{"slug": "show-hn-agentwatch-local-mcp-proxy-that-catches-agents-leaking-your-data", "title": "Show HN: AgentWatch – Local MCP proxy that catches agents leaking your data", "summary": "AgentWatch, a local MCP proxy tool that monitors AI agents for data leaks, has been released on GitHub by developer Dhanraj. The tool sits between agents like Claude Code or Cursor and their MCP servers, tracking every tool call on a live dashboard and flagging when untrusted data flows to an external destination. AgentWatch uses taint tracking to detect leaks, runs fully locally with no cloud dependency, and can be installed via git clone with a one-line setup.", "body_md": "**See what your AI agents are actually doing — and catch when they leak your data.**\n\nAI agents (Claude Code, Cursor, and anything else using [MCP](https://modelcontextprotocol.io)) can read files, fetch web pages, and call tools with your real credentials. The problem: an agent blindly trusts whatever it reads. A poisoned web page or document can quietly instruct it to send your data somewhere it shouldn't — and today, **nobody can see it happen.**\n\nAgentWatch is a local tool that sits between your agent and its MCP servers, shows every tool call on a live dashboard, and **flags when untrusted data flows out to an external destination** — explaining each risk in plain English.\n\n**Watches every tool call** your agent makes, live, in your browser — no more black box.**Detects data leaks.** Tracks data from where it's read (an untrusted source like a web page) to where it goes (an outbound call), and flags the flow when untrusted content leaves your machine.**Explains findings in plain English.** Not raw JSON — a sentence anyone can read:*\"Data leak: your agent fetched content from an external source, then sent it to an external server. Untrusted web content left your machine.\"***Never breaks your setup.** It forwards every byte unchanged and only*observes*— it can't corrupt your agent's traffic.**One line to install, one line to wire in.** No account, no cloud, fully local.\n\nInstall:\n\n```\ngit clone https://github.com/dhanraj176/agentwatch.git\ncd agentwatch\npip install -e \".[dashboard]\"\n```\n\n(PyPI package coming soon — for now, install from source.)\n\nWrap whatever command launches your MCP server — everything after `--`\n\nis your original command, run and relayed unchanged:\n\n```\nagentwatch run -- npx -y @modelcontextprotocol/server-filesystem /some/dir\n```\n\nThen open the dashboard:\n\n```\nagentwatch dashboard\n```\n\nVisit ** http://localhost:8787** and watch your agent's activity stream in live.\n\nIn your MCP config, replace the server command with the same command wrapped by `agentwatch run --`\n\n:\n\n```\n{\n  \"mcpServers\": {\n    \"filesystem\": {\n      \"command\": \"agentwatch\",\n      \"args\": [\"run\", \"--\", \"npx\", \"-y\", \"@modelcontextprotocol/server-filesystem\", \"/some/dir\"]\n    }\n  }\n}\n```\n\nYour client talks to AgentWatch exactly as it would to the real server — it doesn't notice AgentWatch is there.\n\nSee AgentWatch catch a leak without wiring up a real agent. `demo_server.py`\n\nis\na mock MCP server with a fetch tool and an upload tool, and `run_demo.py`\n\ndrives\nit: it fetches text, then passes that text straight into an outbound call — the\nexact flow AgentWatch flags.\n\nStart the dashboard, open [http://localhost:8787](http://localhost:8787), then run the demo:\n\n```\nagentwatch dashboard\npython run_demo.py\n```\n\nThe verdict banner flips red and the upload call is flagged with a plain-English explanation. Everything is local and synthetic — no network, no credentials.\n\n``` php\nMCP client  <--stdio-->  agentwatch  <--stdio-->  real MCP server\n                             |\n                             v\n                       agentwatch.db  ──▶  live dashboard\n```\n\nAgentWatch spawns the real server as a subprocess and relays raw bytes between the client and server. For every JSON-RPC message it parses a **copy** and records it — the forwarded bytes are never re-serialised, so the traffic is byte-for-byte identical to a direct connection.\n\nThe leak detection works by **taint tracking**: when a result comes back from an untrusted source (a web fetch), AgentWatch remembers that data. When a later outbound call (an upload, a POST, a message send) contains that same data in its arguments, the flow is flagged as a risk. Outbound calls carrying *unrelated* data are left alone — so it flags real leaks, not every network call.\n\nThe dashboard shows, live:\n\n- A verdict banner — green when safe, red the moment a risky flow is detected.\n- Summary stats — total events, tool calls, files touched, and data leaks.\n- Every tool call, with a risk indicator (safe / write / leak) and a plain-English explanation on risky rows.\n- Search and filters (all / risky only / writes only), with protocol handshake noise collapsed by default.\n\nEverything is stored in a local SQLite file (`agentwatch.db`\n\n). A `sessions`\n\ntable (one row per run) and a `messages`\n\ntable (one row per JSON-RPC message, with timestamp, direction, method, tool name, arguments, result, and the exact raw line). Inspect it with any SQLite tool.\n\n```\npip install -e \".[dev]\"\npytest\n```\n\n**Windows:** launching`.cmd`\n\nshims like`npx`\n\nby bare name may fail — use`cmd /c npx ...`\n\nor point at the underlying executable.- Fully local. No data leaves your machine; AgentWatch makes no network calls of its own.\n\nBeing upfront about what v0.1 can and can't do:\n\n**Detection is matching-based.** AgentWatch flags an outbound call when it carries data that arrived from an untrusted source. If the model transforms that data first — base64-encodes it, summarizes it, rewords it — the match fails and the flow goes undetected. This is the known gap; smarter detection is on the roadmap.**Observe-only.** Risky flows are flagged, not blocked. Enforcement mode is the next milestone.**stdio transport only.** HTTP/SSE MCP servers aren't supported yet.**Classification is heuristic.** Which tools count as untrusted sources and outbound sinks is currently built-in, not configurable — expect false negatives on unusual tool setups.\n\n**Enforcement mode**— block risky flows, not just detect them (the firewall).- Configurable taint sources and sinks.\n- Support for more MCP transports beyond stdio.\n\nMIT", "url": "https://wpnews.pro/news/show-hn-agentwatch-local-mcp-proxy-that-catches-agents-leaking-your-data", "canonical_source": "https://github.com/dhanraj176/agentwatch", "published_at": "2026-07-24 12:52:33+00:00", "updated_at": "2026-07-24 13:22:32.038742+00:00", "lang": "en", "topics": ["ai-agents", "ai-safety", "developer-tools", "ai-tools"], "entities": ["AgentWatch", "Dhanraj", "Claude Code", "Cursor", "MCP", "GitHub"], "alternates": {"html": "https://wpnews.pro/news/show-hn-agentwatch-local-mcp-proxy-that-catches-agents-leaking-your-data", "markdown": "https://wpnews.pro/news/show-hn-agentwatch-local-mcp-proxy-that-catches-agents-leaking-your-data.md", "text": "https://wpnews.pro/news/show-hn-agentwatch-local-mcp-proxy-that-catches-agents-leaking-your-data.txt", "jsonld": "https://wpnews.pro/news/show-hn-agentwatch-local-mcp-proxy-that-catches-agents-leaking-your-data.jsonld"}}