OctoWatch DLP

OctoWatch DLP MCP Server

PyPI package: octowatch-mcp · product: octowatchdlp.com (not related to other products named “OctoWatch”).

Read-only Model Context Protocol (MCP) server for OctoWatch DLP Cloud employee monitoring and data-loss prevention — ask Cursor, Claude, or VS Code about risks, idle time, productivity, and monitoring in plain language.

• Product: octowatchdlp.com
• Product docs: octowatchdlp.com/docs/
• Web Console: app.octowatchdlp.com
• In-app API catalog: app.octowatchdlp.com/api/

Python MCP SDK v2 (MCPServer). Built for SecOps and managers — open-source companion to the OctoWatch console.

Contents: Status · Where to find us · Prerequisites · Example questions · Security · Limitations · Quick start · Your account · Tools · Configuration · Documentation · Contributing

Status

Alpha (v0.5.1). APIs and tool shapes may change; pin a PyPI version in production configs.

Tool failures return MCP is_error (ToolError). All tools advertise read_only_hint.

Where to find us

The MCP runs locally (no ExtrLabs-hosted MCP). Catalogs point at PyPI / GitHub; you supply Cloud login via env.

Channel	Link
PyPI	octowatch-mcp
Official MCP Registry	io.github.extralabs/octowatch-mcp
GitHub	extralabs/octowatch-mcp-server
Cursor Marketplace	Plugin manifest .cursor-plugin — publish form (manual review)
Directories	Glama · mcpservers.org · mcpfind.org · mcpmarket.com · PulseMCP · awesome-mcp-servers#13003 (mcp.so skipped — paid)
cursor.directory	Open Plugins: root .mcp.json + .cursor-plugin/plugin.json — re-submit after these are on main

Directory / Marketplace maintainer notes: docs/distribution.md.

Prerequisites

• Python 3.10+
• An MCP-capable host (Cursor, Claude Desktop, VS Code, …)
• Network access to your Cloud API host (default https://cloud.octowatchdlp.com)

Example questions

• “Which Risks in the last day?”
• “Who was idle the longest yesterday?”
• “Productivity summary for Accounting”
• “Show Monitoring keystrokes for Emily”
• “Find keyword invoice across monitoring last week”
• “List users and groups”

Short scenarios

Goal	Ask something like…
DLP / policy hits	“Summarize risks for today by user and rule”
Idle time (not formal alerts)	“Who was idle more than 2 hours yesterday?”
Top apps/sites	“Top applications for group Accounting last 7 days”
Keyword hunt	“Search monitoring for confidential last 30 days”
Directory	“List users and groups, then show info for AliasID 4”

Security & privacy

Defaults use the public demo account.
Do not put production passwords in MCP config or git. Use env vars and a least-privilege console operator.
No writes, no screenshot/video binary downloads.

Monitoring responses can contain sensitive employee data (activity, keystrokes snippets, mail metadata). Treat tool output as confidential. Full policy: SECURITY.md.

Limitations

• Read-only — not a full console replacement (Web Console)
• No screenshot/video binary downloads (stream metadata only)
• Not a mirror of product docs or the REST catalog — those stay at docs and /api/
• Alpha — expect breaking changes between minors until 1.0

Quick start (PyPI)

Use the Install badges at the top of this README (Cursor / VS Code; demo credentials). First ensure the CLI is available:

pip install octowatch-mcp

Or configure manually — example for Cursor / Claude-style mcpServers (demo credentials):

{
  "mcpServers": {
    "octowatch": {
      "command": "octowatch-mcp",
      "env": {
        "OCTOWATCH_API_BASE": "https://cloud.octowatchdlp.com",
        "OCTOWATCH_EMAIL": "demo@octowatchdlp.com",
        "OCTOWATCH_PASSWORD": "demo"
      }
    }
  }
}

Ready-made files: examples/cursor-mcp-pypi.json, examples/claude-desktop-pypi.json. Per-host steps: docs/hosts.md.

Restart the host, then try: “Using OctoWatch, who am I logged in as?” or “List risks for the last week.”

Demo credentials work without a .env. Be gentle with the shared demo tenant (avoid aggressive agent loops).

From source

git clone https://github.com/extralabs/octowatch-mcp-server.git
cd octowatch-mcp-server
python -m venv .venv
# Windows: .venv\Scripts\activate
# macOS/Linux: source .venv/bin/activate
pip install -e .
cp .env.example .env   # optional
python -m octowatch_mcp

Use examples/cursor-mcp.json / examples/claude-desktop.json and set cwd to your clone (Windows: D:\\path\\to\\octowatch-mcp-server).

