Backup (AI Agent)

⚡ 3 min read

Encrypted member and credential backups are console-only — agents cannot download backup bundles through MCP. A human with Console access must run the export.

Why console-only

Backup files contain project-wide member metadata and authentication method records. Transcodes keeps this behind the Console Backup panel with end-to-end encryption and user-controlled keys — not exposed as an MCP write/download tool.

The MCP jwk_backup tool returns a pointer to the Console rather than performing the export.

What agents can do

Action	Via MCP
Explain backup format / recovery	✅ Prompt your agent
Trigger encrypted download	❌ Use Console Backup panel
Rotate or store backup files	❌ Human operator

Ask your agent: “Walk me through downloading an encrypted backup from the Console” — it can guide you using Admin → Backup steps.

What’s in a backup

Public member data (email, name, etc.)
Sign-in credentials and authentication method metadata
Excluded: private keys (they never leave user devices)

See sample backup structure in the Admin guide.

Agent + backup workflow

Agent audits who has Console access (RBAC)
Human downloads backup from Console after step-up if required
Agent helps validate JSON structure or migration scripts offline — without holding the raw export in chat logs

Next: Webhook · Admin Backup