OctoWatch DLP

io.github.extralabsPublished by GitHub account extralabsv0.5.1Updated Oct 24, 2026

Read-only OctoWatch DLP Cloud MCP: risks, idle time, productivity, monitoring.

VerifiedSTDIODesktop onlyProductivity & WorkflowSecurity & MonitoringData & Analytics

Overview

AI-generated overview

Read-only access to OctoWatch DLP Cloud for risks, idle time, productivity, activity, and monitoring data.

What you can do
Connects an assistant to an OctoWatch DLP Cloud tenant and exposes read-only tools for employee monitoring and data-loss-prevention data. Core tools cover account identity, users and groups, risks, anomalies, idle summaries, activity summaries, timesheets, productivity rollups, and reports. Console coverage tools add analytics views, dashboards, chrono timelines, day structure, monitoring listings, keyword search across monitoring kinds, activity drill-down, online presence, stream metadata, directory listings, user cards, and read-only account info. All tools advertise a read-only hint and return errors through the MCP error channel.
When to use it
Useful for SecOps staff and managers who want to ask about DLP risks, idle time, productivity, top applications and sites, or keyword hits in monitoring data in plain language instead of opening the web console. It is a read-only companion, not a replacement for the console, and it does not download screenshot or video binaries.
Requirements
Runs locally as a Python package (octowatch-mcp, Python 3.10+) launched by an MCP-capable host such as Cursor, Claude Desktop, or VS Code. Needs network access to the Cloud API host, defaulting to the public cloud. Console credentials are supplied by the host through the environment variables OCTOWATCH_EMAIL and OCTOWATCH_PASSWORD; OCTOWATCH_API_BASE and OCTOWATCH_TOOLSETS are optional. Demo credentials work for a try-out.
Before you install
The server asks for a console password through OCTOWATCH_PASSWORD; keep it out of MCP config files and version control and use a least-privilege operator account for real tenants. Monitoring output can contain sensitive employee data such as activity, keystroke snippets, and mail metadata, so treat tool output as confidential. The project is alpha, so APIs and tool shapes may change between minor versions; pin a version in production. The shared demo tenant should not be hammered with…

Installation

In SourceWeft

  1. Open OctoWatch DLP in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

OctoWatch DLP MCP Server

PyPI package: octowatch-mcp · product: octowatchdlp.com (not related to other products named “OctoWatch”).

[PyPI] [Python] [CI] [MCP] [License: MIT]

[Install in Cursor] [Install in VS Code] [Install in VS Code Insiders]

Read-only Model Context Protocol (MCP) server for OctoWatch DLP Cloud employee monitoring and data-loss prevention — ask Cursor, Claude, or VS Code about risks, idle time, productivity, and monitoring in plain language.

Python MCP SDK v2 (MCPServer). Built for SecOps and managers — open-source companion to the OctoWatch console.

Contents: Status · Where to find us · Prerequisites · Example questions · Security · Limitations · Quick start · Your account · Tools · Configuration · Documentation · Contributing

Status

Alpha (v0.5.1). APIs and tool shapes may change; pin a PyPI version in production configs.

Tool failures return MCP is_error (ToolError). All tools advertise read_only_hint.

Where to find us

The MCP runs locally (no ExtrLabs-hosted MCP). Catalogs point at PyPI / GitHub; you supply Cloud login via env.

ChannelLink
PyPIoctowatch-mcp
Official MCP Registryio.github.extralabs/octowatch-mcp
GitHubextralabs/octowatch-mcp-server
Cursor MarketplacePlugin manifest .cursor-plugin — publish form (manual review)
DirectoriesGlama · mcpservers.org · mcpfind.org · mcpmarket.com · PulseMCP · awesome-mcp-servers#13003 (mcp.so skipped — paid)
cursor.directoryOpen Plugins: root .mcp.json + .cursor-plugin/plugin.json — re-submit after these are on main

Directory / Marketplace maintainer notes: docs/distribution.md.

Prerequisites

  • Python 3.10+
  • An MCP-capable host (Cursor, Claude Desktop, VS Code, …)
  • Network access to your Cloud API host (default https://cloud.octowatchdlp.com)

Example questions

  • “Which Risks in the last day?”
  • “Who was idle the longest yesterday?”
  • “Productivity summary for Accounting”
  • “Show Monitoring keystrokes for Emily”
  • “Find keyword invoice across monitoring last week”
  • “List users and groups”

Short scenarios

GoalAsk something like…
DLP / policy hits“Summarize risks for today by user and rule”
Idle time (not formal alerts)“Who was idle more than 2 hours yesterday?”
Top apps/sites“Top applications for group Accounting last 7 days”
Keyword hunt“Search monitoring for confidential last 30 days”
Directory“List users and groups, then show info for AliasID 4”

Security & privacy

Defaults use the public demo account.
Do not put production passwords in MCP config or git. Use env vars and a least-privilege console operator.
No writes, no screenshot/video binary downloads.

Monitoring responses can contain sensitive employee data (activity, keystrokes snippets, mail metadata). Treat tool output as confidential. Full policy: SECURITY.md.

Limitations

  • Read-only — not a full console replacement (Web Console)
  • No screenshot/video binary downloads (stream metadata only)
  • Not a mirror of product docs or the REST catalog — those stay at docs and /api/
  • Alpha — expect breaking changes between minors until 1.0

Quick start (PyPI)

Use the Install badges at the top of this README (Cursor / VS Code; demo credentials). First ensure the CLI is available:

bash
pip install octowatch-mcp

Or configure manually — example for Cursor / Claude-style mcpServers (demo credentials):

json
{  "mcpServers": {    "octowatch": {      "command": "octowatch-mcp",      "env": {        "OCTOWATCH_API_BASE": "https://cloud.octowatchdlp.com",        "OCTOWATCH_EMAIL": "[email protected]",        "OCTOWATCH_PASSWORD": "demo"      }    }  }}

Ready-made files: examples/cursor-mcp-pypi.json, examples/claude-desktop-pypi.json. Per-host steps: docs/hosts.md.

