OctoWatch DLP MCP Server

MCP Server for OctoWatch DLP (Cloud or On-Premise)

Documentation

OctoWatch DLP MCP Server

PyPI package: octowatch-mcp · product: octowatchdlp.com (not related to other products named “OctoWatch”).

Read-only Model Context Protocol (MCP) server for OctoWatch DLP Cloud employee monitoring and data-loss prevention — ask Cursor, Claude, or VS Code about risks, idle time, productivity, and monitoring in plain language.

Product: octowatchdlp.com
Product docs: octowatchdlp.com/docs/
Web Console: app.octowatchdlp.com
In-app API catalog: app.octowatchdlp.com/api/

Python MCP SDK v2 (MCPServer). Built for SecOps and managers — open-source companion to the OctoWatch console.

Contents: Status · Where to find us · Prerequisites · Example questions · Security · Limitations · Quick start · Your account · Tools · Configuration · Documentation · Contributing

Status

Alpha (v0.5.1). APIs and tool shapes may change; pin a PyPI version in production configs.

Tool failures return MCP is_error (ToolError). All tools advertise read_only_hint.

Where to find us

The MCP runs locally (no ExtrLabs-hosted MCP). Catalogs point at PyPI / GitHub; you supply Cloud login via env.

Channel	Link
PyPI	octowatch-mcp
Official MCP Registry	`io.github.extralabs/octowatch-mcp`
GitHub	extralabs/octowatch-mcp-server
Cursor Marketplace	Plugin manifest `.cursor-plugin` — publish form (manual review)
Directories	Glama · mcpservers.org · mcpfind.org · mcpmarket.com · PulseMCP · awesome-mcp-servers#13003 (mcp.so skipped — paid)
cursor.directory	Open Plugins: root `.mcp.json` + `.cursor-plugin/plugin.json` — re-submit after these are on `main`

Directory / Marketplace maintainer notes: docs/distribution.md.

Prerequisites

Python 3.10+
An MCP-capable host (Cursor, Claude Desktop, VS Code, …)
Network access to your Cloud API host (default https://cloud.octowatchdlp.com)

Example questions

“Which Risks in the last day?”
“Who was idle the longest yesterday?”
“Productivity summary for Accounting”
“Show Monitoring keystrokes for Emily”
“Find keyword invoice across monitoring last week”
“List users and groups”

Short scenarios

Goal	Ask something like…
DLP / policy hits	“Summarize risks for today by user and rule”
Idle time (not formal alerts)	“Who was idle more than 2 hours yesterday?”
Top apps/sites	“Top applications for group Accounting last 7 days”
Keyword hunt	“Search monitoring for `confidential` last 30 days”
Directory	“List users and groups, then show info for AliasID 4”

Security & privacy

Defaults use the public demo account.
Do not put production passwords in MCP config or git. Use env vars and a least-privilege console operator.
No writes, no screenshot/video binary downloads.

Monitoring responses can contain sensitive employee data (activity, keystrokes snippets, mail metadata). Treat tool output as confidential. Full policy: SECURITY.md.

Limitations

Read-only — not a full console replacement (Web Console)
No screenshot/video binary downloads (stream metadata only)
Not a mirror of product docs or the REST catalog — those stay at docs and /api/
Alpha — expect breaking changes between minors until 1.0

Quick start (PyPI)

Use the Install badges at the top of this README (Cursor / VS Code; demo credentials). First ensure the CLI is available:

pip install octowatch-mcp

Or configure manually — example for Cursor / Claude-style mcpServers (demo credentials):

{
  "mcpServers": {
    "octowatch": {
      "command": "octowatch-mcp",
      "env": {
        "OCTOWATCH_API_BASE": "https://cloud.octowatchdlp.com",
        "OCTOWATCH_EMAIL": "demo@octowatchdlp.com",
        "OCTOWATCH_PASSWORD": "demo"
      }
    }
  }
}

Ready-made files: examples/cursor-mcp-pypi.json, examples/claude-desktop-pypi.json. Per-host steps: docs/hosts.md.

Restart the host, then try: “Using OctoWatch, who am I logged in as?” or “List risks for the last week.”

Demo credentials work without a .env. Be gentle with the shared demo tenant (avoid aggressive agent loops).

From source

git clone https://github.com/extralabs/octowatch-mcp-server.git
cd octowatch-mcp-server
python -m venv .venv
# Windows: .venv\Scripts\activate
# macOS/Linux: source .venv/bin/activate
pip install -e .
cp .env.example .env   # optional
python -m octowatch_mcp

Use examples/cursor-mcp.json / examples/claude-desktop.json and set cwd to your clone (Windows: D:\\path\\to\\octowatch-mcp-server).

