Your agent failed at
step 3 of 5. Now what?

┌─ the problem

MCP standardized how agents call tools.
It says nothing about how to undo one.

Agents run multistep jobs against real systems: create the user, grant access, send the email, charge the card. When step 4 fails, steps 1–3 are already committed in three different systems — and nothing at the protocol level knows what is safe to reverse, or how.

Workflow engines solved this decades ago with the saga pattern — inside your own code. MCP tools are other people's code. There was no declarative, portable way for a server to say: "the inverse of this tool is that one, with these parameters." Now there is.

┌─ how it works

One proxy between the agent and the world

1. InterceptEvery tools/call, over stdio or Streamable HTTP. stdout stays pure JSON-RPC; the human UI lives on stderr.
2. ClassifyExplicit mcp-compensate metadata → native MCP annotations → conservative name heuristics. Explicit always wins.
3. Show the impactA human-readable diff: what will run, with which arguments, and whether it can be undone — before any effect.
4. Gate on approvalTerminal prompt, policy mode, or a remote control plane with Slack buttons and multi-approver quorum.
5. Compensate on failureLIFO saga rollback driven by static parameter mappings. No LLM anywhere in the rollback path — by design, against prompt injection.
6. Audit everythingAppend-only JSONL with a sha256 hash chain. Tamper with one line and the chain breaks from there on — verifiable by third parties.

┌─ the open standard

mcp-compensate — reversibility, declared

A tiny MCP extension (dev.chronomcp/compensate): each tool declares its class in tools/list. Gateways get semantics; clients that ignore it lose nothing.

"_meta": {
  "dev.chronomcp/compensate": {
    "reversibility": "compensable",
    "compensation": {
      "toolName": "delete_record",
      "parameterMapping": { "id": "$.output.structuredContent.id" }
    },
    "sideEffectScope": ["storage"]
  }
}

No metadata? Reversibility is unknown — never inferred as safe. Full spec, JSON Schema, reference proxy and a complete demo server in the repo.

┌─ what we will not promise

Honesty is the feature

┌─ open-core

The standard is free. The operation is paid.

┌─ for teams · early access

Approvals your auditor will love

Running AI agents against real systems at work? We're onboarding a small group of pilot teams: Slack approvals, multi-approver quorum, and a compliance trail your auditor can verify independently. Free during the pilot — you shape the product.

┌─ faq

Questions we actually get