{
  "markdown": "# OctoWatch DLP MCP Server\n\nPyPI package: [`octowatch-mcp`](https://pypi.org/project/octowatch-mcp/) · product: [octowatchdlp.com](https://octowatchdlp.com/) (not related to other products named “OctoWatch”).\n\n[![PyPI](https://img.shields.io/pypi/v/octowatch-mcp.svg)](https://pypi.org/project/octowatch-mcp/)\n[![Python](https://img.shields.io/pypi/pyversions/octowatch-mcp.svg)](https://pypi.org/project/octowatch-mcp/)\n[![CI](https://github.com/extralabs/octowatch-mcp-server/actions/workflows/ci.yml/badge.svg)](https://github.com/extralabs/octowatch-mcp-server/actions/workflows/ci.yml)\n[![MCP](https://img.shields.io/badge/MCP-server-6001D2)](https://modelcontextprotocol.io/)\n[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)\n\n[![Install in Cursor](https://img.shields.io/badge/Cursor-Install_Server-000000?style=flat-square&logo=cursor&logoColor=white)](cursor://anysphere.cursor-deeplink/mcp/install?name=octowatch&config=eyJjb21tYW5kIjoib2N0b3dhdGNoLW1jcCIsImVudiI6eyJPQ1RPV0FUQ0hfQVBJX0JBU0UiOiJodHRwczovL2Nsb3VkLm9jdG93YXRjaGRscC5jb20iLCJPQ1RPV0FUQ0hfRU1BSUwiOiJkZW1vQG9jdG93YXRjaGRscC5jb20iLCJPQ1RPV0FUQ0hfUEFTU1dPUkQiOiJkZW1vIn19)\n[![Install in VS Code](https://img.shields.io/badge/VS_Code-Install_Server-0098FF?style=flat-square&logo=visualstudiocode&logoColor=white)](https://insiders.vscode.dev/redirect/mcp/install?name=octowatch&config=%7B%22command%22%3A%22octowatch-mcp%22%2C%22env%22%3A%7B%22OCTOWATCH_API_BASE%22%3A%22https%3A%2F%2Fcloud.octowatchdlp.com%22%2C%22OCTOWATCH_EMAIL%22%3A%22demo%40octowatchdlp.com%22%2C%22OCTOWATCH_PASSWORD%22%3A%22demo%22%7D%7D)\n[![Install in VS Code Insiders](https://img.shields.io/badge/VS_Code_Insiders-Install_Server-24bfa5?style=flat-square&logo=visualstudiocode&logoColor=white)](https://insiders.vscode.dev/redirect/mcp/install?name=octowatch&config=%7B%22command%22%3A%22octowatch-mcp%22%2C%22env%22%3A%7B%22OCTOWATCH_API_BASE%22%3A%22https%3A%2F%2Fcloud.octowatchdlp.com%22%2C%22OCTOWATCH_EMAIL%22%3A%22demo%40octowatchdlp.com%22%2C%22OCTOWATCH_PASSWORD%22%3A%22demo%22%7D%7D&quality=insiders)\n\nRead-only [Model Context Protocol (MCP)](https://modelcontextprotocol.io/) server for **[OctoWatch DLP Cloud](https://octowatchdlp.com/)** employee monitoring and data-loss prevention — ask Cursor, Claude, or VS Code about risks, idle time, productivity, and monitoring in plain language.\n\n<!-- mcp-name: io.github.extralabs/octowatch-mcp -->\n\n- Product: [octowatchdlp.com](https://octowatchdlp.com/)\n- Product docs: [octowatchdlp.com/docs/](https://octowatchdlp.com/docs/)\n- Web Console: [app.octowatchdlp.com](https://app.octowatchdlp.com/)\n- In-app API catalog: [app.octowatchdlp.com/api/](https://app.octowatchdlp.com/api/)\n\nPython MCP SDK **v2** (`MCPServer`). Built for SecOps and managers — open-source companion to the OctoWatch console.\n\n**Contents:** [Status](#status) · [Where to find us](#where-to-find-us) · [Prerequisites](#prerequisites) · [Example questions](#example-questions) · [Security](#security--privacy) · [Limitations](#limitations) · [Quick start](#quick-start-pypi) · [Your account](#your-account-email--password) · [Tools](#core-tools) · [Configuration](#configuration) · [Documentation](#documentation) · [Contributing](#contributing)\n\n## Status\n\n**Alpha** (`v0.5.1`). APIs and tool shapes may change; pin a PyPI version in production configs.\n\nTool failures return MCP `is_error` (`ToolError`). All tools advertise `read_only_hint`.