watchtower_sync_usageLABSCO SUMMARY
It proves the finding instead of flagging it.
The difference from a commodity scanner is the verb: rather than reporting that RLS may not be enabled, it reads rows as the anonymous role and tells you whether it got them — the failure mode where a policy is present but is not actually enforcing. Cost tracking shares the same install, which reads oddly on a feature list and makes sense on the week you ship.
What it is
A Node MCP server that runs a live read-only cross-tenant probe against your own database and scans your source for working secrets, entirely on your machine.
What you get
- A cross-tenant probe that logs in as a random user and as the anonymous role, and reports whether either read other accounts' rows
- Every check run inside a rolled-back transaction — the probe can read, never write
- Source scanned for hardcoded keys and tokens in pure Node, without shelling out
- Optional verification of a found key by calling that key's own vendor, so a hit is confirmed live rather than suspected
- Response headers scanned
- Scan history kept, so you can see what changed between runs
- Real Claude Code token usage imported from its own session logs, with already-imported events skipped
- Spend by day, week or month, calendar-aligned, with a per-model breakdown and how much of it is estimated
- Budget alerts that warn as you approach the budget and again when you pass it
Requirements
npm install -g watchtower-mcp and one line in the client config. No account. Nothing leaves your machine except the opt-in key check, which calls only each key's own vendor.
Setup effort
One command — npm install -g watchtower-mcp
USE CASES
01
Finding out whether your RLS is actually enforcing
Run the cross-tenant probe and read whether another account's rows came back.
02
Checking whether a key in the repo is still live
Scan the source, then verify the hits against each key's own vendor.
03
Reviewing response headers before a launch
Get the header scan done in the same pass as the rest of the gate.
04
Seeing what changed since the last check
Compare against the stored scan history rather than re-reading a full report.
05
Finding out what this month has cost
Import the real usage from session logs, then read spend with the per-model split.
06
Getting warned before the bill surprises you
Set daily, weekly or monthly budgets, with a manual log for non-Claude-Code clients.
9 tools
Listed in project docs. Your client may show a different list.
watchtower_spendwatchtower_budgetwatchtower_log_usagewatchtower_scan_secretswatchtower_scan_supabasewatchtower_scan_headerswatchtower_statuswatchtower_scan_historyBEFORE YOU INSTALL
What to know first
Tools you get
9 tools named in the project's documentation.
Requires
- watchtower-mcp on PATH
- Node.js 18+
Where it runs
The documented client runs the server on your machine.
INSTALLATION
Connect your client
Server setup
TERMINAL
npm install -g watchtower-mcpMCP Clients
Claude Code
CLAUDE CODE · JSON
{
"mcpServers": {
"watchtower": {
"command": "watchtower-mcp"
}
}
}
