ThinkWatch
starsforks
How to install ThinkWatch?
thinkwatchproject/thinkwatch
$git clone https://github.com/ThinkWatchProject/ThinkWatch[English](README.md) | [中文](README.zh-CN.md)
README.md
| 1 | <p align="center"> |
| 2 | <picture> |
| 3 | <source media="(prefers-color-scheme: dark)" srcset="assets/logo-dark.png"> |
| 4 | <img src="assets/logo.png" alt="ThinkWatch" width="480"> |
| 5 | </picture> |
| 6 | </p> |
| 7 | |
| 8 | <p align="center"> |
| 9 | <img src="https://img.shields.io/badge/Rust-000000?style=for-the-badge&logo=rust&logoColor=white" /> |
| 10 | <img src="https://img.shields.io/badge/React-20232A?style=for-the-badge&logo=react&logoColor=61DAFB" /> |
| 11 | <img src="https://img.shields.io/badge/PostgreSQL-316192?style=for-the-badge&logo=postgresql&logoColor=white" /> |
| 12 | <img src="https://img.shields.io/badge/Redis-DC382D?style=for-the-badge&logo=redis&logoColor=white" /> |
| 13 | <img src="https://img.shields.io/badge/Docker-2496ED?style=for-the-badge&logo=docker&logoColor=white" /> |
| 14 | <img src="https://img.shields.io/badge/Kubernetes-326CE5?style=for-the-badge&logo=kubernetes&logoColor=white" /> |
| 15 | </p> |
| 16 | |
| 17 | # ThinkWatch |
| 18 | |
| 19 | **[English](README.md) | [中文](README.zh-CN.md)** |
| 20 | |
| 21 | **The enterprise-grade secure gateway for AI.** Secure, audit, and govern every AI API call and MCP tool invocation across your organization — from a single control plane. |
| 22 | |
| 23 | Just as an SSH secure gateway is the single gateway through which all server access must flow, ThinkWatch is the single gateway through which all AI access must flow. Every model request. Every tool call. Every token. Authenticated, authorized, rate-limited, logged, and accounted for. |
| 24 | |
| 25 | ``` |
| 26 | ┌──────────────────────────────────────┐ |
| 27 | Claude Code ──────>│ │──> OpenAI |
| 28 | Cursor ───────────>│ Gateway :3000 │──> Anthropic |
| 29 | Custom Agent ─────>│ AI API + MCP Unified Proxy │──> Google Gemini |
| 30 | CI/CD Pipeline ───>│ │──> Azure OpenAI / AWS Bedrock |
| 31 | └──────────────────────────────────────┘ |
| 32 | ┌──────────────────────────────────────┐ |
| 33 | Admin Browser ────>│ Console :3001 │ |
| 34 | │ Management UI + Admin API │ |
| 35 | └──────────────────────────────────────┘ |
| 36 | ``` |
| 37 | |
| 38 | ## Why ThinkWatch? |
| 39 | |
| 40 | As AI agents proliferate across engineering teams, organizations face a growing governance challenge: |
| 41 | |
| 42 | - **API keys scattered everywhere** — hardcoded in `.env` files, shared in Slack, rotated never |
| 43 | - **Zero visibility** — who used which model, how many tokens, at what cost? |
| 44 | - **No access control** — every developer has direct access to every model and every MCP tool |
| 45 | - **Compliance gaps** — no audit trail for AI-assisted code generation or data access |
| 46 | - **Cost surprises** — monthly AI bills that nobody can explain or attribute |
| 47 | |
| 48 | ThinkWatch solves all of this with a single deployment. |
| 49 | |
| 50 | ## Key Features |
| 51 | |
| 52 | ### AI API Gateway |
| 53 | - **Multi-format API proxy** — natively serves OpenAI Chat Completions (`/v1/chat/completions`), Anthropic Messages (`/v1/messages`), and OpenAI Responses (`/v1/responses`) APIs on a single port; works as a drop-in replacement for Cursor, Continue, Cline, Claude Code, and the OpenAI/Anthropic SDKs |
| 54 | - **Multi-provider routing** — OpenAI, Anthropic, Google Gemini, Azure OpenAI, AWS Bedrock, or any OpenAI-compatible endpoint |
| 55 | - **Automatic format conversion** — Anthropic Messages API, Google Gemini, Azure OpenAI, AWS Bedrock Converse API, and more, all behind a unified interface |
| 56 | - **Provider auto-loading** — active providers are loaded from the database at startup and registered in the model router; default model prefixes (`gpt-`/`o1-`/`o3-`/`o4-` for OpenAI, `claude-` for Anthropic, `gemini-` for Google) route automatically; Azure and Bedrock require explicit model registration |
| 57 | - **Streaming SSE pass-through** — zero-overhead forwarding with real-time token counting |
| 58 | - **Virtual API keys** — issue scoped `tw-` keys; the same `tw-` token works on both the AI gateway and the MCP gateway via a per-key `surfaces` allowlist |
| 59 | - **API key lifecycle management** — automatic rotation with grace periods, per-key inactivity timeout, expiry warnings, and background poli |
People who liked this also viewed
6 picksType
- mcp-scannerScan MCP servers for potential threats & security findings.MCP ServersJul 2026
- hol-guardOpen-source antivirus for AI agents: block risky tools, secret access, prompt injection, malicious packages, MCP servers, plugins, and skills at runtime.MCP ServersJul 2026
- agent-scanSecurity scanner for AI agents, MCP servers and agent skills.MCP ServersJul 2026
- falcon-mcpConnect AI agents to CrowdStrike Falcon for automated security analysis and threat huntingMCP ServersJul 2026
- python🔐 Plug-and-play auth for Python MCP servers.MCP ServersAug 2025
- auth0-mcp-serverConnect LLMs and AI agents to Auth0 Management APIs via an MCP server. Use natural-language commands to create apps, deploy Actions, and query logs—runs locally and supports interactive tenant authentication for secure Auth0 administration from AI tools/CLIs.MCP ServersJul 2026