\n\n## Where to find us\n\nThe MCP runs **locally** (no ExtrLabs-hosted MCP). Catalogs point at PyPI / GitHub; you supply Cloud login via env.\n\n| Channel | Link |\n|---------|------|\n| PyPI | [octowatch-mcp](https://pypi.org/project/octowatch-mcp/) |\n| Official MCP Registry | [`io.github.extralabs/octowatch-mcp`](https://registry.modelcontextprotocol.io/v0.1/servers?search=io.github.extralabs/octowatch-mcp) |\n| GitHub | [extralabs/octowatch-mcp-server](https://github.com/extralabs/octowatch-mcp-server) |\n| Cursor Marketplace | Plugin manifest [`.cursor-plugin`](.cursor-plugin/plugin.json) — [publish form](https://cursor.com/marketplace/publish) (manual review) |\n| Directories | [Glama](https://glama.ai/) · [mcpservers.org](https://mcpservers.org/) · [mcpfind.org](https://mcpfind.org/) · [mcpmarket.com](https://mcpmarket.com/) · [PulseMCP](https://www.pulsemcp.com/) · [awesome-mcp-servers#13003](https://github.com/punkpeye/awesome-mcp-servers/pull/13003) (mcp.so skipped — paid) |\n| cursor.directory | Open Plugins: root [`.mcp.json`](.mcp.json) + [`.cursor-plugin/plugin.json`](.cursor-plugin/plugin.json) — re-submit after these are on `main` |\n\nDirectory / Marketplace maintainer notes: [docs/distribution.md](docs/distribution.md).\n\n## Prerequisites\n\n- Python **3.10+**\n- An MCP-capable host (Cursor, Claude Desktop, VS Code, …)\n- Network access to your Cloud API host (default `https://cloud.octowatchdlp.com`)\n\n## Example questions\n\n- “Which **Risks** in the last day?”\n- “Who was idle the longest yesterday?”\n- “Productivity summary for Accounting”\n- “Show Monitoring keystrokes for Emily”\n- “Find keyword `invoice` across monitoring last week”\n- “List users and groups”\n\n### Short scenarios\n\n| Goal | Ask something like… |\n|------|---------------------|\n| DLP / policy hits | “Summarize risks for today by user and rule” |\n| Idle time (not formal alerts) | “Who was idle more than 2 hours yesterday?” |\n| Top apps/sites | “Top applications for group Accounting last 7 days” |\n| Keyword hunt | “Search monitoring for `confidential` last 30 days” |\n| Directory | “List users and groups, then show info for AliasID 4” |\n\n## Security & privacy\n\n> Defaults use the public **demo** account.  \n> **Do not put production passwords in MCP config or git.** Use env vars and a least-privilege console operator.  \n> No writes, no screenshot/video binary downloads.\n\nMonitoring responses can contain sensitive employee data (activity, keystrokes snippets, mail metadata). Treat tool output as confidential. Full policy: [SECURITY.md](SECURITY.md).\n\n## Limitations\n\n- **Read-only** — not a full console replacement ([Web Console](https://app.octowatchdlp.com/))\n- No screenshot/video **binary** downloads (stream **metadata** only)\n- Not a mirror of product docs or the REST catalog — those stay at [docs](https://octowatchdlp.com/docs/) and [/api/](https://app.octowatchdlp.com/api/)\n- Alpha — expect breaking changes between minors until 1.0\n\n## Quick start (PyPI)\n\nUse the **Install** badges at the top of this README (Cursor / VS Code; demo credentials). First ensure the CLI is available:\n\n```bash\npip install octowatch-mcp\n```\n\nOr configure manually — example for Cursor / Claude-style `mcpServers` (demo credentials):\n\n```json\n{\n  \"mcpServers\": {\n    \"octowatch\": {\n      \"command\": \"octowatch-mcp\",\n      \"env\": {\n        \"OCTOWATCH_API_BASE\": \"https://cloud.octowatchdlp.com\",\n        \"OCTOWATCH_EMAIL\": \"demo@octowatchdlp.com\",\n        \"OCTOWATCH_PASSWORD\": \"demo\"\n      }\n    }\n  }\n}\n```\n\nReady-made files: [examples/cursor-mcp-pypi.json](examples/cursor-mcp-pypi.json), [examples/claude-desktop-pypi.json](examples/claude-desktop-pypi.json). Per-host steps: [docs/hosts.md](docs/hosts.md).