UTM Watch

io.github.DarrickBMPublished by GitHub account DarrickBMv0.7.1Updated Nov 12, 2026

Read-only history of UTM VMs on a Mac: CPU, memory, disk, network, ping, incidents (macOS only).

The publisher's own server: watch.diy – DIY Store Finder

Overview

AI-generated overview

Read-only MCP server that lets an assistant query recorded history of UTM virtual machines on a Mac to explain slowness and resource use.

What you can do
  • Find incidents and summarize what happened over a time range, VM by VM
  • Inspect a single moment or one metric over time for a VM, the Mac or the network
  • List events such as VM starts and stops, memory pressure, swap, CPU limits and Wi-Fi changes
  • Read the latest sample of every VM, the Mac and the network
  • List the Macs in a fleet and query any of them by name or UUID
When to use it
Useful when someone reports that a VM or a remote connection to it was slow and you want the assistant to look through recorded history instead of guessing. Also handy for checking current VM load, disk fullness and network quality on a Mac running UTM.
Requirements
macOS on an Apple silicon Mac with the UTM Watch app installed; the MCP server binary ships inside the app bundle and runs locally over standard input/output. The app needs macOS permissions for other apps' data, control of UTM and the local network. Fleet queries require a joined hub.
Before you install
Read-only over history, but the app asks for broad permissions, including access to other apps' data and control of UTM, and may need Full Disk Access. Fleet mode uploads a Mac's history to a hub every ten seconds, and cross-network fleet use involves a Tailscale auth key. Access can be disabled in the app's AI diagnosis settings.

Installation

In SourceWeft

  1. Open UTM Watch in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

UTM Watch: a VM monitor for UTM on Mac

See what each of your UTM virtual machines is doing, and find out why one was slow.


[Star this repo]

[macOS 14+]   [Apple silicon]   [MCP server]   [License: MIT]

Install · Features · AI diagnosis · Fleet · Terminal tool · How it works

[UTM Watch detail window with a pinned moment]

Why UTM Watch

UTM shows whether a VM is on or off. Activity Monitor shows two processes with the same name. Neither tells you which VM is eating the CPU, how close you are to running out of memory, or whether the lag your remote user felt came from the VM, the Mac, or the Wi-Fi. UTM Watch does.

QuestionUTMActivity MonitorUTM Watch
Which VM is using the CPU?NoProcess names onlyEvery VM by name
How full is each VM's disk?NoNoYes, read from the disk image
What happened at 3:12 pm?NoNoRecorded history you can scrub
Was it the VM, the Mac or the network?NoNoPing and link quality next to VM load

Features

  • Every VM by name, with CPU, memory, how full its disk is, network and ping, live in the menu bar.

  • A quick look without opening a window: hover the menu bar item for every VM and the Mac at a glance. Click it for the full window.

    [The menu bar item with its hover brief below]

  • Recorded history you can scrub back through, to see exactly what was happening at a past moment.

  • The whole connection path: ping to each VM, to your router and to the internet, plus Wi-Fi or Ethernet link quality, so you can tell a slow VM from a slow network.

  • Fleets: several Macs report to one hub, and one window shows every Mac and its VMs. Free, with no accounts.

  • AI diagnosis through a read-only MCP server: ask an agent such as Claude why a VM was slow, on this Mac or any Mac in the fleet, and it reads the history and tells you.

  • Works with both UTM backends: Apple Virtualization and QEMU, with macOS, Linux and Windows guests.

UTM Watch is an independent project. It is not affiliated with or endorsed by the UTM project.

Install

Requires an Apple silicon Mac. Built and tested on macOS 26; set to run on macOS 14 or later, but older versions are untested.

One command (recommended). Installs the menu bar app into /Applications and the utmwatch terminal tool, then starts the app:

bash
curl -fsSL https://raw.githubusercontent.com/DarrickBM/utm-watch/main/install.sh | bash

The script is short; read it first if you prefer: install.sh.

