WatchTower

The pre-deploy security gate for vibe-coded apps.It doesn't ask whether your Supabase RLSexists— it logs in as a random user and as the anonymous role and proves whether they can read yourotherusers' data, right inside Claude Code, before you ship.

No URL to paste. No data uploaded. No deploy required. Runs locally in your Claude Code agent loop.

Commodity scanner → ⚠ "RLS may not be enabled on profiles." Watchtower → [CRIT] [PROVEN] the anon role read rows from profiles belonging to other accounts — RLS is not isolating users. [CRIT] [PROVEN] the OpenAI key in src/config.ts returned HTTP 200 from the vendor — it is LIVE. Rotate it now.

It runs a live,read-only, rolled-backcross-tenant probe against your database — theCVE-2025-48757class, where 170+ apps leaked their user tables because RLS was "present" but never actually enforced — and it verifies whether a leaked key is real by calling that key's own vendor. (It also tracks your real Claude Code spend, so deploy day isn't an $8k surprise either.)

{ "mcpServers": { "watchtower": { "command": "watchtower-mcp" } } }

"Sync my Claude Code usage and show this month's spend" "Scan my project for hardcoded secrets and check if any are live" "Audit my Supabase database — can other users read my data?" "Check the security headers on https://myapp.vercel.app" "Set a $5 daily budget alert"

- Cost tracking—watchtower_sync_usageparses Claude Code's transcript logs (the actual billed token counts) and stores them in a local SQLite database at~/.watchtower/watchtower.db. Costs are computed from a current pricing table; unknown models are clearly labelledestimatedrather than silently mispriced. Spend windows are calendar-aligned (UTC) to reconcile with your Anthropic bill.
- Secret scanning— runs entirely in-process (no shell), with overlap de-duplication, placeholder/entropy filtering to cut false positives, and secret redaction in all output. Withverify: true, each detected key gets a single read-only verification request to its own vendor (Anthropic/OpenAI/Stripe/GitHub) or a local JWT decode (Supabase) — so you learn which leaks arereal.
- RLS correctness— connects with thepgdriver (credential stays in-process), then inside read-only, rolled-back transactions it drops to theauthenticatedandanonroles and attempts to read each table. A row visible to a random non-owner or to the anon role is aprovencross-tenant leak — theCVE-2025-48757class of breach. Findings backed by a live read are marked[PROVEN].

Watchtower holds itself to the standard it scans for:

- No shell is invoked anywhere. The secret scanner reads files directly; the RLS audit uses thepgdriver, neverpsql. Caller-supplied paths and connection strings cannot inject commands, and your database password is never placed on a command line.
- Detected secrets are redacted in all output and areneverwritten to the database.
- Live-key verification isopt-in(verify: true) and contacts only each key's own vendor over read-only endpoints.

Claude Opus 4.6, Sonnet 4.6, Haiku 4.5, and Sonnet 3.5. Unknown models are priced as an explicit estimate (Sonnet rates) and flagged as such.

- Node.js 18+
- Claude Code (or any MCP-compatible client)
- For the RLS audit: a Postgres/Supabase connection string with permission to read schema and (ideally) theauthenticated/anonroles. Nopsqlinstall required.

This is a web browser that enables your coding agent, such as Claude Code, to visit websites on your behalf and assist you in identifying bugs or creating UI test cases.

All-in-one website diagnostics: DNS, SSL certs, HTTP headers, security audit (A-F grade), WHOIS, tech stack detection. No API keys needed.

Cloud security insights, guardrail guidance, and compliance checking via Dawnguard.

Access and interact with Harness platform data, including pipelines, repositories, logs, and artifact registries.

A secure MCP server for eBPF, designed for AI integration, kernel introspection, and automation.

Manage secrets and environment variables with Infisical's official MCP server.

An MCP server for interacting with the Tenable Nessus vulnerability scanner.

Network reconnaissance and security scanning with port scanning, DNS analysis, and vulnerability assessment

The Execution Security Layer for the Agentic Era. Providing deterministic "Sudo" governance and audit logs for autonomous AI agents.

AI-safe secrets manager - inject credentials as env vars, AI never sees plaintext

AI health, token usage, LLM cost optimization, BYOK vault, and cleanup audits for MCP agents.