MCP 服务器

viberevert

Local MCP server for AI agents and vibe coding safety: deterministic risk checks (payments, auth, database, secrets, infrastructure), sessions, checkpoints, policy inspection, and fix prompts. Runs over stdio against a local git repository; no language model judges risk.

README

<h1 align="center">VibeRevert</h1>

<h3 align="center">AI broke your project? Undo the session, not your week.</h3>

<p align="center"><strong>Record · Check · Fix · Restore.</strong></p>

VibeRevert records an AI coding session, flags risky changes with deterministic rules, and can restore your project files to exactly how they were before it started, including work you hadn't committed.

No AI judges the AI: risk findings are reproducible, explainable, and based on rules you can inspect.

Keep using your coding agent. VibeRevert adds the safety layer around the session — with Claude Code, Cursor, and other coding-agent workflows.

See it work

The actual CLI, condensed from a real beta payment run — check flags it, and rollback previews what it will change before you --apply:

$ viberevert check
risk: CRITICAL · payments
  app/api/checkout/route.ts          payments   (critical)
  app/api/webhooks/stripe/route.ts   payments   (critical)

$ viberevert rollback <session>        # preview — nothing changed yet
  package.json                       tracked_restored
  app/page.tsx                       tracked_restored
  app/api/checkout/route.ts          untracked_deleted
  app/api/webhooks/stripe/route.ts   untracked_deleted
  lib/stripe.ts                      untracked_deleted
  .gitignore  README.md  (your uncommitted work)   skipped_unchanged

Proof, not promises

3 real AI coding sessions. 3 exact project-file restorations. Payments, database migrations, and deployment infrastructure — all with pre-existing uncommitted work preserved. Read the beta report →

Quickstart

Works inside a Git repository and requires Node.js 22+. VibeRevert keeps its records on your machine and requires no VibeRevert account or hosted service.

npm install -g viberevert@beta

viberevert init                # one-time setup in your project
viberevert run <your-agent>    # records the session and saves your files' starting state
viberevert check               # see what changed and what looks risky
viberevert rollback <session>  # preview putting your files back; add --apply to restore

What it protects you from

You let an AI agent work across your project, and it touched more than you expected — maybe payment code, a database migration, a deploy file — while your own half-finished work was sitting right there uncommitted. VibeRevert captures your project's starting file state first, so a session you don't like doesn't cost you your afternoon.

What VibeRevert does

Around each AI coding session, VibeRevert:

Checkpoints your project first — working tree, staged changes, and untracked files, including work you haven't committed.
Records the session and the project files that changed while it ran.
Flags risky edits — changes touching auth, payments, databases, secrets, dependencies, or infrastructure (risk taxonomy).
Writes an agent-ready fix prompt from those findings, to paste into your next iteration.
Restores your files to the checkpoint when you need it.

It warns you; it does not silently block your work. An optional pre-commit hook can reject a commit above your configured risk threshold — opt-in, tunable, and bypassable like any local Git hook.

Rules decide. Agents fix.

VibeRevert does not ask another language model whether your agent's changes look risky. Its checks are deterministic: the same inputs and configuration produce the same findings, with an inspectable reason for every flag.

When something needs attention, VibeRevert can turn those findings into an agent-ready fix prompt. The rules decide what to flag; you decide what happens next.

What rollback restores — and what it doesn't

viberevert rollback restores your local project files — tracked, staged, and untracked, including uncommitted work — to how they were when the session started. It previews by default; --apply writes the change, and every apply first saves an emergency checkpoint.

It does not reverse effects outside your project files. Deployments, database writes, third-party API calls, payments, and sent emails need their own recovery. Rollback is state-based rather than atomic, and it's a safety net around AI sessions, not a replacement for tests or review. Read what rollback can and can't restore before you rely on it.

One recovery layer across your coding agents

Keep using the coding tools you prefer. VibeRevert can wrap command-line agent sessions (viberevert run <your-agent>) and integrates with tools such as Claude Code and Cursor through its installers.

Built-in checkpoints live inside the agent's workflow. VibeRevert stays with the project.

It captures your project's starting state — including uncommitted work — then records the session, flags risky changes, previews the rollback, and keeps that recovery path outside the agent itself.

Use Claude Code today, Cursor tomorrow, or wrap another terminal agent: the safety layer stays with your project.

Wire it into your tools

VibeRevert installs non-destructively and can be removed cleanly. It integrates with Claude Code and Cursor (MCP server and hooks); every install previews its changes and keeps a recovery journal. See getting started.

An experimental terminal bridge (--pty) can intercept commands inside an interactive agent shell; it's best-effort and documented as such in the PTY contract.

Platforms

Linux, macOS, and Windows, on Node.js 22+. CI runs the suite across all three on Node 22 and 24; see compatibility for exactly what each platform is tested to do.

Learn more

Getting started · Commands · Configuration
What rollback can and can't restore · Risk taxonomy
Security policy · Threat model · Contributing

Support VibeRevert

VibeRevert is Apache-2.0 open source. Sponsoring funds continued cross-platform testing, security work, rollback and recovery testing, and helping pay for independent review. Sponsorship does not influence risk findings or release decisions. → Sponsor VibeRevert · what your support funds

License

Apache-2.0. See NOTICE and the license audit.