# Show HN: AgentWatch – Local MCP proxy that catches agents leaking your data

> Source: <https://github.com/dhanraj176/agentwatch>
> Published: 2026-07-24 12:52:33+00:00

**See what your AI agents are actually doing — and catch when they leak your data.**

AI agents (Claude Code, Cursor, and anything else using [MCP](https://modelcontextprotocol.io)) can read files, fetch web pages, and call tools with your real credentials. The problem: an agent blindly trusts whatever it reads. A poisoned web page or document can quietly instruct it to send your data somewhere it shouldn't — and today, **nobody can see it happen.**

AgentWatch is a local tool that sits between your agent and its MCP servers, shows every tool call on a live dashboard, and **flags when untrusted data flows out to an external destination** — explaining each risk in plain English.

**Watches every tool call** your agent makes, live, in your browser — no more black box.**Detects data leaks.** Tracks data from where it's read (an untrusted source like a web page) to where it goes (an outbound call), and flags the flow when untrusted content leaves your machine.**Explains findings in plain English.** Not raw JSON — a sentence anyone can read:*"Data leak: your agent fetched content from an external source, then sent it to an external server. Untrusted web content left your machine."***Never breaks your setup.** It forwards every byte unchanged and only*observes*— it can't corrupt your agent's traffic.**One line to install, one line to wire in.** No account, no cloud, fully local.

Install:

```
git clone https://github.com/dhanraj176/agentwatch.git
cd agentwatch
pip install -e ".[dashboard]"
```

(PyPI package coming soon — for now, install from source.)

Wrap whatever command launches your MCP server — everything after `--`

is your original command, run and relayed unchanged:

```
agentwatch run -- npx -y @modelcontextprotocol/server-filesystem /some/dir
```

Then open the dashboard:

```
agentwatch dashboard
```

Visit ** http://localhost:8787** and watch your agent's activity stream in live.

In your MCP config, replace the server command with the same command wrapped by `agentwatch run --`

:

```
{
  "mcpServers": {
    "filesystem": {
      "command": "agentwatch",
      "args": ["run", "--", "npx", "-y", "@modelcontextprotocol/server-filesystem", "/some/dir"]
    }
  }
}
```

Your client talks to AgentWatch exactly as it would to the real server — it doesn't notice AgentWatch is there.

See AgentWatch catch a leak without wiring up a real agent. `demo_server.py`

is
a mock MCP server with a fetch tool and an upload tool, and `run_demo.py`

drives
it: it fetches text, then passes that text straight into an outbound call — the
exact flow AgentWatch flags.

Start the dashboard, open [http://localhost:8787](http://localhost:8787), then run the demo:

```
agentwatch dashboard
python run_demo.py
```

The verdict banner flips red and the upload call is flagged with a plain-English explanation. Everything is local and synthetic — no network, no credentials.

``` php
MCP client  <--stdio-->  agentwatch  <--stdio-->  real MCP server
                             |
                             v
                       agentwatch.db  ──▶  live dashboard
```

AgentWatch spawns the real server as a subprocess and relays raw bytes between the client and server. For every JSON-RPC message it parses a **copy** and records it — the forwarded bytes are never re-serialised, so the traffic is byte-for-byte identical to a direct connection.

The leak detection works by **taint tracking**: when a result comes back from an untrusted source (a web fetch), AgentWatch remembers that data. When a later outbound call (an upload, a POST, a message send) contains that same data in its arguments, the flow is flagged as a risk. Outbound calls carrying *unrelated* data are left alone — so it flags real leaks, not every network call.

The dashboard shows, live:

- A verdict banner — green when safe, red the moment a risky flow is detected.
- Summary stats — total events, tool calls, files touched, and data leaks.
- Every tool call, with a risk indicator (safe / write / leak) and a plain-English explanation on risky rows.
- Search and filters (all / risky only / writes only), with protocol handshake noise collapsed by default.

Everything is stored in a local SQLite file (`agentwatch.db`

). A `sessions`

table (one row per run) and a `messages`

table (one row per JSON-RPC message, with timestamp, direction, method, tool name, arguments, result, and the exact raw line). Inspect it with any SQLite tool.

```
pip install -e ".[dev]"
pytest
```

**Windows:** launching`.cmd`

shims like`npx`

by bare name may fail — use`cmd /c npx ...`

or point at the underlying executable.- Fully local. No data leaves your machine; AgentWatch makes no network calls of its own.

Being upfront about what v0.1 can and can't do:

**Detection is matching-based.** AgentWatch flags an outbound call when it carries data that arrived from an untrusted source. If the model transforms that data first — base64-encodes it, summarizes it, rewords it — the match fails and the flow goes undetected. This is the known gap; smarter detection is on the roadmap.**Observe-only.** Risky flows are flagged, not blocked. Enforcement mode is the next milestone.**stdio transport only.** HTTP/SSE MCP servers aren't supported yet.**Classification is heuristic.** Which tools count as untrusted sources and outbound sinks is currently built-in, not configurable — expect false negatives on unusual tool setups.

**Enforcement mode**— block risky flows, not just detect them (the firewall).- Configurable taint sources and sinks.
- Support for more MCP transports beyond stdio.

MIT