Overwatch: Code Agent Security

Security for MCP servers with Javelin Guardrails

Overwatch secures your AI code agents and MCP (Model Context Protocol) servers. Install the extension, configure your Javelin API key, and all MCP requests will be validated through Javelin Guardrails.

Features

• 🛡️ Automatic Protection: Automatically intercepts and validates all MCP requests
• 🔧 Easy Setup: Simple configuration with your Javelin API key
• 👁️ Real-time Monitoring: Visual status indicators and detailed logging
• ⚡ Lightweight: Minimal performance impact with intelligent caching
• 🎛️ Granular Control: Custom policies
• 🔄 Hot Reload: Dynamic policy updates without restart

Quick Start

1. Install the Extension

   • Install from VS Code Marketplace or Cursor Extensions
   • The extension activates automatically

2. Set Your Javelin API Key

   • Open VS Code/Cursor Settings
   • Search for "Overwatch"
   • Enter your Javelin API key (get one at getjavelin.com)

3. You're Protected!

   • All MCP servers are now automatically secured
   • Check the status bar for real-time protection status

How It Works

Overwatch works by:

1. Auto-Discovery: Automatically finds all MCP server configurations
2. Transparent Proxying: Inserts a lightweight security proxy between your IDE and MCP servers
3. Request Validation: Every MCP request is validated through Javelin Guardrails
4. Seamless Operation: Blocked requests return helpful error messages; approved requests work normally

Configuration

Basic Settings

• Enable/Disable: Toggle protection on/off
• Javelin API Key: Your Javelin Guardrails API key
• The proxy fails closed on validation errors; requests are blocked when Guard validation is unavailable
• Log Level: Control logging verbosity

Advanced Settings

• Custom Policy: Path to custom YAML policy file for advanced rules

Note on HTTP/SSE servers

• Wrapping HTTP/SSE servers no longer requires a setting. Use “Overwatch: Auto‑Proxy All Servers” to apply wrapping as needed. “Overwatch: Unwrap All Servers” disables protection and restores originals safely.

Status Indicators

• 🟢 Protected: Server is secured by Overwatch
• 🔴 Unprotected: Server not yet secured (extension disabled)

Troubleshooting

Extension Not Working?

1. Check that the extension is enabled in VS Code/Cursor
2. Verify your Javelin API key is set correctly
3. Check the Overwatch output channel for error messages

MCP Server Not Starting?

1. Ensure the original MCP server command is valid
2. Check if the server requires specific environment variables

Performance Issues?

1. Enable request caching in settings
2. Reduce log level to 'error' only

Support

• Website: www.getjavelin.com

License

This extension is licensed under Javelin's proprietary license. All rights reserved.