\n\nRestart the host, then try: *“Using OctoWatch, who am I logged in as?”* or *“List risks for the last week.”*\n\nDemo credentials work without a `.env`. Be gentle with the shared demo tenant (avoid aggressive agent loops).\n\n### From source\n\n```bash\ngit clone https://github.com/extralabs/octowatch-mcp-server.git\ncd octowatch-mcp-server\npython -m venv .venv\n# Windows: .venv\\Scripts\\activate\n# macOS/Linux: source .venv/bin/activate\npip install -e .\ncp .env.example .env   # optional\npython -m octowatch_mcp\n```\n\nUse [examples/cursor-mcp.json](examples/cursor-mcp.json) / [examples/claude-desktop.json](examples/claude-desktop.json) and set `cwd` to your clone (Windows: `D:\\\\path\\\\to\\\\octowatch-mcp-server`).\n\n### ChatGPT and other hosts\n\nThere is **no** single public ChatGPT JSON config we ship yet — ChatGPT / similar products often use **remote** MCP connectors rather than a local `command` stdio process.\n\n- For local desktop agents, prefer **Cursor**, **Claude Desktop**, or **VS Code** with the examples above.\n- If your host supports custom MCP over HTTP, you can run `octowatch-mcp --transport streamable-http` (localhost only by default) and register that endpoint per the host’s docs — see [docs/hosts.md](docs/hosts.md#chatgpt-and-other-hosts).\n\n## Your account (email / password)\n\nOctoWatch Cloud still needs a console login. The MCP does **not** store passwords for you — the host passes them as process env.\n\n| Mode | What to set |\n|------|-------------|\n| **Demo (try-out)** | Defaults / Install badges: `demo@octowatchdlp.com` / `demo` |\n| **Your tenant** | Your least-privilege operator email + password in MCP `env` (or Cursor plugin **Configure**) |\n\n| Variable | Meaning |\n|----------|---------|\n| `OCTOWATCH_EMAIL` | Console operator email |\n| `OCTOWATCH_PASSWORD` | Console password (`isSecret` in Registry metadata) |\n| `OCTOWATCH_API_BASE` | Cloud API host if not the default public cloud |\n\n**Recommended:** put them in the MCP host JSON `env` block — [examples/cursor-mcp-pypi-with-env.json](examples/cursor-mcp-pypi-with-env.json) / [examples/claude-desktop-pypi-with-env.json](examples/claude-desktop-pypi-with-env.json). Cursor plugin variables: [`.cursor-plugin/plugin.json`](.cursor-plugin/plugin.json).\n\nAlternatively, for a source install, copy `.env.example` → `.env` next to the process working directory.\n\nNever commit real passwords. Verify the same data in the [Web Console](https://app.octowatchdlp.com/). Walkthrough: [docs/hosts.md](docs/hosts.md#your-own-login).\n\n## Core tools\n\n| Tool | Cloud area | Notes |\n|------|------------|--------|\n| `octowatch_whoami` | Auth session | Account / host (no password) |\n| `list_users_groups` | Directory tree | Type 0 root, 1 group, 2 user |\n| `list_risks` | Risks + Analytics | Default `mode=summary` |\n| `list_anomalies` | Alerts | Formal deviations (not idle) |\n| `get_idle_summary` | Productivity | Rank by `InactiveTime` |\n| `get_activity_summary` | Activity | Top apps/sites |\n| `get_timesheet` | TimeSheet | Worked vs expected hours |\n| `get_productivity_summary` | Productivity + analytics | Per-user rollup |\n| `list_reports` | Reports | Scheduled + processing tasks |\n\n## Console coverage tools\n\n| Tool | Cloud area | Notes |\n|------|------------|--------|\n| `get_analytics` | Analytics | `view=overall\\|disciplina\\|activity\\|productivity` |\n| `get_dashboard` | Dashboard | Widgets; blobs stripped |\n| `get_chrono` | Chrono | Timeline |\n| `get_day_structure` | Day structure | `list` or `detail` |\n| `list_monitoring` | Monitoring | One kind; compact by default |\n| `search_monitoring` | Tools → Search | `filter_key` across kinds |\n| `get_activity_detail` | Activity window | Drill-down |\n| `list_online` | Live | Presence only |\n| `list_stream_meta` | Stream | Metadata only |\n| `list_directory` | Edit Get\\* | users/groups/computers/… |\n| `get_user_info` | User card | AliasID / computer |\n| `get_account_readonly` | Account Get\\* | No Set\\*/PIN |\n| `list_api_coverage` | (static) | Gap summary |\n\nFull arguments, routing, and scenarios: [docs/TOOLS.md](docs/TOOLS.md).  \nMCP prompts/resources: [docs/MCP.md](docs/MCP.md).\n\n## Configuration\n\n| Env | Default | Meaning |\n|-----|---------|---------|\n| `OCTOWATCH_API_BASE` | `https://cloud.octowatchdlp.com` | API host (`serverBase`) |\n| `OCTOWATCH_EMAIL` | `demo@octowatchdlp.com` | Console operator |\n| `OCTOWATCH_PASSWORD` | `demo` | **Demo only** by default |\n| `OCTOWATCH_DEFAULT_DAYS` | `1` | Lookback when tools omit dates/period |\n| `OCTOWATCH_TOOLSETS` | `all` | `all` \\| `core` \\| `console` (console includes core) |\n\n```bash\noctowatch-mcp                                      # stdio (default)\noctowatch-mcp --transport streamable-http          # http://127.0.0.1:8000/mcp\n```\n\n### Periods & filters\n\nPrefer `period=today|yesterday|last_7_days|last_30_days`, or `date_from` / `date_to`.\n\n- Date-only values cover the **full calendar day** (`date_to` → `23:59:59`).\n- Optional `user_id` (AliasID) and `group_id` on most read tools.\n- POST body `TreeviewUsers`: all → `NodeType=-666666`; **group → `NodeType=14`**; **user → `NodeType=1`**.\n\n## Documentation\n\n| Doc | Contents |\n|-----|----------|\n| [docs/README.md](docs/README.md) | Doc index |\n| [docs/hosts.md](docs/hosts.md) | Install per host + your login |\n| [docs/TOOLS.md](docs/TOOLS.md) | Tool reference + when-which |\n| [docs/MCP.md](docs/MCP.md) | Protocol, resources, prompts |\n| [docs/API.md](docs/API.md) | MCP coverage audit (not a full REST mirror) |\n| [docs/troubleshooting.md](docs/troubleshooting.md) | Common failures |\n| [docs/registry.md](docs/registry.md) | Official MCP Registry (`server.json`) |\n| [docs/distribution.md](docs/distribution.md) | Directories, Marketplace, deferred hosted channels |\n\n### Product & console\n\n- [octowatchdlp.com](https://octowatchdlp.com/)\n- [octowatchdlp.com/docs/](https://octowatchdlp.com/docs/)\n- [app.octowatchdlp.com](https://app.octowatchdlp.com/)\n- [app.octowatchdlp.com/api/](https://app.octowatchdlp.com/api/)\n\n## Roadmap\n\nPlanned (not scheduled): tighter payload budgets, client-side rate limits, argument completions, server icon, optional MCP Apps UI, tool-routing evals. Registry metadata: [docs/registry.md](docs/registry.md). Protocol surface: [docs/MCP.md](docs/MCP.md).\n\n## Contributing\n\nSee [CONTRIBUTING.md](CONTRIBUTING.md). Changelog: [CHANGELOG.md](CHANGELOG.md). Issues: [GitHub Issues](https://github.com/extralabs/octowatch-mcp-server/issues).\n\n## License\n\nMIT — see [LICENSE](LICENSE).\n",
  "bytes": 13626,
  "sha": "0522386e9ea31ebe412d24754688b13525d8acd1e6d897dc72c5383127383cd6",
  "repo_slug": "extralabs/octowatch-mcp-server",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_extralabs_octowatch_mcp_a9718298/readme"
}