OctoWatch DLP MCP Server

PyPI package: octowatch-mcp · product: octowatchdlp.com (not related to other products named “OctoWatch”).

Read-only Model Context Protocol (MCP) server for OctoWatch DLP Cloud employee monitoring and data-loss prevention — ask Cursor, Claude, or VS Code about risks, idle time, productivity, and monitoring in plain language.

• Product: octowatchdlp.com
• Product docs: octowatchdlp.com/docs/
• Web Console: app.octowatchdlp.com
• In-app API catalog: app.octowatchdlp.com/api/

Python MCP SDK v2 (MCPServer). Built for SecOps and managers — open-source companion to the OctoWatch console.

Contents: Status · Where to find us · Prerequisites · Example questions · Security · Limitations · Quick start · Your account · Tools · Configuration · Documentation · Contributing

Status

Alpha (v0.5.1). APIs and tool shapes may change; pin a PyPI version in production configs.

Tool failures return MCP is_error (ToolError). All tools advertise read_only_hint.

Where to find us

The MCP runs locally (no ExtrLabs-hosted MCP). Catalogs point at PyPI / GitHub; you supply Cloud login via env.

Directory / Marketplace maintainer notes: docs/distribution.md.

Prerequisites

• Python 3.10+
• An MCP-capable host (Cursor, Claude Desktop, VS Code, …)
• Network access to your Cloud API host (default https://cloud.octowatchdlp.com)

Example questions

• “Which Risks in the last day?”
• “Who was idle the longest yesterday?”
• “Productivity summary for Accounting”
• “Show Monitoring keystrokes for Emily”
• “Find keyword invoice across monitoring last week”
• “List users and groups”

Short scenarios

Security & privacy

Defaults use the public demo account.
Do not put production passwords in MCP config or git. Use env vars and a least-privilege console operator.
No writes, no screenshot/video binary downloads.

Monitoring responses can contain sensitive employee data (activity, keystrokes snippets, mail metadata). Treat tool output as confidential. Full policy: SECURITY.md.

Limitations

• Read-only — not a full console replacement (Web Console)
• No screenshot/video binary downloads (stream metadata only)
• Not a mirror of product docs or the REST catalog — those stay at docs and /api/
• Alpha — expect breaking changes between minors until 1.0

Quick start (PyPI)

Use the Install badges at the top of this README (Cursor / VS Code; demo credentials). First ensure the CLI is available:

pip install octowatch-mcp

Or configure manually — example for Cursor / Claude-style mcpServers (demo credentials):

{
  "mcpServers": {
    "octowatch": {
      "command": "octowatch-mcp",
      "env": {
        "OCTOWATCH_API_BASE": "https://cloud.octowatchdlp.com",
        "OCTOWATCH_EMAIL": "demo@octowatchdlp.com",
        "OCTOWATCH_PASSWORD": "demo"
      }
    }
  }
}

Ready-made files: examples/cursor-mcp-pypi.json, examples/claude-desktop-pypi.json. Per-host steps: docs/hosts.md.

Restart the host, then try: “Using OctoWatch, who am I logged in as?” or “List risks for the last week.”

Demo credentials work without a .env. Be gentle with the shared demo tenant (avoid aggressive agent loops).

From source

git clone https://github.com/extralabs/octowatch-mcp-server.git
cd octowatch-mcp-server
python -m venv .venv
# Windows: .venv\Scripts\activate
# macOS/Linux: source .venv/bin/activate
pip install -e .
cp .env.example .env   # optional
python -m octowatch_mcp

Use examples/cursor-mcp.json / examples/claude-desktop.json and set cwd to your clone (Windows: D:\\path\\to\\octowatch-mcp-server).

ChatGPT and other hosts

There is no single public ChatGPT JSON config we ship yet — ChatGPT / similar products often use remote MCP connectors rather than a local command stdio process.

• For local desktop agents, prefer Cursor, Claude Desktop, or VS Code with the examples above.
• If your host supports custom MCP over HTTP, you can run octowatch-mcp --transport streamable-http (localhost only by default) and register that endpoint per the host’s docs — see docs/hosts.md.

Your account (email / password)

OctoWatch Cloud still needs a console login. The MCP does not store passwords for you — the host passes them as process env.

Recommended: put them in the MCP host JSON env block — examples/cursor-mcp-pypi-with-env.json / examples/claude-desktop-pypi-with-env.json. Cursor plugin variables: .cursor-plugin/plugin.json.

Alternatively, for a source install, copy .env.example → .env next to the process working directory.

Never commit real passwords. Verify the same data in the Web Console. Walkthrough: docs/hosts.md.

Core tools

Console coverage tools

Full arguments, routing, and scenarios: docs/TOOLS.md.
MCP prompts/resources: docs/MCP.md.

Configuration

octowatch-mcp                                      # stdio (default)
octowatch-mcp --transport streamable-http          # http://127.0.0.1:8000/mcp

Periods & filters

Prefer period=today|yesterday|last_7_days|last_30_days, or date_from / date_to.

• Date-only values cover the full calendar day (date_to → 23:59:59).
• Optional user_id (AliasID) and group_id on most read tools.
• POST body TreeviewUsers: all → NodeType=-666666; group → NodeType=14; user → NodeType=1.

Documentation

Product & console

• octowatchdlp.com
• octowatchdlp.com/docs/
• app.octowatchdlp.com
• app.octowatchdlp.com/api/

Roadmap

Planned (not scheduled): tighter payload budgets, client-side rate limits, argument completions, server icon, optional MCP Apps UI, tool-routing evals. Registry metadata: docs/registry.md. Protocol surface: docs/MCP.md.

Contributing

See CONTRIBUTING.md. Changelog: CHANGELOG.md. Issues: GitHub Issues.

License

MIT — see LICENSE.