What is agentwatch?

{"i":0,"repo":"dhanraj176/agentwatch","stars":1,"lang":"Python","ok":true,"char_count":2034,"text":"AI agents like Claude Code and Cursor can read files, fetch web pages, and call tools using your real credentials. The problem is that an agent trusts whatever it reads. A poisoned web page or document can quietly instruct it to send your data somewhere it should not go, and normally nobody can see that happening. AgentWatch is a local tool that sits between your agent and its servers, shows every tool call on a live dashboard, and flags when untrusted data flows out to an external destination.\n\nThe tool watches every tool call your agent makes and displays it live in your browser. It detects data leaks by tracking data from where it is read, such as a web page, to where it goes, like an outbound upload. When untrusted content leaves your machine, AgentWatch flags the flow and explains the risk in a plain sentence anyone can read. It never modifies your traffic, so it cannot corrupt your agent's communication.\n\nInstallation involves cloning the repository and running a pip install command. You then wrap your existing server launch command with \"agentwatch run --\" and everything after the dashes runs unchanged. A dashboard command opens a local web page at port 8787 where you can watch your agent's activity stream in real time. There is also a 60-second demo that shows the tool catching a synthetic leak without needing a real agent setup.\n\nThe dashboard shows a verdict banner that turns green when things are safe and red the moment a risky flow is detected. It displays summary stats like total events, tool calls, files touched, and data leaks. Every tool call gets a risk indicator and a plain-English explanation on risky rows. All data is stored in a local SQLite file you can inspect with any standard tool, and AgentWatch itself makes no network calls.\n\nThe tool has some limitations worth knowing. Its detection is matching-based, meaning if the AI model transforms data before sending it, the match can fail and the leak goes undetected. It only observes and flags risky flows rather than blocking them. It supports only the stdio transport method, and its classification of which tools count as untrusted sources or outbound destinations is built-in rather than configurable. Future plans include an enforcement mode that blocks risky flows and support for more transport types."}