Or by hand. Download UTMWatch-<version>-macos-arm64.dmg from the latest release, open it, and drag UTM Watch into Applications. The app is not notarized by Apple, so the first time macOS will refuse to open it. Go to System Settings, then Privacy & Security, and click Open Anyway, or run this once:

bash
xattr -dr com.apple.quarantine /Applications/UTMWatch.app

First launch. macOS asks for three permissions: access to data from other apps (UTM's VM files), control of UTM, and the local network (pings to your router and VMs). The app keeps working if you deny one, with less detail.

[!IMPORTANT] After an update, give the permissions again. macOS treats the updated app as new. It asks for control of UTM again, and it may refuse UTM's VM files until you turn Full Disk Access for UTM Watch off and on again in System Settings › Privacy & Security, then quit UTM Watch and open it again. If it keeps refusing, use Reset and ask again… in UTM Watch's Settings › Permissions. Until then VMs show without their names, limits or disk usage.

What is in the box

PartWhat it does
Menu bar app (UTMWatch.app)Live figures in the menu bar, a hover brief, and a detail window with trend tracks and recorded history.
Terminal tool (utmwatch)The same live table in a terminal, or one JSON snapshot for scripts.
MCP server (utmwatch-mcp, inside the app)Read-only tools over the recorded history, for AI agents.

History is stored in ~/Library/Application Support/UTM Watch/history.sqlite.

AI diagnosis with an MCP server

The app bundle contains utmwatch-mcp, a read-only Model Context Protocol server over standard input/output. An agent on this Mac can use it to read the recorded history and work out why a VM was slow. Connect Claude Code with:

bash
claude mcp add utm-watch -- /Applications/UTMWatch.app/Contents/MacOS/utmwatch-mcp

Then ask, for example: "A user says connecting to one of my VMs is sometimes slow. Use utm-watch to find out why."

[Claude answering why the VMs were slow, from UTM Watch's history]

ToolWhat it answers
find_incidentsWhen were VMs slow? Start here when someone reports slowness without a time.
summarizeWhat happened over a time range, VM by VM.
get_momentEverything recorded at one moment.
get_metricsOne metric over time for a VM, the Mac or the network.
list_eventsVM starts and stops, memory pressure and swap, VMs at their CPU limit, Wi-Fi and link changes, sleep and wake.
get_statusThe latest sample: every VM, the Mac and the network now.
list_macsEvery Mac in the fleet (on a Mac that has joined one).

Access can be switched off in the app's Settings under AI diagnosis.

Monitor several Macs as a fleet

[The Fleet window on the hub Mac: every Mac with its VMs]

UTM Watch on one Mac needs nothing below. With several Macs, one of them hosts a hub and the others report to it; the hub Mac can then open Open Fleet from the menu bar item and see every Mac's VMs, and click a Mac for its history. The other Macs only report: they cannot see the fleet.

  1. On the Mac that will host the hub: Settings › Fleet › Host the hub on this Mac, then New pairing code.
  2. On each other Mac: Settings › Fleet, paste the code, Join. A code adds one Mac and works once, for 15 minutes.

A Mac that joins uploads its last 24 hours, then new history every ten seconds. If the hub cannot be reached it keeps recording and fills the gap later. The hub Mac has to stay on and logged in.

Macs on other networks. On the hub Mac, under "Connect Macs on other networks", paste an auth key from your own Tailscale account (reusable, tagged, pre-approved). UTM Watch then carries its own hidden Tailscale node: nothing appears in the menu bar or in System Settings, and a Tailscale you already run is left alone. Pairing codes made after that work from any network.

