octowatch-mcp
OfficialServer Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
| prompts | {
"listChanged": false
} |
| resources | {
"subscribe": false,
"listChanged": false
} |
| experimental | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| octowatch_whoamiA | Show which OctoWatch API host and account the MCP server is using (password never returned). |
| list_users_groupsA | List users and groups tree (GetUsersGroups2). Type 0=root, 1=group, 2=user. These Type values are for the UI tree only. For report POST filters use NodeType 14=group and NodeType 1=user (AliasID). Cached ~5 min per MCP session; pass refresh=true to force reload. |
| list_risksA | List or summarize DLP/rule Risks for a period. Use for: policy/keyword/USB/AI rule hits. Default mode=summary (by_user from Analytics/Overall; by_rule/by_day/sample from Risks/Overall2). Not for idle time (get_idle_summary) or timetable deviations (list_anomalies). |
| list_anomaliesA | List formal Alerts / deviations (POST /api/Alerts/Overall2). Use for: lateness, overtime, unusual app-share, timetable-fired alerts. Do NOT use for idle/inactive duration — that is get_idle_summary (InactiveTime). Do NOT use for DLP keyword/USB policy hits — that is list_risks. |
| get_idle_summaryA | Rank users by inactive (idle) time from Productivity/Overall3. Use for: 'who was idle longest?', 'idle > N hours', InactiveTime totals. Do NOT use list_anomalies for idle — Alerts are formal deviations only. |
| get_activity_summaryB | Top apps and sites by ActiveTime (POST /api/Activity/Overall2). |
| get_timesheetB | Timesheet / attendance summary (POST /api/TimeSheet/Overall2). |
| get_productivity_summaryB | Per-user productivity rollup (Overall3 + stats + Analytics metrics). |
| list_reportsA | List scheduled report mailing settings and background processing tasks. |
| get_analyticsB | Analytics rollups: view=overall|disciplina|activity|productivity. |
| get_dashboardA | Dashboard widgets (metadata only; screenshot blobs stripped when compact). |
| get_chronoC | Chronometry timeline (POST /api/Chrono/Overall2). |
| get_day_structureA | Day structure: mode=list (DayStructureList) or detail (GetDayStructure). detail requires user_id. Filters match console: ProductivityFilter 0–4, ActivityTypeFilter 0–2 (defaults 0). |
| list_monitoringA | Single Monitoring list (Sites, Apps, Screens, Keystrokes, Mail, …). For keyword search across many Monitoring kinds (console Tools → Search), use search_monitoring(filter_key=…) instead of calling this 13–19 times. Sensitive kinds return text truncated when compact=true. No binary media. |
| search_monitoringA | Console Tools → Search: parallel Monitoring fan-out with FilterKey. Use for: 'find keyword X across activity' (sites/apps/keys/mail/files/…). Prefer this over calling list_monitoring many times. Not for Risks (list_risks), idle (get_idle_summary), or formal Alerts (list_anomalies). Does not search SearchQueries. kinds: optional comma-separated subset (e.g. "Sites,Apps,Mail" or "sites,mail"). Default = all Tools Search sources. |
| get_activity_detailB | Activity drill-down: ActivityWindow (needs activity_name) or CategoryWindow (needs category_guid). |
| list_onlineA | Online presence (POST /api/Live/Overall2). No webcam or live stream frames. |
| list_stream_metaA | Desktop video metadata (SPA GET contracts; no DownloadVideo). which_content: needs user_id; uses DateTo (or period end) as DateTime. videos: needs user_id + DateFrom/DateTo (UserID header). downloads: Bearer only (exported file list). |
| list_directoryA | Directory reads: users/groups tree, users, groups, computers, additional operators. users_groups is session-cached (~5 min); pass refresh=true to force reload. |
| get_user_infoA | User/computer detail reads (SPA GET headers). user_data / tooltip / group: need user_id (AliasID). group = group path for that user (not load-by-GroupID). computer / users_from_computer: need computer_guid (ComputerGuid). |
| get_account_readonlyB | Read-only account/profile/license Gets (SPA header contracts). profiles: GetProfiles2 — ProfilesType 0|1|2; optional user_id + alias_type (1=user, 14=group); defaults AliasID/AliasType=-1. timetable/rules/profile_settings/computer_settings: require profile_id. computer_profiles: optional computer_guid (Guid header). |
| list_api_coverageA | Static gap matrix: which console APIs are covered vs intentional out-of-scope. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
| daily_risks_brief | Summarize DLP risks for a period using the recommended tool sequence. |
| idle_review | Find who was idle longest using get_idle_summary (not list_anomalies). |
| user_activity_drilldown | Drill into one user's apps/sites and optional activity window. |
| monitoring_keyword_hunt | Search Monitoring via Tools Search (search_monitoring), not repeated list_monitoring. |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
| resource_coverage | Static gap matrix of console API coverage (same data as list_api_coverage). |
| resource_tool_routing | When-which-tool routing text for SecOps queries. |
| resource_whoami | Current API host and account (password never included). Live call. |
TDQS
Scored across 22 tools
Most tools are sharply delineated with explicit cross-references, e.g. list_risks vs list_anomalies vs get_idle_summary. Some overlap remains between list_users_groups and list_directory, and between get_activity_summary, get_productivity_summary, and get_analytics, but descriptions largely resolve it.
The set mostly follows a consistent list_/get_ + noun convention, with list_ for collection-style endpoints and get_ for details or summaries. Exceptions like octowatch_whoami and search_monitoring break the pattern slightly, keeping this from a 5.
22 tools falls in the heavy 16-25 band. The breadth is justified by the wide OctoWatch read-only surface, but the count is more than most agents need at once and includes several summary/detail pairs that could be consolidated.
The toolset thoroughly covers read-only monitoring: risks, alerts, idle time, activity, productivity, directory, online presence, streams, and account info. Obvious gaps are write/manage operations and media/live-frame downloads, but these appear intentional for a monitoring-focused read-only server.