aIWatch

AIWatch is a local agent-security trust layer for teams building and testing MCP-based AI agents. Modern agents can read files, call tools, hit APIs, and trigger actions, but developers often lack a clear way to see which tools were called, what changed, whether a tool behaved suspiciously, or where to enforce policy before damage happens. AIWatch creates that control point at the routed MCP tool layer. AIWatch sits between the agent and the MCP server through a local stdio wrapper or HTTP relay. As MCP traffic passes through, AIWatch captures tool definitions and tool calls, normalizes them into structured events, fingerprints tools, detects risky behavior, and stores everything in a local SQLite audit trail. This gives developers a replayable record of agent/tool activity instead of relying on scattered terminal logs or opaque agent behavior. AIWatch also detects several concrete MCP-layer risks some of which include poisoned tool descriptions, tool fingerprint drift, tool-name shadowing, and credential-shaped tool-call parameters. It also supports opt-in enforcement mode, where selected high-risk routed MCP calls can be denied before they are forwarded upstream. Operators can manually quarantine suspicious tools by name or fingerprint, then block future routed calls to those tools when deny mode is enabled. AIWatch also connects MCP-layer activity with prompt/response security signals. By ingesting Lobster Trap JSONL audit records locally, AIWatch can place prompt-layer policy decisions and MCP tool-layer activity into one Unified Audit timeline. This lets a developer see not just that a prompt was risky, and not just that a tool was called, but how those events relate in the same session. Thus acting as a local prototype for agent observability, MCP tool-risk detection, opt-in tool-call enforcement, prompt-layer correlation, and regulator-readable audit evidence. Currently however It only observes and enforces traffic routed through its wrapper or relay.