Rollcage

npx add-mcp 'https://rollcage.app/mcp'

AI agents break things. Rollcage puts them back.

A Mac menu-bar app that snapshots your projects the moment Claude Code, Codex or Cursor starts, undoes a whole agent session in one click, and keeps agents out of your .env files.

$29 launch price ends on 18 October.36 spots left at $29.

7 days free, then $29 once. macOS 14 Sonoma or later. Signed and notarized by Apple.

zsh in ~/code/api

~/code/api claude "clean up the old build output"

I'll remove the stale build folders.

$ rm -rf./src./dist

removed src/routes/billing.ts

removed src/routes/auth.ts

removed src/db/schema.ts

removed src/lib/stripe.ts

removed src/server.ts

… 307 more

↺ Undo session: claude in api, 14:02–14:09

✓ 312 files back. Your own edits kept.

Works withClaude CodeCodex CLICursorGemini CLIAiderOpenCodeGooseAmp

From “oh no” to “never mind” in one click.

1. 1

   An agent starts

   Rollcage notices Claude Code, Codex, Cursor or any agent you list the moment it launches in a project.
2. 2

   Your project is cloned instantly

   An APFS copy-on-write snapshot takes well under a second and almost no disk space, then again every 15 minutes while the agent works.
3. 3

   Something goes wrong

   Files start disappearing. Rollcage counts them as they go and alerts you before you even look at the terminal.
4. 4

   You undo it

   Open the session, see exactly what it deleted, edited and created, and put it all back in one click. Your own later edits stay.

Undo the whole session, not just the last edit.

Every agent run gets its own report: the files it deleted, edited and created, every command it ran, and what the Guard stopped. One click puts it all back.

1. 1

   A snapshot when the agent starts

   An instant copy of every folder it can touch, including uncommitted work and ignored files.
2. 2

   Another when it stops

   So Rollcage knows exactly which changes were the session's, and which came later.
3. 3

   Undo this session

   Deleted files come back, edits are reverted, new files are moved aside. Anything you changed afterwards stays as it is.

Claude Code's rewind can't undo rm. Rollcage can.

claude in api

Today · 14:02 – 14:09 · 7 min

↺ Undo this session

312

files changed

18

commands

2

stopped by Guard

• − src/routes/billing.ts
• − src/db/schema.ts
• ✎ src/server.ts
• ✎ README.md changed since
• + dist/bundle.tmp.js
• … 307 more

14:03 rm -rf./src./dist

14:05 ✕ blocked: cat.env.local

README.md changed after the session, so Undo leaves your edit alone.

Your secrets stay yours. So does production.

The Guard plugs into Claude Code, Codex, Cursor and Gemini CLI. Before an agent reads a file or runs a command, Rollcage checks it.

It knows the secret files of every stack: dotenv, Rails, Laravel, Django,.NET, Terraform, SSH and cloud credentials, keys and certificates. It also catches the sneaky routes, like printing environment variables or reading them from a one-line script in Python, Node, Ruby, PHP or Go.

Destructive commands are blocked outright or paused until you approve them. You decide which.

Before an agent commits or pushes, Rollcage reads what would actually be sent. An API key or a .env file stops it. A push to main, a cloud delete or a connection to a production database waits for you.

The same check covers the network: uploads to paste, file-drop and tunnel sites are refused, and you can limit agents to a list of sites you trust.

How the Guard works Leak and production guard Network guard Secrets leak scan

The agent triesRollcage

• cat .env.local secret file Blocked
• printenv dumps environment variables Blocked
• python3 -c "import os; print(os.environ)" reads env vars in code Blocked
• git add . && git commit -m "payments" Stripe key in pay.js Blocked
• rm -rf ~ deletes your home folder Blocked
• curl -T dump.sql https://transfer.sh uploads to a file-drop site Blocked
• git push origin main protected branch Asks you
• gh repo delete acme/api deletes a repository Asks you
• git reset --hard throws away uncommitted work Asks you
• cat .env.example template, no secrets Allowed

New · Free MCP server

Claude can ask before it acts.

Add Rollcage to Claude as a connector and it can check a command, a file or a URL against the Guard's rules before it touches anything. No account, no key, nothing installed.

Claude: Settings → Connectors → Add custom connector

https://rollcage.app/mcp

Claude Code

claude mcp add --transport http --scope user rollcage https://rollcage.app/mcp

Agents

• claudeapiNeeds you Rollcage: git push to main needs your approval
• codexwebWorking · 6 min
• claudedocsDone · 14 min

Plan limits

Claude · 5 hours71%

Resets 16:40 · at this pace, full around 16:05

Claude · week38%

Resets Sun 09:00

Stop babysitting the terminal.

Rollcage follows every session through the agent's own hooks and tells you the moment one needs you.

• Needs you

  A notification the moment an agent stops for a permission prompt or a question, saying what it wants to do. Click it to jump to that terminal or editor.

• Done

  Told when a long turn finishes. The quick replies you're watching stay quiet.

• Plan limits

  Your Claude and Codex 5-hour and weekly usage, when each resets, and a warning when your pace will run out first.

Works with Claude Code, Codex CLI, Cursor and Gemini CLI. Your own Claude Code status line keeps working as before.

Quiet in the menu bar until you need it.

Session undo

Every agent run gets a report of what it changed and ran. Undo the whole session in one click, without losing your own later edits.

