A rewind button for your AI agent.

Locally, rowsafe mcp serves the tools over stdio with your saved login (or ROWSAFE_API_KEY). It is read-only unless you add a flag. --allow-restore-points adds only create_restore_point, which is what an agent needs.

$ claude mcp add rowsafe -- rowsafe mcp --allow-restore-points

$ claude mcp add rowsafe -- rowsafe mcp

Remotely, connect to https://api.rowsafe.sh/mcp with an API key in the Authorization header. Write tools are listed, but the API refuses them for a key created with --read-only.

$ claude mcp add --transport http rowsafe https://api.rowsafe.sh/mcp --header "Authorization: Bearer rsk_..."

Claude Desktop runs rowsafe mcp locally. Its remote connectors can't send an API-key header, so use stdio there, with the absolute path from which rowsafe. It uses the login saved by rowsafe login.

{
  "mcpServers": {
    "rowsafe": {
      "command": "/usr/local/bin/rowsafe",
      "args": ["mcp", "--allow-restore-points"]
    }
  }
}

Paste this into AGENTS.md or CLAUDE.md at the root of your project and set the database name. Agents read it before they work.

## Database safety (Rowsafe)

This project's PostgreSQL is protected by Rowsafe (database: `app`). Before any destructive
or risky database operation (migrations, schema changes, DROP/TRUNCATE, DELETE or UPDATE
without a narrow WHERE, backfills, resets, restoring a dump):

1. Run `safety_check` for `app` (or `rowsafe status app`). If it is not protected,
   tell me the reasons and wait for my OK.
2. Create a restore point with a descriptive name: `create_restore_point` (or
   `rowsafe mark app before-<what>`), wait until it is confirmed, and tell
   me its name.
3. Then proceed.

If something goes wrong: stop, don't try to repair the data, and never restore anything
yourself. Tell me what happened and the restore point's name; I'll decide whether to restore.

The same steps work from a shell, for agents without MCP:

rowsafe init app                     # writes .rowsafe.json; later commands can omit the name
rowsafe status app                   # protected? exit 0 if yes, 3 if not
rowsafe mark app before-drop-legacy-orders
rowsafe marks app                    # restore points, with the backup to restore from

The Claude Code plugin bundles the MCP server (with restore points), a skill that teaches the workflow, and a PreToolUse hook, rowsafe guard. The hook recognizes destructive database commands and creates a restore point named agent-<UTC timestamp> right before they run, whether or not the model remembered to.

claude plugin marketplace add rowsafe/rowsafe
claude plugin install rowsafe@rowsafe

Tell the hook which database the project uses in .rowsafe.json, which rowsafe init app writes (or set ROWSAFE_DATABASE). By default it only warns if something fails. With require_protection (or ROWSAFE_REQUIRE_PROTECTION=1) it also runs safety_check and blocks the command when the database isn't protected or the restore point can't be confirmed.

{ "database": "app", "require_protection": true }

What it matches:

• Migration tools: Prisma, Rails, Alembic, Django, Knex, Sequelize, TypeORM, Drizzle, goose, migrate, dbmate, Atlas, sqlx, Diesel, Flyway, Liquibase, Ecto, Laravel, Supabase, and db:migrate-style npm scripts.
• SQL sent to psql: DROP, TRUNCATE, ALTER TABLE ... DROP/RENAME/TYPE, DELETE or UPDATE without WHERE.
• PostgreSQL tools: dropdb, pg_restore --clean.

It ignores status, dry-run and help invocations, and commands that only mention a tool. Test a command with:

$ rowsafe guard --check "npx prisma migrate deploy"