ThinkWatch

What it is

ThinkWatch is a self-hosted gateway for AI model traffic and MCP tool calls, positioned as a bastion host for AI access. It is source-available under the Business Source License 1.1, not open source. A separate free desktop edition, ThinkWatch Lite (MIT), runs a local gateway for individual developers on macOS, Windows and Linux.

How it works

Two ports with different trust levels:

flowchart LR
  C[Clients: Claude Code, Cursor, CI] --> G[Gateway :3000]
  G --> G1[Auth, limits, guards]
  G1 --> U[Providers and MCP servers]
  A[Admin browser] --> K[Console :3001]
  K -.->|keep behind VPN or firewall| N[Not public]

Only the gateway (port 3000) needs to be reachable by clients. The console (port 3001) serves the management UI and admin API and belongs behind a VPN or firewall.

Three guards run on each request, each set to on, monitoring or off:

• Secrets & privacy swaps credentials and personal data for placeholders such as <<TW_EMAIL_1>> before the request goes upstream, then restores them in the answer, including streamed answers.
• Dangerous commands cuts a response at the offending tool call or records it. Two built-in rules also catch a credential sent to an unknown host and a local file uploaded to an external host.
• The content filter matches phrases, regexes or code points in requests and answers, then refuses, deletes, replaces or records.

Preconditions / Affected

• A new installation starts with all three guards in monitoring mode. Hits go to the audit log and forwarders, and nothing is changed until a guard is switched on.
• E-mail and phone rules ship switched off. Zero-width and private-use character rules also ship off; Unicode tag characters and bidirectional controls ship on.
• Secrets & privacy skips field names and base64 payloads. Custom rules also skip ids, types, roles, tool names and the model name.
• Body redaction before audit storage is off by default.
• Production use is free only up to 10,000,000 Billable Tokens and 10,000 MCP Tool Calls per UTC month. Above either threshold a commercial license is required. LICENSING.md defines the terms and says the license changes to GPL-2.0-or-later at a later date.
• Contributors sign a CLA on their first pull request.

What to do

Local trial:

make infra
make dev-secrets
make dev-backend
cd web && pnpm install && pnpm dev

Then finish the setup wizard at http://localhost:5173/setup. It creates the first Super Admin, sets the site name and issues a first API key. Providers are added in the console afterwards. The Deployment Guide covers TLS and hardening.

Before relying on it, check these behaviours:

• Limits and budgets are checked before a request against earlier usage, and tokens are counted after the response. One request can therefore cross a token limit or budget before the next is refused.
• Limits fail open by default if Redis is unavailable or the database fails while limits load. Set security.rate_limit_fail_closed to refuse those requests instead.
• A user who has not connected an upstream account still sees the tool list. A call returns JSON-RPC error -32050 with the authorization URL.
• Per-user MCP responses are cached per user and account, never shared. A user can connect several accounts to one server and pin each tw- key to one.
• GET /v1/usage on the gateway port shows a client its usage and remaining room.

Caveats

• A content rule that checks answers cannot refuse and cannot match code points.
• Kafka forwarding goes through a REST proxy.
• The page gives no benchmarks, latency overhead or audit results.