Show HN: AgentWatch – Local MCP proxy that catches agents leaking your data

AgentWatch, a local MCP proxy tool that monitors AI agents for data leaks, has been released on GitHub by developer Dhanraj. The tool sits between agents like Claude Code or Cursor and their MCP servers, tracking every tool call on a live dashboard and flagging when untrusted data flows to an external destination. AgentWatch uses taint tracking to detect leaks, runs fully locally with no cloud dependency, and can be installed via git clone with a one-line setup.

See what your AI agents are actually doing — and catch when they leak your data. AI agents Claude Code, Cursor, and anything else using MCP https://modelcontextprotocol.io can read files, fetch web pages, and call tools with your real credentials. The problem: an agent blindly trusts whatever it reads. A poisoned web page or document can quietly instruct it to send your data somewhere it shouldn't — and today, nobody can see it happen. AgentWatch is a local tool that sits between your agent and its MCP servers, shows every tool call on a live dashboard, and flags when untrusted data flows out to an external destination — explaining each risk in plain English. Watches every tool call your agent makes, live, in your browser — no more black box. Detects data leaks. Tracks data from where it's read an untrusted source like a web page to where it goes an outbound call , and flags the flow when untrusted content leaves your machine. Explains findings in plain English. Not raw JSON — a sentence anyone can read: "Data leak: your agent fetched content from an external source, then sent it to an external server. Untrusted web content left your machine." Never breaks your setup. It forwards every byte unchanged and only observes — it can't corrupt your agent's traffic. One line to install, one line to wire in. No account, no cloud, fully local. Install: git clone https://github.com/dhanraj176/agentwatch.git cd agentwatch pip install -e ". dashboard " PyPI package coming soon — for now, install from source. Wrap whatever command launches your MCP server — everything after -- is your original command, run and relayed unchanged: agentwatch run -- npx -y @modelcontextprotocol/server-filesystem /some/dir Then open the dashboard: agentwatch dashboard Visit http://localhost:8787 and watch your agent's activity stream in live. In your MCP config, replace the server command with the same command wrapped by agentwatch run -- : { "mcpServers": { "filesystem": { "command": "agentwatch", "args": "run", "--", "npx", "-y", "@modelcontextprotocol/server-filesystem", "/some/dir" } } } Your client talks to AgentWatch exactly as it would to the real server — it doesn't notice AgentWatch is there. See AgentWatch catch a leak without wiring up a real agent. demo server.py is a mock MCP server with a fetch tool and an upload tool, and run demo.py drives it: it fetches text, then passes that text straight into an outbound call — the exact flow AgentWatch flags. Start the dashboard, open http://localhost:8787 http://localhost:8787 , then run the demo: agentwatch dashboard python run demo.py The verdict banner flips red and the upload call is flagged with a plain-English explanation. Everything is local and synthetic — no network, no credentials. php MCP client <--stdio-- agentwatch <--stdio-- real MCP server | v agentwatch.db ──▶ live dashboard AgentWatch spawns the real server as a subprocess and relays raw bytes between the client and server. For every JSON-RPC message it parses a copy and records it — the forwarded bytes are never re-serialised, so the traffic is byte-for-byte identical to a direct connection. The leak detection works by taint tracking : when a result comes back from an untrusted source a web fetch , AgentWatch remembers that data. When a later outbound call an upload, a POST, a message send contains that same data in its arguments, the flow is flagged as a risk. Outbound calls carrying unrelated data are left alone — so it flags real leaks, not every network call. The dashboard shows, live: - A verdict banner — green when safe, red the moment a risky flow is detected. - Summary stats — total events, tool calls, files touched, and data leaks. - Every tool call, with a risk indicator safe / write / leak and a plain-English explanation on risky rows. - Search and filters all / risky only / writes only , with protocol handshake noise collapsed by default. Everything is stored in a local SQLite file agentwatch.db . A sessions table one row per run and a messages table one row per JSON-RPC message, with timestamp, direction, method, tool name, arguments, result, and the exact raw line . Inspect it with any SQLite tool. pip install -e ". dev " pytest Windows: launching .cmd shims like npx by bare name may fail — use cmd /c npx ... or point at the underlying executable.- Fully local. No data leaves your machine; AgentWatch makes no network calls of its own. Being upfront about what v0.1 can and can't do: Detection is matching-based. AgentWatch flags an outbound call when it carries data that arrived from an untrusted source. If the model transforms that data first — base64-encodes it, summarizes it, rewords it — the match fails and the flow goes undetected. This is the known gap; smarter detection is on the roadmap. Observe-only. Risky flows are flagged, not blocked. Enforcement mode is the next milestone. stdio transport only. HTTP/SSE MCP servers aren't supported yet. Classification is heuristic. Which tools count as untrusted sources and outbound sinks is currently built-in, not configurable — expect false negatives on unusual tool setups. Enforcement mode — block risky flows, not just detect them the firewall .- Configurable taint sources and sinks. - Support for more MCP transports beyond stdio. MIT