Auto-protect

Start an agent inside any git repository and Rollcage starts protecting it. No setup per project.

Mass-delete alarm

A notification when 100 files vanish in 10 seconds, or the folder itself disappears. You choose the numbers.

Leak and production guard

No API keys or.env files in an agent's commits or pushes. Pushes to main, cloud deletes and production databases wait for you.

Agent alerts

A notification when an agent needs your approval or finishes a long turn. Click it to jump straight to that terminal.

Plan limits

Your Claude and Codex 5-hour and weekly limits, when they reset, and a warning before your pace runs out.

Restore that never deletes

When you restore or undo, the current versions are moved aside, not thrown away. Nothing is ever lost twice.

Secrets leak scan

Finds API keys and passwords already sitting in your agents' transcripts and saved approvals, tells you which to rotate, and overwrites them on disk.

Network guard

Blocks agents from paste, file-drop and tunnel sites, or allows only the sites you list. A log shows every address they connect to.

Snapshot scheduler

Every 15 minutes while an agent is running, plus an optional fixed schedule for everything else.

Activity timeline

Every agent session, snapshot, restore and blocked command in one searchable list.

Token and cost tracking

Tokens per day, project, model and session, read from Claude Code and Codex transcripts, with what it costs at API prices.

Agent storage cleaner

See the gigabytes each agent keeps on your Mac: transcripts, caches, VM images. Move what you don't need to the Trash.

Memory monitor

Live memory and CPU for every running agent, with all the helpers and MCP servers it started. Quit or force-kill one that got out of hand.

Stays on your Mac

Snapshots, sessions and limits live on your own disk. No account, no cloud, no telemetry.

One price. Yours to keep.

Try every feature free for 7 days, no card needed. Buy only once you know it's right for you: all sales are final.

Launch offer: save $10 until 18 October

–

days

–

hours

–

min

–

sec

36 spots left at $29.

Then the price goes back to $39.

$29 $39 once, no subscription

• Snapshots, session undo and the mass-delete alarm
• Secrets, command, leak and production Guard for every supported agent
• Agent alerts and plan limits
• Auto-protect and the snapshot scheduler
• Secrets leak scan, network guard and usage tracking
• Agent storage cleaner and memory monitor
• Use one key on up to 3 of your Macs
• All future updates

Secure checkout by Stripe. The discount is applied at checkout. Your licence key arrives by email.

Learn to run agents safely.

Plain guides to what each agent's own safety features do, and where they stop.

• Claude Code security

  Is Claude Code safe? What its permissions, sandbox and hooks protect, the gaps they leave, and a checklist to close them.

• Claude Code hooks

  How hooks work, with PreToolUse examples that block.env reads, environment dumps and destructive commands.

• Claude Code permissions

  Permission modes, allow, ask and deny rules in settings.json, how to protect.env files, and where rules stop.

• Claude Code YOLO mode

  What --dangerously-skip-permissions does, what can go wrong, the equivalents in other agents, and how to run it with a safety net.

• Claude Code sandbox

  The built-in /sandbox, Docker and dev containers, how Codex compares, and what a sandbox still doesn't protect.

• Undo Claude Code changes

  /rewind and checkpoints, what they miss, and how to recover files deleted by rm or git reset --hard on a Mac.

Questions

Can Rollcage undo everything an agent did?

Yes. Each session gets a snapshot when the agent starts and another when it stops, so Undo this session puts back exactly what that run changed, including files removed by shell commands, which agents' own rewind can't restore. Files you edited afterwards are left alone.

Will it tell me when Claude Code is waiting for me?

Yes. Rollcage notifies you when Claude Code, Codex, Cursor or Gemini CLI stops for a permission prompt or a question, and when a long turn finishes. Click the notification to jump to that agent's window. It can also show your Claude and Codex plan limits.

Does it slow down my Mac or my agents?

No. Snapshots are APFS clones, which copy file references instead of data, so even large repositories are cloned in well under a second. The Guard check adds a few milliseconds to each agent action.

How much disk space do snapshots use?

Almost none until files change: a clone shares its data with the original. Rollcage keeps snapshots for 7 days or 50 snapshots by default, and you can change both.

Which agents does the Guard work with?

Claude Code, OpenAI Codex CLI, Cursor and Gemini CLI, through each tool's official hooks. Snapshots and the delete alarm work with any agent, including Aider, OpenCode, Goose and Amp.

Can an agent still get to my secrets?

The Guard stops agents from opening secret files, printing environment variables, reading them with one-line scripts, and committing or pushing keys. It can't see inside a program an agent writes to a file and then runs, so keep production keys out of your local.env and give agents test keys. The secrets scan shows you any key that did end up in a transcript.

Is Rollcage a backup?

It's an undo button for agent mistakes, kept on the same disk as your projects. Keep using Time Machine and git for real backups.

Why isn't it on the Mac App Store?

App Store apps have to run in a sandbox that would stop Rollcage from seeing running agents and installing the Guard. It's signed with an Apple Developer ID and notarized by Apple instead, so it opens without warnings.

How does the licence work?

Pay $39 once and the licence key arrives straight away, on screen and by email. One key works on up to 3 of your Macs; to move it, remove it from an old Mac in Rollcage › License. All future updates are included.

Can I try it before I buy?

Yes, that's what the 7-day trial is for: every feature, no card, no account. Because the trial lets you test everything first, all sales are final and we don't offer refunds.