AgentWatch
by agentwatch.agentwatch.workers.dev · remote · no sign-in to list tools · v0.5.1 · published by dev.workers.agentwatch.agentwatch
Read-only watchtower for AI agents on-chain: decoded receipts, plan vs execution, Safe audits.
Deletes · 1Changes · 7
21 tools: 1 can delete or cancel things, 7 change things and 13 only read.
Scanned Oct 21, 2026
- Deletes or cancels1Claude Code: deny: see these tools
- Can't be undone0Claude Code: ask
- Changes things7Claude Code: ask: see these tools
- Only reads13Claude Code: allow: see these tools
No check matched anything in the tool definitions. No finding is not a safety guarantee. How the checks work.
claude mcp add --transport http agentwatch https://agentwatch.agentwatch.workers.dev/mcpTools
Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.
21 tools
Deletes or cancels 1Claude Code: deny
remove_recovery_ownerRemove a saved recovery address for this user.No findings
Why it is in this group
- The name "remove_recovery_owner" says "remove": a word for removing or ending something.
Description, as the server wrote it Remove a saved recovery address for this user.
Changes things 7Claude Code: ask
add_watchStart watching an address.No findings
Why it is in this group
- The name "add_watch" says "add": a word for a change.
Description, as the server wrote it Start watching an address. Use when onboarding a new agent or Safe.
refresh_watchesForce an immediate poller pass over this principal's watched addresses (catch up txs from explorers into AgentWatch).No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Force an immediate poller pass over this principal's watched addresses (catch up txs from explorers into AgentWatch). Use after add_watch / a fresh broadcast when get_feed is still empty. Optional address / chains to focus the pass.
register_intentDeclare an intent BEFORE broadcasting.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Declare an intent BEFORE broadcasting. Returns {intent_id, pairing_code}. Append the 16-hex pairing_code as the last 8 bytes of calldata (no magic prefix), then broadcast — EXCEPT bare ETH transfers to contracts (empty data + value>0): appending reverts on Safe/fallback handlers; register without a suffix and use expected.steps for multi-leg flows (e.g. approve+supply). Pairing codes are single-use and only consumed by successful (non-reverted) txs. Use deadline_minutes (relative) — normalized to absolute constraints.deadline at registration.
run_auditRun provenance audit on a Safe/address.No findings
Why it is in this group
- The name "run_audit" says "run": a word for a change.
Description, as the server wrote it Run provenance audit on a Safe/address. Use when the user asks 'is this fake?' or wants a shareable verdict.
set_agent_passportDeclare who a watched agent is: model provider, run cadence, role, purpose, operator, and whether to publish a shareable public passport at /a/<slug>.No findings
Why it is in this group
- The name "set_agent_passport" says "set": a word for a change.
Description, as the server wrote it Declare who a watched agent is: model provider, run cadence, role, purpose, operator, and whether to publish a shareable public passport at /a/<slug>. Declarations never change the receipt-derived numbers next to them; publishing exposes only this address, never the rest of the watch list.
set_recovery_ownerSave or update a recovery address for this user.No findings
Why it is in this group
- The name "set_recovery_owner" says "set": a word for a change.
Description, as the server wrote it Save or update a recovery address for this user. Product default Safe is then 1/2: threshold 1, owners = [agent, this recovery]. Use make_default=true to prefer this label in get_safe_defaults.
watch_demo_setONE-SHOT cold-start for brand-new Claude / MCP users with an empty watch list.No findings
Why it is in this group
- The name "watch_demo_set" says "set": a word for a change.
Description, as the server wrote it ONE-SHOT cold-start for brand-new Claude / MCP users with an empty watch list. Adds the July 18 fixture (Agent EOA + Safe A + Safe B on Base, with declared intents) and one live Polygon trading bot, so the first dashboard has recent activity. Call this FIRST after connect when list_watched is empty, then call get_dashboard (Always allow the App). Idempotent — skips addresses already watched.
Only reads 13Claude Code: allow
get_agent_passportRead the declared identity of a watched agent (name, model provider, how often it runs, role, purpose, operator) and whether its public passport page is published.No findings
Why it is in this group
- The name "get_agent_passport" says "get": a word for reading.
Description, as the server wrote it Read the declared identity of a watched agent (name, model provider, how often it runs, role, purpose, operator) and whether its public passport page is published.
get_alertsList alerts scoped to this principal's watched addresses (empty watch list → call watch_demo_set first).No findings
Why it is in this group
- The name "get_alerts" says "get": a word for reading.
Description, as the server wrote it List alerts scoped to this principal's watched addresses (empty watch list → call watch_demo_set first). Use when checking what needs attention.
get_benchmarkCounterfactual P&L / agent alpha vs do-nothing baselines.No findings
Why it is in this group
- The name "get_benchmark" says "get": a word for reading.
