GitHub - dhanraj176/agentwatch: See what your AI agents are doing — and catch when they leak your data · GitHub
/" data-turbo-transient="true" />
Skip to content
Search or jump to...
Search code, repositories, users, issues, pull requests...
-->
Search
Clear
Search syntax tips
Provide feedback
--><br>We read every piece of feedback, and take your input very seriously.
Include my email address so I can be contacted
Cancel
Submit feedback
Saved searches
Use saved searches to filter your results more quickly
-->
Name
Query
To see all available qualifiers, see our documentation.
Cancel
Create saved search
Sign in
/;ref_cta:Sign up;ref_loc:header logged out"}"<br>Sign up
Appearance settings
Resetting focus
You signed in with another tab or window. Reload to refresh your session.<br>You signed out in another tab or window. Reload to refresh your session.<br>You switched accounts on another tab or window. Reload to refresh your session.
Dismiss alert
{{ message }}
dhanraj176
agentwatch
Public
Notifications<br>You must be signed in to change notification settings
Fork
Star
main
BranchesTags
Go to file
CodeOpen more actions menu
Folders and files<br>NameNameLast commit message<br>Last commit date<br>Latest commit
History<br>6 Commits<br>6 Commits
docs
docs
mcp-playground
mcp-playground
src/agentwatch
src/agentwatch
tests
tests
.gitignore
.gitignore
README.md
README.md
demo_server.py
demo_server.py
pyproject.toml
pyproject.toml
run_demo.py
run_demo.py
View all files
Repository files navigation
AgentWatch
See what your AI agents are actually doing — and catch when they leak your data.
AI agents (Claude Code, Cursor, and anything else using MCP) can read files, fetch web pages, and call tools with your real credentials. The problem: an agent blindly trusts whatever it reads. A poisoned web page or document can quietly instruct it to send your data somewhere it shouldn't — and today, nobody can see it happen.
AgentWatch is a local tool that sits between your agent and its MCP servers, shows every tool call on a live dashboard, and flags when untrusted data flows out to an external destination — explaining each risk in plain English.
What it does
Watches every tool call your agent makes, live, in your browser — no more black box.
Detects data leaks. Tracks data from where it's read (an untrusted source like a web page) to where it goes (an outbound call), and flags the flow when untrusted content leaves your machine.
Explains findings in plain English. Not raw JSON — a sentence anyone can read: "Data leak: your agent fetched content from an external source, then sent it to an external server. Untrusted web content left your machine."
Never breaks your setup. It forwards every byte unchanged and only observes — it can't corrupt your agent's traffic.
One line to install, one line to wire in. No account, no cloud, fully local.
Quick start
Install:
git clone https://github.com/dhanraj176/agentwatch.git<br>cd agentwatch<br>pip install -e ".[dashboard]"
(PyPI package coming soon — for now, install from source.)
Wrap whatever command launches your MCP server — everything after -- is your original command, run and relayed unchanged:
agentwatch run -- npx -y @modelcontextprotocol/server-filesystem /some/dir
Then open the dashboard:
agentwatch dashboard
Visit http://localhost:8787 and watch your agent's activity stream in live.
Wiring it into a client (e.g. Claude Code)
In your MCP config, replace the server command with the same command wrapped by agentwatch run --:
"mcpServers": {<br>"filesystem": {<br>"command": "agentwatch",<br>"args": ["run", "--", "npx", "-y", "@modelcontextprotocol/server-filesystem", "/some/dir"]
Your client talks to AgentWatch exactly as it would to the real server — it doesn't notice AgentWatch is there.
Try the demo (60 seconds)
See AgentWatch catch a leak without wiring up a real agent. demo_server.py is<br>a mock MCP server with a fetch tool and an upload tool, and run_demo.py drives<br>it: it fetches text, then passes that text straight into an outbound call — the<br>exact flow AgentWatch flags.
Start the dashboard, open http://localhost:8787, then run the demo:
agentwatch dashboard<br>python run_demo.py
The verdict banner flips red and the upload call is flagged with a plain-English<br>explanation. Everything is local and synthetic — no network, no credentials.
How it works
agentwatch real MCP server<br>agentwatch.db ──▶ live dashboard">MCP client agentwatch real MCP server<br>agentwatch.db ──▶ live dashboard
AgentWatch spawns the real server as a subprocess and relays raw bytes between the client and server. For every JSON-RPC message it parses a copy and records it — the forwarded bytes are never re-serialised, so the traffic is byte-for-byte identical to a direct connection.
The leak detection works by taint tracking : when a result comes back from an untrusted source (a web fetch), AgentWatch remembers that data. When a later outbound call (an upload, a POST, a...