octowatch-mcp

Read-only MCP server for OctoWatch DLP Cloud.

Ask Claude / Cursor / ChatGPT in plain language:

• “Which Risks in the last day?”
• “Who was idle the longest yesterday?”
• “Productivity summary for Accounting”
• “Show Monitoring keystrokes for Emily”
• “List users and groups”

Python MCP SDK v2 (MCPServer). Built for SecOps and managers — and as open-source PR for octowatchdlp.com.

Security: defaults use the public demo account.
Do not put production passwords in MCP config or git. Use env vars and a least-privilege console operator.
No writes, no screenshot/video binary downloads.

Status

Alpha (v0.4.0): read-only coverage of Cloud console APIs (analytics, monitoring lists, dashboard, chrono, directory, account Gets). See docs/API.md gap matrix or tool list_api_coverage.

Core tools

Console coverage tools

Quick start

From PyPI

pip install octowatch-mcp
octowatch-mcp
# or: python -m octowatch_mcp

Demo defaults work without a .env. For Cursor/Claude after install, merge examples/cursor-mcp-pypi.json or examples/claude-desktop-pypi.json (command octowatch-mcp, no repo cwd).

From source

git clone https://github.com/extralabs/octowatch-mcp-server.git
cd octowatch-mcp-server
python -m venv .venv
# Windows:
.venv\Scripts\activate
# macOS/Linux:
# source .venv/bin/activate

pip install -e .
cp .env.example .env   # optional; demo defaults work without it
python -m octowatch_mcp

Merge examples/cursor-mcp.json / examples/claude-desktop.json into MCP settings (fix cwd / use python from the venv). Restart and try: “List OctoWatch risks for the last week.”

Release (maintainers)

CI runs unit tests and live demo smoke on main. Publishing to PyPI uses Trusted Publisher on a version tag:

# version in pyproject.toml must match the tag (e.g. 0.4.0 → v0.4.0)
git tag v0.4.0
git push origin v0.4.0

Configuration

Periods & filters

Prefer period=today|yesterday|last_7_days|last_30_days, or date_from / date_to.

• Date-only values cover the full calendar day (date_to → 23:59:59).
• Optional user_id (AliasID) and group_id on most read tools.
• POST body TreeviewUsers: all → NodeType=-666666; group → NodeType=14; user → NodeType=1.

Auth & period calls (API)

1. GET /api/Access/login-jwt?email=…&password=… → Token, RefreshToken, PublicID
2. Later requests: Authorization: Bearer <Token>
3. Period POSTs need headers DateFrom / DateTo as yyyy-MM-dd HH:mm:ss
4. Body (users/groups filter):

[{ "NodeType": -666666, "UserID": -666666 }]

Marketing / interactive docs: app.octowatchdlp.com/api/.
Help catalog: https://cloud.octowatchdlp.com/Help.
Product docs: octowatchdlp.com/docs/.
Coverage audit: docs/API.md.

Roadmap

• Date-only full-day fix + relative period
• Risks summary + idle helper + compact formatters
• Correct TreeviewUsers NodeType (group=14, user=1)
• Console read-only coverage (Monitoring, Dashboard, Chrono, Account Gets)
• Report generator queue (Edit/QueueReportEmail) as optional write-opt-in
• PyPI publish + GitHub Action smoke against demo
• TypeScript port (optional)

License

MIT — see LICENSE.