Skip to main content

Overview

Overwatch is a comprehensive security framework that provides enterprise-grade protection for AI code agents and Model Context Protocol (MCP) servers. It acts as a security-first AI gateway that sits between your IDE/CLI tools and MCP servers, validating every request through Javelin Guardrails before allowing it to proceed. Overwatch is a universal security wrapper designed to protect AI interactions across two deployment modes:

Deployment Modes​

IDE Extension (VS Code/Cursor)​

The Overwatch extension integrates directly into your development environment, automatically securing all MCP server connections. Once installed, it transparently intercepts MCP requests between your IDE and MCP servers, validating them through Javelin Guardrails without requiring changes to your workflow.

CLI Tool​

The Overwatch CLI tool wraps any AI command-line tool (Claude CLI, Gemini, etc.), routing all LLM and MCP server calls through a security proxy. Simply prefix your AI commands with overwatch, and all requests are automatically secured.

Architecture​

Overwatch uses a transparent proxy architecture that:

  • Intercepts requests before they reach their destinations (MCP servers or LLM APIs)
  • Validates through Javelin Guardrails - Every request is checked against security policies and AI-powered threat detection
  • Enforces policies - Uses Cedar policy language to apply granular access controls
  • Monitors in real-time - Provides immediate feedback on security threats and blocked requests
  • Operates transparently - Approved requests proceed normally; blocked requests return clear error messages
Overwatch Architecture
┌─────────────┐        ┌──────────────┐        ┌─────────────┐
│ IDE/CLI     │  ───►  │   Overwatch  │  ───►  │ MCP Server  │
│  Tool       │        │   Security   │        │  / LLM API  │
│             │        │    Proxy     │        │             │
└─────────────┘        └──────────────┘        └─────────────┘
                              │
                              ▼
                     ┌────────────────────┐
                     │  Policy validation │
                     │        and         │
                     │  Javelin Guardrails│
                     └────────────────────┘

Security Benefits​

Overwatch delivers immediate security benefits for organizations using AI agents:

Prevents Secrets Exposure​

  • Blocks API keys and credentials in prompts before they reach LLMs
  • Redacts sensitive data in responses (AWS keys, SSH keys, JWTs, tokens)
  • Detects obfuscated secrets through advanced ML-based detection
  • Protects credential files from being accessed by AI tools

Blocks Security Attacks​

  • Prompt Injection Protection - Prevents jailbreak attempts and instruction manipulation
  • Command Injection Prevention - Blocks dangerous shell commands and system execution
  • Path Traversal Protection - Restricts file system access to safe directories
  • SSRF Protection - Prevents Server-Side Request Forgery attacks on private networks
  • SQL Injection Detection - Identifies and blocks SQL injection patterns in requests

Real-Time Threat Monitoring​

  • Visual threat indicators in your IDE status bar
  • Detailed threat dashboard showing security issues by server and severity
  • Automatic scanning of MCP servers for vulnerabilities
  • Threat categorization (critical, high, medium, low) for prioritization

Policy-Based Access Control​

  • Granular tool restrictions - Allow or deny specific MCP tools per server
  • File path controls - Restrict access to sensitive directories
  • HTTP endpoint allowlists - Control which external services can be accessed
  • Custom security rules - Define organization-specific policies using Cedar

Zero-Configuration Default Protection​

  • Works out of the box - Comprehensive default policy installed automatically
  • Auto-updates - Policy improvements delivered with each update
  • Sensible defaults - Blocks dangerous operations while allowing legitimate use

Why Use Overwatch?​

Security Risks of Unprotected AI Agents​

AI code agents and MCP servers expose powerful capabilities that can become attack vectors:

  • File system access can be exploited to read sensitive credentials or configuration files
  • Database connections might expose internal data through manipulated queries
  • API integrations could be used for SSRF attacks or unauthorized data exfiltration
  • System commands enable remote code execution if not properly restricted
  • Prompt injection can bypass model safety controls and extract sensitive information

Without proper security controls, these capabilities create significant organizational risk.

Compliance Benefits​

Overwatch helps organizations meet security and compliance requirements:

  • Audit trails - All requests and security decisions are logged
  • Policy enforcement - Ensures consistent security controls across all AI interactions
  • Threat visibility - Provides clear reporting on security incidents and blocked requests
  • Access control - Implements least-privilege access patterns

Enterprise-Grade Security​

Overwatch integrates with Javelin Guardrails, providing:

  • AI-powered threat detection - Advanced ML models detect sophisticated attacks
  • Multi-layer protection - Local policy enforcement plus cloud-based validation
  • Continuous updates - Security improvements delivered automatically
  • Enterprise support - Designed for production environments with reliability and scale

Getting Started​

Overwatch can be deployed in two ways: as an IDE extension for VS Code/Cursor, or as a CLI tool for command-line AI tools. Both provide automatic protection with minimal configuration.

Quick Start:

  • IDE Extension: Install from marketplace, configure Javelin API key, and you're protected
  • CLI Tool: Install via npm, configure on first use, then prefix any AI command with overwatch

For detailed installation and configuration instructions, see the Quickstart Guide.

Next Steps​

Ready to get started? Follow these guides: