{
  "markdown": "# Agent Watch — Project README\n\n**Status:** Two capabilities, two different maturity levels (see below).\n**Frame card:** `frame-card.md` (original MCP-monitoring scope). Grantwatch's own\ndesign/plan live in the parent AI-Workbench repo:\n`docs/superpowers/specs/2026-09-05-grantwatch-oauth-scope-monitoring-design.md`\nand `docs/superpowers/plans/2026-09-05-grantwatch-oauth-scope-monitoring.md`.\n**Sibling project:** `~/AI-Workbench/projects/perimeter-watch/` — Agent Watch reuses\nPerimeter Watch's live Stripe account (GASPERMIT acct) rather than standing up new billing.\n\n## What this is\n\nAgent Watch monitors the agent economy from two directions:\n\n1. **Supply side (original, live in production):** liveness, latency, schema-drift,\n   price-integrity, and auth-posture monitoring for MCP registry endpoints and\n   x402/paid agent services. \"Is this endpoint alive and honest about what it does?\"\n2. **Demand side (Grantwatch, new, not yet customer-facing):** for an SMB's own\n   Google Workspace tenant, which third-party AI agents/apps hold OAuth grants,\n   whether granted scope matches actual usage, and whether any grant looks\n   abandoned or still-active-when-it-shouldn't-be. \"Which AI agents did your\n   employees let in, and are they behaving?\"\n\nBoth are sold to the same buyer profile (SMB/MSP), reuse the same infrastructure\npattern (probe/ingest → baseline → drift diff → alert), and are packaged under\none product, not two.\n\n## Capability 1: MCP/agent-endpoint monitoring (supply side)\n\n**Status:** deployed and registry-listed. No paid tier wired yet.\n\n| Piece | Status | Evidence |\n|---|---|---|\n| `probe_engine.py` — MCP handshake + latency + schema-hash + price-integrity + auth-metadata probe | LIVE | `compute_trust_score()` produces a 0-100/A-F trust score for a monitored endpoint |\n| REST API on Railway | LIVE | `https://agent-watch-api-production.up.railway.app` — `/health`, `/v1/probe`, `/v1/endpoints`, `/v1/alerts`, `/stats` |\n| CLI (`repo/cli/agent-watch.py`) | BUILT | `add/status/list/alert/history/scan` |\n| MCP server (`repo/mcp/aw_mcp_server.py`) | BUILT, registry-listed | `server.json` — `io.github.entradox/agent-watch`, streamable-http remote |\n| `llms.txt` (agent-facing API reference) | LIVE | `repo/llms.txt` |\n| Public status page | LIVE | `/status`, `status.html` |\n| Stripe billing | **NOT YET WIRED** | Frame card targets $9-99/mo metered tiers; no Stripe config exists in this repo yet — this is the actual gap between \"built\" and \"monetized\" for capability 1 |\n\n**Known gap:** the original frame card's `$9-99/mo metered SaaS` billing was never\nactually set up. Capability 1 is a live, working, registry-listed free tool with\nno revenue rail — worth deciding whether to wire billing here or let Grantwatch\nbe the first paid tier under this product.\n\n## Capability 2: Grantwatch — OAuth scope drift monitoring (demand side)\n\n**Status:** engine complete on `feature/grantwatch`, Turing-approved (27/27 tests\npassing), not yet merged, not yet customer-facing.\n\n| Piece | Status |\n|---|---|\n| Tenant authorization gate (`grantwatch/gate.py`) | DONE — mirrors Perimeter Watch's `domains_authorized.txt` pattern |\n| Scope-diff engine (`grantwatch/scope_diff.py`) | DONE — findings only, no score/grade by design |\n| Google Workspace connector (`grantwatch/connectors/google_workspace.py`) | DONE, mocked-tested only — real use requires Google OAuth restricted-scope verification (see below) |\n| Microsoft 365 connector (`grantwatch/connectors/microsoft365.py`) | DONE, built standalone, **not wired into the audit flow** — launch scope is Google Workspace only |\n| Coverage disclosure (`grantwatch/coverage.py`) | DONE — a