ChatGPT and other hosts

There is no single public ChatGPT JSON config we ship yet — ChatGPT / similar products often use remote MCP connectors rather than a local command stdio process.

• For local desktop agents, prefer Cursor, Claude Desktop, or VS Code with the examples above.
• If your host supports custom MCP over HTTP, you can run octowatch-mcp --transport streamable-http (localhost only by default) and register that endpoint per the host’s docs — see docs/hosts.md.

Your account (email / password)

OctoWatch Cloud still needs a console login. The MCP does not store passwords for you — the host passes them as process env.

Mode	What to set
Demo (try-out)	Defaults / Install badges: demo@octowatchdlp.com / demo
Your tenant	Your least-privilege operator email + password in MCP env (or Cursor plugin Configure)

Variable	Meaning
OCTOWATCH_EMAIL	Console operator email
OCTOWATCH_PASSWORD	Console password (isSecret in Registry metadata)
OCTOWATCH_API_BASE	Cloud API host if not the default public cloud

Recommended: put them in the MCP host JSON env block — examples/cursor-mcp-pypi-with-env.json / examples/claude-desktop-pypi-with-env.json. Cursor plugin variables: .cursor-plugin/plugin.json.

Alternatively, for a source install, copy .env.example → .env next to the process working directory.

Never commit real passwords. Verify the same data in the Web Console. Walkthrough: docs/hosts.md.

Core tools

Tool	Cloud area	Notes
octowatch_whoami	Auth session	Account / host (no password)
list_users_groups	Directory tree	Type 0 root, 1 group, 2 user
list_risks	Risks + Analytics	Default mode=summary
list_anomalies	Alerts	Formal deviations (not idle)
get_idle_summary	Productivity	Rank by InactiveTime
get_activity_summary	Activity	Top apps/sites
get_timesheet	TimeSheet	Worked vs expected hours
get_productivity_summary	Productivity + analytics	Per-user rollup
list_reports	Reports	Scheduled + processing tasks

Console coverage tools

Tool	Cloud area	Notes
get_analytics	Analytics	view=overall|disciplina|activity|productivity
get_dashboard	Dashboard	Widgets; blobs stripped
get_chrono	Chrono	Timeline
get_day_structure	Day structure	list or detail
list_monitoring	Monitoring	One kind; compact by default
search_monitoring	Tools → Search	filter_key across kinds
get_activity_detail	Activity window	Drill-down
list_online	Live	Presence only
list_stream_meta	Stream	Metadata only
list_directory	Edit Get*	users/groups/computers/…
get_user_info	User card	AliasID / computer
get_account_readonly	Account Get*	No Set*/PIN
list_api_coverage	(static)	Gap summary

Full arguments, routing, and scenarios: docs/TOOLS.md.
MCP prompts/resources: docs/MCP.md.

Configuration

Env	Default	Meaning
OCTOWATCH_API_BASE	https://cloud.octowatchdlp.com	API host (serverBase)
OCTOWATCH_EMAIL	demo@octowatchdlp.com	Console operator
OCTOWATCH_PASSWORD	demo	Demo only by default
OCTOWATCH_DEFAULT_DAYS	1	Lookback when tools omit dates/period
OCTOWATCH_TOOLSETS	all	all | core | console (console includes core)

octowatch-mcp                                      # stdio (default)
octowatch-mcp --transport streamable-http          # http://127.0.0.1:8000/mcp

Periods & filters

Prefer period=today|yesterday|last_7_days|last_30_days, or date_from / date_to.

• Date-only values cover the full calendar day (date_to → 23:59:59).
• Optional user_id (AliasID) and group_id on most read tools.
• POST body TreeviewUsers: all → NodeType=-666666; group → NodeType=14; user → NodeType=1.

Documentation

Doc	Contents
docs/README.md	Doc index
docs/hosts.md	Install per host + your login
docs/TOOLS.md	Tool reference + when-which
docs/MCP.md	Protocol, resources, prompts
docs/API.md	MCP coverage audit (not a full REST mirror)
docs/troubleshooting.md	Common failures
docs/registry.md	Official MCP Registry (server.json)
docs/distribution.md	Directories, Marketplace, deferred hosted channels

Product & console

• octowatchdlp.com
• octowatchdlp.com/docs/
• app.octowatchdlp.com
• app.octowatchdlp.com/api/

Roadmap

Planned (not scheduled): tighter payload budgets, client-side rate limits, argument completions, server icon, optional MCP Apps UI, tool-routing evals. Registry metadata: docs/registry.md. Protocol surface: docs/MCP.md.

Contributing

See CONTRIBUTING.md. Changelog: CHANGELOG.md. Issues: GitHub Issues.

License

MIT — see LICENSE.