Description, as the server wrote it Counterfactual P&L / agent alpha vs do-nothing baselines. Use for performance honesty checks. Check matched_agent — false means the key has no indexed activity.
get_capabilitiesBlast-radius / historical capability for an agent key.No findings
Why it is in this group
- The name "get_capabilities" says "get": a word for reading.
Description, as the server wrote it Blast-radius / historical capability for an agent key. Use before trusting an agent with funds.
get_dashboardPersona-tailored dashboard brief (fidelity, alerts, pending plans, recent planned-vs-executed).No findings
Why it is in this group
- The name "get_dashboard" says "get": a word for reading.
Description, as the server wrote it Persona-tailored dashboard brief (fidelity, alerts, pending plans, recent planned-vs-executed). NEW USERS with empty watches: call watch_demo_set first, then get_dashboard again. Narrate in plain language; ask the user to Always allow the AgentWatch MCP App widget when the host prompts.
get_feedDecoded activity feed for an address.No findings
Why it is in this group
- The name "get_feed" says "get": a word for reading.
Description, as the server wrote it Decoded activity feed for an address. Use when reviewing what an agent did on-chain.
get_fidelityIntent↔execution fidelity score for an agent or Safe.No findings
Why it is in this group
- The name "get_fidelity" says "get": a word for reading.
Description, as the server wrote it Intent↔execution fidelity score for an agent or Safe. Use for accountability / coverage meter. Check matched_agent — false means the address has no indexed activity (as signer or as the Safe that executed), so the score is vacuous.
get_leaderboardPublic standings for agents with a published passport, ranked from receipts (declared-first coverage, fidelity, reliability, hygiene, sustained work).No findings
Why it is in this group
- The name "get_leaderboard" says "get": a word for reading.
Description, as the server wrote it Public standings for agents with a published passport, ranked from receipts (declared-first coverage, fidelity, reliability, hygiene, sustained work). Pass agent_key to get that agent's own rank, its component scores, and what it would need to climb. Read-only: nothing here can be self-reported.
get_pending_proposalsPending Safe multisig proposals from the Safe Transaction Service (indexer confidence).No findings
Why it is in this group
- The name "get_pending_proposals" says "get": a word for reading.
Description, as the server wrote it Pending Safe multisig proposals from the Safe Transaction Service (indexer confidence). Pass safe=0x… or omit to scan all watched addresses.
get_safe_defaultsReturn the default Safe ownership plan for an agent EOA: threshold 1 + agent + selected recovery (1/2 when one recovery is set).No findings
Why it is in this group
- The name "get_safe_defaults" says "get": a word for reading.
Description, as the server wrote it Return the default Safe ownership plan for an agent EOA: threshold 1 + agent + selected recovery (1/2 when one recovery is set). Call before register_intent for Safe deploys. AgentWatch never deploys or signs.
get_tcaTCA market-context snapshot for an event_id (chain:txHash).No findings
Why it is in this group
- The name "get_tca" says "get": a word for reading.
Description, as the server wrote it TCA market-context snapshot for an event_id (chain:txHash). Use when judging execution quality.
list_recovery_ownersList this user's saved recovery wallets (human co-signers for default 1/2 Safes).No findings
Why it is in this group
- The name "list_recovery_owners" says "list": a word for reading.
Description, as the server wrote it List this user's saved recovery wallets (human co-signers for default 1/2 Safes). Each may have a label/purpose — users often keep several for different vaults.
list_watchedList watched addresses for this connector principal.No findings
Why it is in this group
- The name "list_watched" says "list": a word for reading.
Description, as the server wrote it List watched addresses for this connector principal. NEW USERS: if empty, call watch_demo_set next (do not invent a global feed), then get_dashboard.
This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.
Install
Pinned to version 0.5.1. Values in angle brackets are yours to fill in.
claude mcp add --transport http agentwatch https://agentwatch.agentwatch.workers.dev/mcpRun in a terminal.
Claude Code permissions
Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.
{
"permissions": {
"allow": [
"mcp__agentwatch__list_watched",
"mcp__agentwatch__get_feed",
"mcp__agentwatch__get_capabilities",
"mcp__agentwatch__get_alerts",
"mcp__agentwatch__get_pending_proposals",
"mcp__agentwatch__get_fidelity",
"mcp__agentwatch__get_leaderboard",
"mcp__agentwatch__get_benchmark",
"mcp__agentwatch__get_tca",
"mcp__agentwatch__get_agent_passport",
"mcp__agentwatch__list_recovery_owners",
"mcp__agentwatch__get_safe_defaults",
"mcp__agentwatch__get_dashboard"
],
"ask": [
"mcp__agentwatch__run_audit",
"mcp__agentwatch__register_intent",
"mcp__agentwatch__add_watch",
"mcp__agentwatch__watch_demo_set",
"mcp__agentwatch__refresh_watches",
"mcp__agentwatch__set_agent_passport",
"mcp__agentwatch__set_recovery_owner"
],
"deny": [
"mcp__agentwatch__remove_recovery_owner"
]
}
}Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as agentwatch. Review it before you use it.