monitoring gap is always stated, never hidden; no \"cleared\"/GREEN state anywhere in this codebase |\n| Free \"Shadow Agent Audit\" lead magnet (`grantwatch/shadow_audit.py`) | DONE |\n| REST API wiring (`/v1/grantwatch/audit` on the existing `api_server.py`) | DONE |\n| Per-tenant credential pointer storage (`grantwatch/credential_store.py`) | DONE — stores a path pointer, never the raw secret |\n| Binding kill-criteria check (`grantwatch/kill_criteria.py`) | DONE — K1: <5 free-audit-to-paid conversions by day 45; K2: <$200 MRR by day 90 |\n| Stripe billing (3 tiers: Starter $49, Growth $149, MSP $399/mo) | **NOT DONE** — manual Stripe CLI step, requires the operator |\n| Real-tenant end-to-end verification | **NOT DONE** — requires a real Google Workspace admin + service account setup |\n\n### Hard rules (same discipline as Perimeter Watch)\n\n1. **No customer tenant is ever scanned without written authority confirmation.**\n   The scan gate (`tenants_authorized.txt`) is the enforcement point.\n2. **Read-only, always.** Grantwatch never writes to a customer's tenant.\n3. **No graded verdict, ever.** No score, no percentage, no Red/Amber/Green badge —\n   findings only, plus explicit coverage disclosure of what wasn't checked. This\n   was a deliberate architecture decision after an adversarial review found that\n   \"cryptographic proof of correct agent behavior\" overclaims what's actually\n   observable (you can prove a log wasn't tampered with, not that it's complete).\n4. **Kill criteria (K1/K2 above) are binding**, matching Perimeter Watch's pattern.\n\n### Blocking conditions before scanning any real customer tenant (Morgan gate, 2026-09-05)\n\nLogged to `~/.claude/team/gate-log.csv` as `decision=hold` (approved-with-conditions).\nNone of these block further engineering — they block Task 11 (first real tenant scan):\n\n- **Google OAuth restricted-scope verification + CASA Tier 2 security assessment**\n  — `admin.reports.audit.readonly` is a Google Restricted Scope; using it against\n  any tenant beyond an internal dev/test account requires this. Weeks-long,\n  real cost. This is the longest-lead item and the most likely to affect launch\n  timing — start it independent of any code work.\n- **Microsoft Publisher Verification** — recommended before selling the M365 tier\n  (not yet built into the flow anyway).\n- **Pre-consent clickwrap** on the connect flow (Morgan drafted starter language;\n  not yet built as a UI/flow).\n- **\"Limited Use\" clause** in a public Grantwatch privacy policy (doesn't exist yet).\n- **Retention purge jobs implemented in code** — 90-day rolling window on raw\n  audit events, 15-day purge for the free one-time audit, 30-day post-cancellation\n  purge for the app list. Turing-reviewed, not just documented policy.\n- **Signed DPA** with the first paying customer (lightweight template OK for MVP;\n  real counsel required once any tenant has EU/UK employees or at Growth/MSP tier).\n- **PII handling controls** in the connector layer — `actor_email` encrypted at\n  rest/in transit, excluded from logs/observability tools, excluded from any\n  public \"anonymized findings\" marketing content.\n\n## Known gaps (honest, both capabilities)\n\n- Capability 1 has no billing wired despite being live — see above.\n- Grantwatch's Microsoft connector is fully built and tested but not reachable\n  from any user-facing flow — deliberate v1 scoping, not an oversight.\n- Neither capability has been used against a real, paying customer yet.\n",
  "bytes": 7126,
  "sha": "d781bb369f43f57246f2a6631da38d9a56e0906e09905bd6945354358cc00cd6",
  "repo_slug": "entradox/agent-watch",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_entradox_agent_watch_a0d8bfbd/readme"
}