Backup (AI Agent)
⚡ 3 min readEncrypted member and credential backups are console-only — agents cannot download backup bundles through MCP. A human with Console access must run the export.
Why console-only
Backup files contain project-wide member metadata and authentication method records. Transcodes keeps this behind the Console Backup panel with end-to-end encryption and user-controlled keys — not exposed as an MCP write/download tool.
The MCP jwk_backup tool returns a pointer to the Console rather than performing the export.
What agents can do
| Action | Via MCP |
|---|---|
| Explain backup format / recovery | ✅ Prompt your agent |
| Trigger encrypted download | ❌ Use Console Backup panel |
| Rotate or store backup files | ❌ Human operator |
Ask your agent: “Walk me through downloading an encrypted backup from the Console” — it can guide you using Admin → Backup steps.
What’s in a backup
- Public member data (email, name, etc.)
- Sign-in credentials and authentication method metadata
- Excluded: private keys (they never leave user devices)
See sample backup structure in the Admin guide.
Agent + backup workflow
- Agent audits who has Console access (RBAC)
- Human downloads backup from Console after step-up if required
- Agent helps validate JSON structure or migration scripts offline — without holding the raw export in chat logs
Next: Webhook · Admin Backup
Last updated on