# gmonk

> gmonk is a self-hosted safety and disaster-recovery layer for AI agents. It sits in front of an AI agent's actions, records every one into a tamper-evident tree, captures the before-state, blocks actions it cannot undo (a pre-flight "reversibility" gate), and lets a human reverse a run — per action and drift-aware — when the agent misbehaves. It runs entirely inside your own infrastructure; no code, prompts, or data leave your network. The engine is closed-source and ships as a Docker image; the compensation SDK (@gmonk/sdk) is open source (MIT).

## What gmonk covers (every action an agent takes, not just databases)

- Databases — Postgres and MySQL. UPDATE / DELETE / INSERT captured with before-images; DROP / TRUNCATE / no-WHERE deletes refused at the wire. Concurrency-preserving, operation-aware undo.
- Files & filesystem — create / modify / delete captured with content snapshots; restore, recreate, or delete on undo.
- Shell commands — commands gmonk cannot recover (escaping the workspace, or device ops like `rm -rf` outside cwd, `dd`, `mkfs`) are paused for human approval via the agent's own prompt.
- Object storage (S3 / MinIO) — object put / delete captured via version (server-side copy, no bytes stored) or snapshot (bytes to the content store); reverse restores/recreates/deletes with a drift (etag/versionId) check.
- External API effects (custom functions) — charges, SaaS resources, and any opaque call are reversed by a compensating call you define with @gmonk/sdk (e.g. a Stripe refund). gmonk never calls a third party on its own; irreversible/unknown effects are flagged for a human.
- MCP tool calls — for MCP-native agents (Claude Code, Cline, Codex, Cursor, Gemini CLI) a capture hook records every tool call and gates unrecoverable shell commands.

## The two pillars

- Prevention (the gate): a reversibility oracle scores how recoverable each action is before it runs. Modes: advise (score only) · block (refuse below a floor) · guarantee (prove-then-commit — capture and execute in one transaction, roll back unless the undo is provable) · off. A declarative guard policy layers extra allow/warn/require-approval/block rules.
- Recovery (undo): reverse a whole run or one action; drift-aware (skips rows changed since the agent); concurrency-preserving (recovers the operation and applies its inverse); causal excise (undo one action plus exactly its transitive dependents); rewind-repair-replay; point-in-time reconstruction; external compensation.

## How capture connects

- Wire proxy (main path): the agent points at gmonk instead of the database; gmonk records how to undo each write before passing it through. Postgres and MySQL, auto-detected from the URL scheme.
- Out-of-band (WAL / logical decoding, or triggers): for locked-down managed databases you cannot proxy.
- MCP hook: for agents that speak tool calls instead of opening a database connection.

## Deployment & security

- Ships as a Docker image + a Postgres store: `GMONK_IMAGE=gmonkdev/gmonk:0.5.0 docker compose up`. Review UI on http://127.0.0.1:4319 (loopback by default).
- Self-hosted only; gmonk's own store is separate from the protected database. Backend TLS to remote targets is mandatory by default. Review UI supports tokens, per-user accounts, and SSO/OIDC. Tamper-evident hash chain + audit log. Tenant isolation via row-level security.

## Docs

- [Overview](https://gmonk.dev/docs)
- [What gmonk covers](https://gmonk.dev/docs/coverage)
- [Capture](https://gmonk.dev/docs/capture)
- [Prevention — the gate](https://gmonk.dev/docs/prevention)
- [Recovery — undo](https://gmonk.dev/docs/recovery)
- [Approvals & alerts](https://gmonk.dev/docs/approvals)
- [Deployment & security](https://gmonk.dev/docs/deployment)
- [Configuration](https://gmonk.dev/docs/configuration)
- [CLI reference](https://gmonk.dev/docs/cli)
- [Install guide](https://gmonk.dev/install)

## Links

- Docker image: https://hub.docker.com/r/gmonkdev/gmonk
- Open-source compensation SDK: https://www.npmjs.com/package/@gmonk/sdk
- Contact: hello@gmonk.dev