gowrav-m/AgentOps Watchtower
Black box recorder, MCP safety scanner, runtime firewall, and evidence generator for AI agent workflows.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit May 30, 2026
- License
- MIT
Pinned Snippet
uses: gowrav-m/agentops-watchtower@f2317b7b3bc739bde15bfd2ca887d450215764db # v1.5.0tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| descriptor | MCP descriptor JSON path. | no | "" |
| config | MCP client config path. | no | "" |
| trace | Agent trace JSONL/Markdown path for runtime attack graph analysis. | no | "" |
| server | MCP server name or inventory id for gate-mcp. | no | "" |
| fail-on | Severity threshold that fails the workflow. | no | high |
| package-version | npm version of agentops-watchtower to run. | no | latest |
| run-agent-bom | Generate AgentBOM when config is provided. | no | true |
| run-admission | Run MCP admission when config and descriptor are provided. | no | true |
| run-gate | Run MCP preflight gate when config and server are provided. | no | false |
| run-proxy-dry-run | Run MCP proxy preflight in dry-run mode when config and server are provided. | no | false |
| run-attack-graph | Run runtime attack graph when trace is provided. | no | true |
| run-report | Generate Markdown, HTML, and JSON Watchtower reports. | no | true |
| run-attestation | Generate a tamper-evident evidence bundle from produced artifacts. | no | true |
Outputs
| name | description |
|---|---|
| report-json | Watchtower report JSON path. |
| sarif | Watchtower SARIF path. |
| agent-bom | AgentBOM JSON path. |
| evidence-bundle | Evidence bundle JSON path. |
| proxy-audit | MCP proxy audit JSON path. |