A hub on a server. The same hub runs on Linux:

sh
docker build -f Hub/Dockerfile -t utm-watch-hub . && docker run -d -p 127.0.0.1:8787:8787 -v hub-data:/data utm-watch-hubdocker exec <container> utmwatch-hub token create --enroll     # a pairing tokenutmwatch fleet enroll --hub http://hub-address:8787 --code <token>

AI diagnosis across the fleet. On a Mac that has joined, the MCP server offers list_macs, and every tool takes an optional mac (a name or UUID). Without mac a tool answers for the Mac it runs on, from its own database, exactly as before; that keeps working when the hub is down.

utmwatch fleet status, leave, view and sim are command-line equivalents and testing aids. The design is in docs/DESIGN-fleet.md.

Terminal tool

utmwatch lists every running virtual machine on this Mac by its UTM name with live CPU, memory and network usage, and tells you how much memory and how many cores are still allocatable.

utmwatch · 2 VM · 4.2 cores · refresh 2s                                 00:34:00
VM          State     Backend             CPU          Memory       ↓ Down         ↑ Up         Total ↓/↑macOS 26    running   Apple     1.1 / 6 cores      8.1 / 8 GB    24.9 KB/s    46.2 KB/s   662 MB / 1.3 GBmacOS 26 B  running   Apple     2.8 / 4 cores      8.1 / 8 GB   121.3 KB/s   128.0 KB/s   7.3 GB / 2.0 GB──────────────────────────────────────────────────────────────────────────────────────────────────────────Headroom  macOS VMs 2/2 (full)  ·  Allocatable 8.7 GB (free now 8.5 GB)  ·  Cores allocated 10/14Host      Memory pressure normal  ·  Swap 3.1 GB / 4.0 GB  ·  Used 39.5 GB of 48.0 GB (23.3 GB outside VMs)
FlagMeaning
--interval 1|2|5Refresh interval in seconds (default 2)
--oncePrint one table and exit (two samples, interval apart)
--jsonWith --once: print the snapshot as JSON (for scripts, Hermes, etc.)
--units mb|mbpsNetwork in MB/s (default) or Mbps
--hide-stoppedStart with stopped VMs hidden
--no-utmSkip the UTM AppleScript query; names come from .utm bundles only
--swap-directionsTreat vmenet in/out the other way round (see Traffic direction)
--log <path>Append collector errors to a file

Keys while running: 1 2 5 change the interval (takes effect immediately), s cycles the sort (name, CPU, memory, network), h hides/shows stopped VMs, u toggles MB/s and Mbps, r re-reads the VM list now, q quits.

How it works

UTM Watch reads each VM's process for CPU and memory, its vmenetN interface for network, and its disk image for disk usage, all read-only and without anything installed in the guest. It matches processes to VMs through the disk image each process holds open, and gets names and states from UTM's AppleScript interface. Only NAT ("Shared") networking is supported in this version; bridged VMs show no network.

docs/HOW-IT-WORKS.md explains what each number means, how VMs are identified, the permissions involved and the implementation details.

Build from source

Requires macOS 26 on Apple silicon and the Swift toolchain from Xcode or the Command Line Tools. The terminal tool and the app have no third-party dependencies and need no root.

bash
swift build -c release.build/release/utmwatch

Self-checks for the pure logic (Command Line Tools ship no XCTest, so this is a plain executable):

bash
swift run selftest

Scripts/make-app.sh builds and signs build/UTMWatch.app (with your Apple Development certificate if you have one, otherwise ad hoc); Scripts/make-release.sh produces the downloadable archives in dist/. Design notes are in docs/DESIGN-menu-bar-app.md.

bash
Scripts/make-app.sh
bash
open build/UTMWatch.app

To connect Claude Code to a build from source:

bash
claude mcp add utm-watch -- "$(pwd)/build/UTMWatch.app/Contents/MacOS/utmwatch-mcp"

Contributing

Bug reports and pull requests are welcome. See CONTRIBUTING.md.

License

MIT. See LICENSE.


Built by DarrickBM


If UTM Watch is useful to you:

[Star this repo]

Source: README.md at commit 4962b56

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v0.7.1LatestNov 12, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

Other Watch integrations