ChatGPT and other hosts

There is no single public ChatGPT JSON config we ship yet — ChatGPT / similar products often use remote MCP connectors rather than a local command stdio process.

For local desktop agents, prefer Cursor, Claude Desktop, or VS Code with the examples above.
If your host supports custom MCP over HTTP, you can run octowatch-mcp --transport streamable-http (localhost only by default) and register that endpoint per the host’s docs — see docs/hosts.md.

Your account (email / password)

OctoWatch Cloud still needs a console login. The MCP does not store passwords for you — the host passes them as process env.

Mode	What to set
Demo (try-out)	Defaults / Install badges: `demo@octowatchdlp.com` / `demo`
Your tenant	Your least-privilege operator email + password in MCP `env` (or Cursor plugin Configure)

Variable	Meaning
`OCTOWATCH_EMAIL`	Console operator email
`OCTOWATCH_PASSWORD`	Console password (`isSecret` in Registry metadata)
`OCTOWATCH_API_BASE`	Cloud API host if not the default public cloud

Recommended: put them in the MCP host JSON env block — examples/cursor-mcp-pypi-with-env.json / examples/claude-desktop-pypi-with-env.json. Cursor plugin variables: .cursor-plugin/plugin.json.

Alternatively, for a source install, copy .env.example → .env next to the process working directory.

Never commit real passwords. Verify the same data in the Web Console. Walkthrough: docs/hosts.md.

Core tools

Tool	Cloud area	Notes
`octowatch_whoami`	Auth session	Account / host (no password)
`list_users_groups`	Directory tree	Type 0 root, 1 group, 2 user
`list_risks`	Risks + Analytics	Default `mode=summary`
`list_anomalies`	Alerts	Formal deviations (not idle)
`get_idle_summary`	Productivity	Rank by `InactiveTime`
`get_activity_summary`	Activity	Top apps/sites
`get_timesheet`	TimeSheet	Worked vs expected hours
`get_productivity_summary`	Productivity + analytics	Per-user rollup
`list_reports`	Reports	Scheduled + processing tasks

Console coverage tools

Tool	Cloud area	Notes
`get_analytics`	Analytics	`view=overall\|disciplina\|activity\|productivity`
`get_dashboard`	Dashboard	Widgets; blobs stripped
`get_chrono`	Chrono	Timeline
`get_day_structure`	Day structure	`list` or `detail`
`list_monitoring`	Monitoring	One kind; compact by default
`search_monitoring`	Tools → Search	`filter_key` across kinds
`get_activity_detail`	Activity window	Drill-down
`list_online`	Live	Presence only
`list_stream_meta`	Stream	Metadata only
`list_directory`	Edit Get*	users/groups/computers/…
`get_user_info`	User card	AliasID / computer
`get_account_readonly`	Account Get*	No Set*/PIN
`list_api_coverage`	(static)	Gap summary

Full arguments, routing, and scenarios: docs/TOOLS.md.
MCP prompts/resources: docs/MCP.md.

Configuration

Env	Default	Meaning
`OCTOWATCH_API_BASE`	`https://cloud.octowatchdlp.com`	API host (`serverBase`)
`OCTOWATCH_EMAIL`	`demo@octowatchdlp.com`	Console operator
`OCTOWATCH_PASSWORD`	`demo`	Demo only by default
`OCTOWATCH_DEFAULT_DAYS`	`1`	Lookback when tools omit dates/period
`OCTOWATCH_TOOLSETS`	`all`	`all` \| `core` \| `console` (console includes core)

octowatch-mcp                                      # stdio (default)
octowatch-mcp --transport streamable-http          # http://127.0.0.1:8000/mcp

Periods & filters

Prefer period=today|yesterday|last_7_days|last_30_days, or date_from / date_to.

Date-only values cover the full calendar day (date_to → 23:59:59).
Optional user_id (AliasID) and group_id on most read tools.
POST body TreeviewUsers: all → NodeType=-666666; group → NodeType=14; user → NodeType=1.

Documentation

Doc	Contents
docs/README.md	Doc index
docs/hosts.md	Install per host + your login
docs/TOOLS.md	Tool reference + when-which
docs/MCP.md	Protocol, resources, prompts
docs/API.md	MCP coverage audit (not a full REST mirror)
docs/troubleshooting.md	Common failures
docs/registry.md	Official MCP Registry (`server.json`)
docs/distribution.md	Directories, Marketplace, deferred hosted channels

Product & console

Roadmap

Planned (not scheduled): tighter payload budgets, client-side rate limits, argument completions, server icon, optional MCP Apps UI, tool-routing evals. Registry metadata: docs/registry.md. Protocol surface: docs/MCP.md.

Contributing

See CONTRIBUTING.md. Changelog: CHANGELOG.md. Issues: GitHub Issues.

License

MIT — see LICENSE.