---
title: "Vault for AI Agents | The Undo Button for Autonomous Infrastructure"
description: "Pre-flight checkpoints, one-call rollbacks, environment time travel, and machine-readable fleet health — Edge Vault ships in the Agent API and MCP server from day one, and works on any infrastructure."
url: https://edge.network/vault/agents/
---

# Vault for AI Agents | The Undo Button for Autonomous Infrastructure

[Vault](https://edge.network/vault)

Vault · For Agents

# The undo button for autonomous infrastructure.

Reversibility is the primitive that makes every *other* agent action less
dangerous. Vault ships in the Agent API and MCP server from day one — so agents
checkpoint before they act, roll back when they're wrong, and prove your fleet is
protected. On any infrastructure, not just Edge.

# 1. checkpoint before the migration

POST /agent/vault/snapshots

→ snap_9f2c · 1.2s · +38 MB new chunks

# 2. run the migration

✗ schema migration failed at step 3

# 3. undo

POST /agent/vault/restore { snapshot: "snap_9f2c" }

→ restored in 41s · cost $0.00

tell_user: "Migration failed; I rolled the server back to the checkpoint taken 4 minutes ago. No data was lost."

## Why reversibility is uniquely agent-shaped

The thing that makes people nervous about agents running infrastructure isn't
capability — it's irreversibility. A human pauses before a destructive command; an
agent needs that pause to be a primitive it can call. Vault gives every risky action
a cheap checkpoint in front of it and a one-call rollback behind it.

And because dedupe makes checkpoints of mostly-unchanged systems nearly free, the
right policy is simply **always checkpoint first** —
a rule that's easy to write into a system prompt and easy for an agent to follow
every single time. Agents are meticulous in a way humans never are. Vault is built
to reward that.

## The verbs

Every response includes a `tell_user` summary
for the agent to relay, and every action lands in your audit log with
`source=agent`.

POST /agent/vault/snapshots

### Pre-flight checkpoint

About to run a migration, rewrite a config, or execute anything destructive? Snapshot first and record the id in your plan. Dedupe makes a checkpoint of a mostly-unchanged system near-instant and near-free — there is no reason not to.

POST /agent/vault/restore

### One-call rollback

Restore a snapshot to a path, to a fresh VM, or into a bucket. Converts "the agent broke my server" into "the agent rolled back in one call" — and the restore costs $0, so recovery is never a budget decision.

POST /agent/vault/restore

### Environment time travel

Restore-to-fresh-VM materialises last Tuesday's production state as a disposable sandbox. Test the risky change against real history, verify, delete — without touching the live machine.

GET /agent/vault/status

### Fleet health, machine-readable

Per-device last-checkpoint age, stored size, and verification state. An agent — or a scheduled automation — can answer "is everything protected?" and open a ticket the moment the answer is no.

POST /agent/vault/verify

### Verification on demand

Trigger a restore test — a checksum walk of a sampled snapshot — and get the result as data. "Backups verified" becomes a fact an agent can assert, not a hope a human holds.

POST /agent/deploy/app

### Protected from the first hour

Deploys gain an optional vault: true flag, so infrastructure an agent provisions arrives with the undo button attached from the start. Agents are meticulous in a way humans never are — the meticulous path is one flag.

The boundary

## Agents get verbs. Never keys.

Vault keys live on the machines being protected and never transit the API.
An agent can see metadata and trigger device-side actions — snapshot, restore,
verify — but the encryption and decryption happen where the key lives. An agent
(or anyone holding its access code) can never read your plaintext.

Snapshot, restore, verify, status — all agent-callable
Keys generated and held on the device, never transmitted
Every action audit-logged with the access code that made it
Dry-run and idempotency headers, like the rest of the Agent API

## In your agent's toolbox from day one

Vault's verbs join the official MCP server alongside deploys, DNS, storage, and
compute — so Cursor, Claude Code, and any MCP client can checkpoint and roll back
the infrastructure they manage without custom integration.

And because the Agent API supports autonomous signup, an agent that's about to do
something risky can **install its own undo button** —
mid-session, no human in the loop, on the free tier with a $0 budget cap. Protection
works on whatever machine the agent is operating; only the encrypted checkpoints
live on Edge.

# one line, any MCP client

npx @edge-network/mcp

# new tools, day one

vault_snapshot · vault_restore

vault_status · vault_verify

## Give your agents an undo button

Vault is coming — with the agent surface in the first release, not a fast-follow.

[Join the Waitlist](https://edge.network/vault#waitlist)