Show HN: AgentWatch – Local MCP proxy that catches agents leaking your data

See what your AI agents are actually doing — and catch when they leak your data.

AI agents (Claude Code, Cursor, and anything else using MCP) can read files, fetch web pages, and call tools with your real credentials. The problem: an agent blindly trusts whatever it reads. A poisoned web page or document can quietly instruct it to send your data somewhere it shouldn't — and today, nobody can see it happen.

AgentWatch is a local tool that sits between your agent and its MCP servers, shows every tool call on a live dashboard, and flags when untrusted data flows out to an external destination — explaining each risk in plain English.

Watches every tool call your agent makes, live, in your browser — no more black box.Detects data leaks. Tracks data from where it's read (an untrusted source like a web page) to where it goes (an outbound call), and flags the flow when untrusted content leaves your machine.Explains findings in plain English. Not raw JSON — a sentence anyone can read:"Data leak: your agent fetched content from an external source, then sent it to an external server. Untrusted web content left your machine."Never breaks your setup. It forwards every byte unchanged and onlyobserves— it can't corrupt your agent's traffic.One line to install, one line to wire in. No account, no cloud, fully local.

Install:

git clone https://github.com/dhanraj176/agentwatch.git
cd agentwatch
pip install -e ".[dashboard]"

(PyPI package coming soon — for now, install from source.)

Wrap whatever command launches your MCP server — everything after --

is your original command, run and relayed unchanged:

agentwatch run -- npx -y @modelcontextprotocol/server-filesystem /some/dir

Then open the dashboard:

agentwatch dashboard

Visit ** http://localhost:8787** and watch your agent's activity stream in live.

In your MCP config, replace the server command with the same command wrapped by agentwatch run --

:

{
  "mcpServers": {
    "filesystem": {
      "command": "agentwatch",
      "args": ["run", "--", "npx", "-y", "@modelcontextprotocol/server-filesystem", "/some/dir"]
    }
  }
}

Your client talks to AgentWatch exactly as it would to the real server — it doesn't notice AgentWatch is there.

See AgentWatch catch a leak without wiring up a real agent. demo_server.py

is a mock MCP server with a fetch tool and an upload tool, and run_demo.py

drives it: it fetches text, then passes that text straight into an outbound call — the exact flow AgentWatch flags.

Start the dashboard, open http://localhost:8787, then run the demo:

agentwatch dashboard
python run_demo.py

The verdict banner flips red and the upload call is flagged with a plain-English explanation. Everything is local and synthetic — no network, no credentials.

MCP client  <--stdio-->  agentwatch  <--stdio-->  real MCP server
                             |
                             v
                       agentwatch.db  ──▶  live dashboard

AgentWatch spawns the real server as a subprocess and relays raw bytes between the client and server. For every JSON-RPC message it parses a copy and records it — the forwarded bytes are never re-serialised, so the traffic is byte-for-byte identical to a direct connection.

The leak detection works by taint tracking: when a result comes back from an untrusted source (a web fetch), AgentWatch remembers that data. When a later outbound call (an upload, a POST, a message send) contains that same data in its arguments, the flow is flagged as a risk. Outbound calls carrying unrelated data are left alone — so it flags real leaks, not every network call.

The dashboard shows, live:

• A verdict banner — green when safe, red the moment a risky flow is detected.
• Summary stats — total events, tool calls, files touched, and data leaks.
• Every tool call, with a risk indicator (safe / write / leak) and a plain-English explanation on risky rows.
• Search and filters (all / risky only / writes only), with protocol handshake noise collapsed by default.

Everything is stored in a local SQLite file (agentwatch.db

). A sessions

table (one row per run) and a messages

table (one row per JSON-RPC message, with timestamp, direction, method, tool name, arguments, result, and the exact raw line). Inspect it with any SQLite tool.

pip install -e ".[dev]"
pytest

Windows: launching.cmd

shims likenpx

by bare name may fail — usecmd /c npx ...

or point at the underlying executable.- Fully local. No data leaves your machine; AgentWatch makes no network calls of its own.

Being upfront about what v0.1 can and can't do:

Detection is matching-based. AgentWatch flags an outbound call when it carries data that arrived from an untrusted source. If the model transforms that data first — base64-encodes it, summarizes it, rewords it — the match fails and the flow goes undetected. This is the known gap; smarter detection is on the roadmap.Observe-only. Risky flows are flagged, not blocked. Enforcement mode is the next milestone.stdio transport only. HTTP/SSE MCP servers aren't supported yet.Classification is heuristic. Which tools count as untrusted sources and outbound sinks is currently built-in, not configurable — expect false negatives on unusual tool setups.

Enforcement mode— block risky flows, not just detect them (the firewall).- Configurable taint sources and sinks.

• Support for more MCP transports beyond stdio.

MIT