OctoWatch DLP MCP Server

PyPI package: `octowatch-mcp` · product: octowatchdlp.com (not related to other products named “OctoWatch”).

Read-only Model Context Protocol (MCP) server for **OctoWatch DLP Cloud** employee monitoring and data-loss prevention — ask Cursor, Claude, or VS Code about risks, idle time, productivity, and monitoring in plain language.

• Product: octowatchdlp.com
• Product docs: octowatchdlp.com/docs/
• Web Console: app.octowatchdlp.com
• In-app API catalog: app.octowatchdlp.com/api/

Python MCP SDK v2 (`MCPServer`). Built for SecOps and managers — open-source companion to the OctoWatch console.

Contents: Status · Where to find us · Prerequisites · Example questions · Security · Limitations · Quick start · Your account · Tools · Configuration · Documentation · Contributing

Status

Alpha (`v0.5.1`). APIs and tool shapes may change; pin a PyPI version in production configs.

Tool failures return MCP `is_error` (`ToolError`). All tools advertise `read_only_hint`.

Where to find us

The MCP runs locally (no ExtrLabs-hosted MCP). Catalogs point at PyPI / GitHub; you supply Cloud login via env.

Directory / Marketplace maintainer notes: docs/distribution.md.

Prerequisites

• Python 3.10+
• An MCP-capable host (Cursor, Claude Desktop, VS Code, …)
• Network access to your Cloud API host (default `https://cloud.octowatchdlp.com`)

Example questions

• “Which Risks in the last day?”
• “Who was idle the longest yesterday?”
• “Productivity summary for Accounting”
• “Show Monitoring keystrokes for Emily”
• “Find keyword `invoice` across monitoring last week”
• “List users and groups”

Short scenarios

Security & privacy

> Defaults use the public demo account.

> Do not put production passwords in MCP config or git. Use env vars and a least-privilege console operator.

> No writes, no screenshot/video binary downloads.

Monitoring responses can contain sensitive employee data (activity, keystrokes snippets, mail metadata). Treat tool output as confidential. Full policy: SECURITY.md.

Limitations

• Read-only — not a full console replacement (Web Console)
• No screenshot/video binary downloads (stream metadata only)
• Not a mirror of product docs or the REST catalog — those stay at docs and /api/
• Alpha — expect breaking changes between minors until 1.0

Quick start (PyPI)

Use the Install badges at the top of this README (Cursor / VS Code; demo credentials). First ensure the CLI is available:

pip install octowatch-mcp

Or configure manually — example for Cursor / Claude-style `mcpServers` (demo credentials):

{
  "mcpServers": {
    "octowatch": {
      "command": "octowatch-mcp",
      "env": {
        "OCTOWATCH_API_BASE": "https://cloud.octowatchdlp.com",
        "OCTOWATCH_EMAIL": "demo@octowatchdlp.com",
        "OCTOWATCH_PASSWORD": "demo"
      }
    }
  }
}

Ready-made files: examples/cursor-mcp-pypi.json, examples/claude-desktop-pypi.json. Per-host steps: docs/hosts.md.

Restart the host, then try: *“Using OctoWatch, who am I logged in as?”* or *“List risks for the last week.”*

Demo credentials work without a `.env`. Be gentle with the shared demo tenant (avoid aggressive agent loops).

From source

git clone https://github.com/extralabs/octowatch-mcp-server.git
cd octowatch-mcp-server
python -m venv .venv
# Windows: .venv\Scripts\activate
# macOS/Linux: source .venv/bin/activate
pip install -e .
cp .env.example .env   # optional
python -m octowatch_mcp

Use examples/cursor-mcp.json / examples/claude-desktop.json and set `cwd` to your clone (Windows: `D:\\path\\to\\octowatch-mcp-server`).

ChatGPT and other hosts

There is no single public ChatGPT JSON config we ship yet — ChatGPT / similar products often use remote MCP connectors rather than a local `command` stdio process.

• For local desktop agents, prefer Cursor, Claude Desktop, or VS Code with the examples above.
• If your host supports custom MCP over HTTP, you can run `octowatch-mcp --transport streamable-http` (localhost only by default) and register that endpoint per the host’s docs — see docs/hosts.md.

Your account (email / password)

OctoWatch Cloud still needs a console login. The MCP does not store passwords for you — the host passes them as process env.

Recommended: put them in the MCP host JSON `env` block — examples/cursor-mcp-pypi-with-env.json / examples/claude-desktop-pypi-with-env.json. Cursor plugin variables: `.cursor-plugin/plugin.json`.

Alternatively, for a source install, copy `.env.example` → `.env` next to the process working directory.

Never commit real passwords. Verify the same data in the Web Console. Walkthrough: docs/hosts.md.

Core tools

Console coverage tools

Full arguments, routing, and scenarios: docs/TOOLS.md.

MCP prompts/resources: docs/MCP.md.

Configuration

octowatch-mcp                                      # stdio (default)
octowatch-mcp --transport streamable-http          # http://127.0.0.1:8000/mcp

Periods & filters

Prefer `period=today|yesterday|last_7_days|last_30_days`, or `date_from` / `date_to`.

• Date-only values cover the full calendar day (`date_to` → `23:59:59`).
• Optional `user_id` (AliasID) and `group_id` on most read tools.
• POST body `TreeviewUsers`: all → `NodeType=-666666`; group → `NodeType=14`; user → `NodeType=1`.

Documentation

Product & console

• octowatchdlp.com
• octowatchdlp.com/docs/
• app.octowatchdlp.com
• app.octowatchdlp.com/api/

Roadmap

Planned (not scheduled): tighter payload budgets, client-side rate limits, argument completions, server icon, optional MCP Apps UI, tool-routing evals. Registry metadata: docs/registry.md. Protocol surface: docs/MCP.md.

Contributing

See CONTRIBUTING.md. Changelog: CHANGELOG.md. Issues: GitHub Issues.

License

MIT — see LICENSE.