Backstop

Documentation

A working undo for AI-agent writes to your business systems. Point your agent at a Backstop MCP endpoint instead of the native one — every write is journaled before it executes, and backstop_undo rolls it back with conflict detection.

How it works

Backstop is a superset MCP server. It mirrors a platform's native tools (so your agent's prompts don't change) and adds backstop_* tools. Each mirrored write goes through one path: read the prior state → journal it → execute. Because nothing reaches the platform except through that path, undo can always find what changed.

Connections start in shadow mode — writes are journaled and undo is previewed but not executed — so you can watch an agent safely. Flip to protecting when you trust it, and backstop_undo executes real rollbacks.

Install

Add a Backstop endpoint to your MCP client with a bearer token. Streamable-HTTP, one endpoint per platform:

{
  "mcpServers": {
    "backstop-hubspot": {
      "url": "https://getbackstop.co/api/mcp/hubspot",
      "headers": { "Authorization": "Bearer <YOUR_TOKEN>" }
    },
    "backstop-shopify": {
      "url": "https://getbackstop.co/api/mcp/shopify",
      "headers": { "Authorization": "Bearer <YOUR_TOKEN>" }
    }
  }
}

Then call tools/list — you'll see the mirrored tools plus backstop_preview, backstop_undo, backstop_diff, and backstop_report.

Scopes

HubSpot (private-app token)

crm.objects.contacts, companies, deals, tickets (read + write), plus owners and schemas. Optional automation to surface workflow-enrollment warnings in preview.

Shopify (Admin API token)

read/write_products, read/write_inventory, read_locations, and read_orders (for the exposure impact report).

What undo covers — and what it refuses

Backstop is a safety product, so it refuses rather than guesses. Every proposed write is classified; backstop_preview shows the class and blast radius before you commit.

Operation	Coverage
Create	Covered — undo deletes the created record.
Update (field values)	Covered — undo restores prior values, with field-level conflict detection (refuses if someone else changed the same field since).
Shopify inventory adjust	Covered (rule S-1) — undo applies the opposite delta, so it composes with sales instead of erasing them.
HubSpot archive/delete	Handoff (rule H-1) — undo re-creates the record, but associations must be re-linked by hand; it warns you first.
Shopify product delete	Refused — permanent, no recycle bin. Classified irreversible; Backstop refuses by default.
Side effects (emails sent, workflows fired, orders placed)	Cannot be recalled — undo repairs the record; it can't un-send an email. Preview flags these, and the impact report quantifies what happened in the exposure window.

The backstop_* tools

backstop_preview — dry-run a write: exact field changes, blast radius (records + associations touched), workflow side effects, and reversibility.
backstop_undo — roll back a session (or specific actions), with conflict detection; refuses (previews) in shadow mode.
backstop_diff — prior / written / current-live for every field in a session.
backstop_report — exportable audit record, including the Shopify exposure impact.

HubSpot tools

Tool	What it does
crm_read_object	Read a HubSpot CRM object by type and id.
crm_create_object	Create a HubSpot CRM object. Journaled and reversible through Backstop.
crm_update_object	Update properties on a HubSpot CRM object. Journaled and reversible through Backstop.
crm_batch_update	Update many HubSpot CRM objects at once. Journaled one action per record, so each is independently undoable.
crm_archive_object	Archive (soft-delete) a HubSpot CRM object. Undo is a guided restore (rule H-1).
backstop_preview	Dry-run a proposed write: show exactly what it would change, its blast radius (records + associations it touches, and any workflow it would enroll — a non-undoable side effect), and its reversibility, without executing.
backstop_undo	Roll back writes made through Backstop in a session, with conflict detection. Optionally a subset of action ids.
backstop_diff	Field-level diff for a session: prior, written, and current-live values.
backstop_report	Exportable audit record for a session: every action, what it changed, current state, and exposure impact.

Shopify tools

Tool	What it does
product_read	Read a Shopify product by id (gid://shopify/Product/...).
product_create	Create a Shopify product (fields: title, status, ...). Journaled and reversible through Backstop.
product_update	Update fields on a Shopify product. Journaled and reversible through Backstop.
product_delete	Delete a Shopify product. Permanent (no recycle bin) — Backstop classifies this irreversible and refuses/hands off rather than pretending it can restore.
inventory_adjust	Adjust available stock by a DELTA at a location. Rule S-1: the undo is the opposite delta, so it composes with sales that happened in between instead of erasing them.
inventory_set	Set available stock to an ABSOLUTE value at a location. Undo restores the prior value with native compare-and-set (refuses if the live value moved under it).
backstop_preview	Dry-run a proposed write: show exactly what it would change, its blast radius (records + associations it touches), and its reversibility, without executing.
backstop_undo	Roll back writes made through Backstop in a session, with conflict detection. Optionally a subset of action ids.
backstop_diff	Field-level diff for a session: prior, written, and current-live values.
backstop_report	Exportable audit record for a session: every action, what it changed, current state, and exposure impact (e.g. units sold while a bad stock level was live).

Plans & retention

The free tier is a permanent plan whose only constraint is history depth (7 days) — never the restore itself. Paid plans extend retention and unlock unprotected-write detection, PDF export, and more connections. A downgrade keeps everything for a 14-day grace window first. See Billing.