrock with Amazon Nova Lite turns a request into proposed tool calls. Rewind checks every proposal against the operation's schema and refuses anything else.
    • Amazon Polly reads the outcome aloud.
    • Both are capped per day. My AWS account got locked during identity verification near the end, so they're switched off on the live site; the code and tests are in the repo.
  • Web app: React 19, Vite, Tailwind CSS 4 and Motion, with my own icons and a "rewind dial" design, under a strict Content Security Policy.
  • Data: SQLite with versioned migrations, on a persistent disk.
  • Hosting: Render, using a Blueprint.
  • Tests:
    • 122 unit and integration tests, and 15 end-to-end browser tests;
    • scripts that test voice input with a fake microphone, and voice output in real Edge and Chrome;
    • scripts that check phone scrolling, and every page for errors.

Challenges I ran into

  • Honest recovery is harder than rollback.
    • Timeouts leave you not knowing what happened.
    • People change things mid-run.
    • Some effects can never be undone.

Each of those needed its own answer: reading back, compare-and-set, and naming the thing that couldn't come back.

  • Voice in real browsers.
    • In Edge, speech recognition starts and then never answers, so my ring sat on "Listening…" forever. That's why I added Whisper on the device.
    • On Windows voices, Chrome and Edge would speak one reply, then get stuck on the next. I only found that by testing in the real browsers and logging every speech event.
  • Running a speech model under a strict security policy. Transformers.js loads its WebAssembly runtime from a CDN by default. I bundled it myself and loosened the policy only for the speech worker.
  • Phones. My first landing page crashed phones on scroll because of big blur effects. I rebuilt it with gradients and SVG, and now it scrolls with zero slow frames on a phone emulator.
  • AWS. My account was locked during identity verification, and there wasn't time to get it back before the deadline. I kept the Nova and Polly integration in and wrote it up in the friction log.

Accomplishments that I'm proud of

  • A real MCP server that turns "the agent broke my house" into "recovered, verified", with the proof right there to inspect.
  • Keeping AI out of the safety decisions entirely.
  • The approval flow. A message waits for you, then it can't be unsent, and Rewind says exactly that.
  • Voice that works in every major browser, with audio that stays on your device.

What I learned

  • Recovery needs words. Compensatable, rollback, irreversible, verified and manual review are different promises, and people deserve to know which one they got.
  • Reading things back catches bugs that "the handler returned OK" hides. One of my tests has a compensation that lies on purpose, and Rewind catches it.
  • Test voice in real browsers. Headless browsers have no voices and no microphone, so they hide the bugs that matter most.

What's next for Rewind

  • Adapters for real services: calendars, CRMs, smart-home hubs, ticketing.
  • An Alexa+ Agent Skill in front of Rewind.
  • Recovery across several MCP servers at once.
  • A hosted version on Postgres, so teams don't have to self-host.

License clarification

The demo video and screenshots reflect an earlier version of the repository, which used the MIT License. The repository has since transitioned to GNU AGPL-3.0 to preserve the openness of qualifying modified versions, including hosted deployments. Please refer to the current repository for the applicable license.

Built With

  • amazon-bedrock
  • amazon-nova
  • amazon-polly
  • aws-sdk-javascript
  • express.js
  • github
  • hugging-face-transformers.js
  • mcp
  • mcp-typescript-sdk
  • motion
  • node.js
  • onnx-runtime-web
  • openid-connect
  • playwright
  • react
  • render
  • resend
  • sqlite
  • tailwind-css
  • typescript
  • vite
  • web-audio-api
  • web-speech-api
  • whisper
  • zod
Share this project:

Updates

Submission history