Restart the host, then try: “Using OctoWatch, who am I logged in as?” or “List risks for the last week.”

Demo credentials work without a .env. Be gentle with the shared demo tenant (avoid aggressive agent loops).

From source

bash
git clone https://github.com/extralabs/octowatch-mcp-server.gitcd octowatch-mcp-serverpython -m venv .venv# Windows: .venv\Scripts\activate# macOS/Linux: source .venv/bin/activatepip install -e .cp .env.example .env   # optionalpython -m octowatch_mcp

Use examples/cursor-mcp.json / examples/claude-desktop.json and set cwd to your clone (Windows: D:\\path\\to\\octowatch-mcp-server).

ChatGPT and other hosts

There is no single public ChatGPT JSON config we ship yet — ChatGPT / similar products often use remote MCP connectors rather than a local command stdio process.

  • For local desktop agents, prefer Cursor, Claude Desktop, or VS Code with the examples above.
  • If your host supports custom MCP over HTTP, you can run octowatch-mcp --transport streamable-http (localhost only by default) and register that endpoint per the host’s docs — see docs/hosts.md.

Your account (email / password)

OctoWatch Cloud still needs a console login. The MCP does not store passwords for you — the host passes them as process env.

ModeWhat to set
Demo (try-out)Defaults / Install badges: [email protected] / demo
Your tenantYour least-privilege operator email + password in MCP env (or Cursor plugin Configure)
VariableMeaning
OCTOWATCH_EMAILConsole operator email
OCTOWATCH_PASSWORDConsole password (isSecret in Registry metadata)
OCTOWATCH_API_BASECloud API host if not the default public cloud

Recommended: put them in the MCP host JSON env block — examples/cursor-mcp-pypi-with-env.json / examples/claude-desktop-pypi-with-env.json. Cursor plugin variables: .cursor-plugin/plugin.json.

Alternatively, for a source install, copy .env.example → .env next to the process working directory.

Never commit real passwords. Verify the same data in the Web Console. Walkthrough: docs/hosts.md.

Core tools

ToolCloud areaNotes
octowatch_whoamiAuth sessionAccount / host (no password)
list_users_groupsDirectory treeType 0 root, 1 group, 2 user
list_risksRisks + AnalyticsDefault mode=summary
list_anomaliesAlertsFormal deviations (not idle)
get_idle_summaryProductivityRank by InactiveTime
get_activity_summaryActivityTop apps/sites
get_timesheetTimeSheetWorked vs expected hours
get_productivity_summaryProductivity + analyticsPer-user rollup
list_reportsReportsScheduled + processing tasks

Console coverage tools

ToolCloud areaNotes
get_analyticsAnalyticsview=overall|disciplina|activity|productivity
get_dashboardDashboardWidgets; blobs stripped
get_chronoChronoTimeline
get_day_structureDay structurelist or detail
list_monitoringMonitoringOne kind; compact by default
search_monitoringTools → Searchfilter_key across kinds
get_activity_detailActivity windowDrill-down
list_onlineLivePresence only
list_stream_metaStreamMetadata only
list_directoryEdit Get*users/groups/computers/…
get_user_infoUser cardAliasID / computer
get_account_readonlyAccount Get*No Set*/PIN
list_api_coverage(static)Gap summary

Full arguments, routing, and scenarios: docs/TOOLS.md.
MCP prompts/resources: docs/MCP.md.

Configuration

EnvDefaultMeaning
OCTOWATCH_API_BASEhttps://cloud.octowatchdlp.comAPI host (serverBase)
OCTOWATCH_EMAIL[email protected]Console operator
OCTOWATCH_PASSWORDdemoDemo only by default
OCTOWATCH_DEFAULT_DAYS1Lookback when tools omit dates/period
OCTOWATCH_TOOLSETSallall | core | console (console includes core)
bash
octowatch-mcp                                      # stdio (default)octowatch-mcp --transport streamable-http          # http://127.0.0.1:8000/mcp

Periods & filters

Prefer period=today|yesterday|last_7_days|last_30_days, or date_from / date_to.

  • Date-only values cover the full calendar day (date_to → 23:59:59).
  • Optional user_id (AliasID) and group_id on most read tools.
  • POST body TreeviewUsers: all → NodeType=-666666; group → NodeType=14; user → NodeType=1.

Documentation

DocContents
docs/README.mdDoc index
docs/hosts.mdInstall per host + your login
docs/TOOLS.mdTool reference + when-which
docs/MCP.mdProtocol, resources, prompts
docs/API.mdMCP coverage audit (not a full REST mirror)
docs/troubleshooting.mdCommon failures
docs/registry.mdOfficial MCP Registry (server.json)
docs/distribution.mdDirectories, Marketplace, deferred hosted channels

Product & console

Roadmap

Planned (not scheduled): tighter payload budgets, client-side rate limits, argument completions, server icon, optional MCP Apps UI, tool-routing evals. Registry metadata: docs/registry.md. Protocol surface: docs/MCP.md.

Contributing

See CONTRIBUTING.md. Changelog: CHANGELOG.md. Issues: GitHub Issues.

License

MIT — see LICENSE.

Source: README.md at commit 7889fba

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v0.5.1LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts