Coverage
What gmonk covers
An AI agent doesn't only run SQL. It writes files, runs shell commands, mutates object storage, and calls paid APIs. gmonk captures, gates, and reverses across every one of those surfaces.
| Surface | Prevention | Recovery |
|---|---|---|
| Databases Postgres & MySQL | Refuses DROP, TRUNCATE, no-WHERE DELETE at the wire; guarantee mode rolls back anything unprovable. | Row INSERT/UPDATE/DELETE restored by primary key from before-images. Concurrency-preserving (operation-aware) undo. |
| Files & filesystem | Shell gate pauses deletes that reach outside the workspace. | Create/modify/delete captured with content snapshots; undo restores, recreates, or deletes the file exactly. |
| Shell commands | Commands gmonk can't recover — escaping the workdir, or dd/mkfs/rm -rf outside cwd — are paused for approval (or blocked). | Commands that stay inside the workspace are snapshotted so their file effects can be undone. |
| Object storage S3 / MinIO | Fail-closed bucket/prefix allowlist; only approved objects are touched. | Put/delete captured by version (server-side copy, no bytes stored) or snapshot (bytes to the content store). Reverse with an etag/versionId drift check. |
| External APIs custom functions | Held for approval or blocked when classified irreversible. | Undone by a compensating call you define with @gmonk/sdk (e.g. a Stripe refund), with an idempotency key. gmonk never calls a third party on its own. |
| MCP tool calls | Gate + guard policy + approval holds apply at the MCP boundary. | A hook records every tool call from Claude Code, Cline, Codex, Cursor, or Gemini CLI, and resolves each to an effect type + reverse. |
Effect types & how each is reversed
gmonk classifies every action into an effect type and the reverse it would need:
| Effect | Reverse |
|---|---|
| create / modify / delete (file) | restore · recreate · delete from the captured before-state |
| insert / update / delete (DB row) | re-insert · restore · delete by primary key |
| object put / delete (S3) | restore prior version · re-put snapshot · delete |
| compensable-external | a registered compensating call (you supply the executor) |
| irreversible-external / unknown | flagged — recorded and surfaced for a human, never silently undone |
Honest limits
gmonk fails toward flagged — anything it can't reverse with certainty is surfaced, not silently dropped. Known limits today:
- Only Postgres & MySQL database engines (no Mongo/SQLite/SQL Server yet).
- Rows with no primary key can't be reversed row-by-row — they're reported by name.
- The dependency graph tracks SQL foreign-key and same-path file edges; causal links across tool-result→argument or object keys are conservative.
- The shell gate is best-effort defense-in-depth, not a guarantee — a hard guarantee needs an OS sandbox. It fails toward ask.