The same commands, as JSON.

{"ok": false, "error": {"code": "...", "message": "..."}}

Name the site exactly

identify matches the whole id, the whole display name, or the whole root. Use the name the person actually gave you.

./bin/backupbinder identify --query "Fixture WordPress"
./bin/backupbinder list_sites
./bin/backupbinder inspect_site --id SITE

When the result has access.ask_user set, ask how this machine reaches the site, then ask only for that option's fields. A hostname is not a local directory. Supply the host, user, path, and keys you were given. Do not fill in ones you were not given.

inspect_site shows one site, its last run, restore status, and the cron line. Read the root before you change anything.

Changes need the id and the root

create_backup, set_schedule, add_destination, set_database, test_restore, and restore_backup refuse to run unless --root is that site's root. setup registers a new site, or returns the site that already uses that directory. A backup, a schedule change, and a remote upload wait until the caller asks for them.

./bin/backupbinder create_backup --id SITE --root /path/to/site

create_backup waits until the backup finishes, unless you pass --detach. After --detach, poll inspect_site for last_run.progress and last_run.ok.

A few more commands you will use, with their flags printed by agent: verify_backup checks a snapshot, list_backups lists runs, compare_backups takes two run ids, and explain_failure reads the last failure.

An agent over MCP

mcp speaks MCP on stdio. The host starts the program. In Cursor, the config looks like this:

{
  "mcpServers": {
    "backupbinder": {
      "command": "/path/to/backupbinder",
      "args": ["--home", "/path/to/var", "mcp"]
    }
  }
}

The tools are the same commands. serve is not a tool, because it does not return. doctor prints this config with the paths filled in. mcp does not start until restic is found.

./bin/backupbinder agent

agent prints the command list and the short instructions. This page does not repeat every flag.

Secrets stay out of the output

Database passwords, access keys, secret keys, and the restic password are not printed. The agent commands also leave out an arbitrary shell, a raw delete of the repository, a key export, and downloading a full archive into the chat.