Watch.ly
Checked: 2026-07-14
Summary
Watch.ly is a commercial human-approval firewall for AI-agent network and filesystem access. A local Watch.ly process is claimed to intercept agent requests, evaluate local rules, and pause unmatched actions for approval through a web dashboard or notification channel. The approved network connection then travels directly from the machine to its destination rather than through Watch.ly’s cloud.
The product targets OpenClaw and other local agents. It is an access-control layer, not a disposable VM or complete development environment.
Problem
Always-on agents may read sensitive files or call destructive external APIs while the user is away. Static allowlists are predictable but cannot cover every legitimate one-off action. Watch.ly combines local policy with remote human approval and temporary permissions.
How It Works
The following is the vendor’s described flow:
- The Watch.ly agent runs beside the AI agent and intercepts a network or file request.
- It evaluates allow, deny, wildcard, pattern, or JavaScript rules locally.
- A matched rule decides immediately. An unmatched request pauses for human approval.
- The user approves once, creates a lasting rule, or denies with guidance returned to the agent.
- An approved network request connects directly to its destination.
- Local logs or optional cloud request/response logging create an audit trail.
The FAQ says the local agent is mainly Rust with some C for eBPF and NFQUEUE integration. These are Linux operating-system networking hooks. The public material does not explain the Windows implementation or the exact file-interception mechanism.
Security Boundary
- Rules are claimed to run locally without sending traffic to the cloud for evaluation.
- Watch.ly is not a VM boundary. The protected agent still runs on the same operating system unless the user adds separate container or VM isolation.
- Human approval can prevent an unmatched request, but its security depends on complete interception, fail-closed behavior, trusted local policy, authenticated approvals, and resistance to agent tampering.
- The public site does not provide a threat model, architecture document, audit report, privilege model, bypass analysis, or failure behavior.
- A privileged or hostile agent may be able to disable, evade, or alter a same-machine control unless Watch.ly uses a stronger privilege boundary. Public evidence does not establish that boundary.
- Approval prompts can also create fatigue or mislead users with incomplete request descriptions.
Verified fact: the site and policy pages are live and describe these controls. Unverified vendor claim: Watch.ly intercepts all network and filesystem traffic originating from an agent.
Platforms and Agents
- Product site: Linux and Windows supported; macOS “coming soon.”
- OpenClaw deployment support claimed for Linux systemd, init.d, or direct command-line use, and Windows direct or startup-service use.
- Docker sandbox support is listed as coming soon.
- “Other systems” are mentioned, but no detailed compatibility list or coding-agent integrations were public.
- The product is not tied to one model provider.
Setup
- The FAQ directs users to create an account and follow a guided installation page.
- Setup uses a separate
watchly-setupbinary. - Linux package repositories are offered so installation and updates can use the system package manager rather than a downloaded shell pipeline.
- In-depth documentation was still “coming soon” on the check date.
- Users then configure local rules, machines, notification channels, logging choices, and approval behavior through the product flow.
Network and Credentials
- Vendor claim: network traffic is evaluated locally and, after approval, travels directly to the destination without passing through Watch.ly servers.
- The cloud receives notifications, rule synchronization, account/device data, and approval decisions needed for remote control.
- Optional request/response logging can send URLs, domains, ports, timestamps, decisions, and agent identifiers to Watch.ly according to the privacy policy.
- The privacy policy says configured allow/deny policies are recorded so they can sync to agents.
- The product does not claim to broker credentials or replace real secrets with placeholders. An approved process may still hold and send its existing credentials.
- JavaScript rules add flexibility but become trusted local policy code.
- Exact treatment of TLS, DNS, UDP, raw IP traffic, subprocesses, localhost, VPNs, containers, and alternate filesystem APIs is undocumented publicly.
Pricing
Official pricing checked 2026-07-14:
| Plan | Price | Published features |
|---|---|---|
| Free / Local | $0 | Local traffic filter, static allow/deny rules, local logs, no cloud |
| Personal | $6.99/month | 3 machines, cloud dashboard, web approvals, notifications, advanced rules, optional 30-day logs |
| Enterprise | Custom | Unlimited agents, custom retention, dedicated support, SSO/SAML, full audit trail |
Personal includes a seven-day trial with no credit card. Confirm current billing and taxes before purchase.
Strengths
- Adds remote human approval without routing approved application traffic through a vendor proxy.
- Local rule evaluation reduces latency and unnecessary content sharing.
- Offers static, scripted, temporary, and one-time decisions.
- Denial guidance helps the agent choose a safer alternative.
- Free local tier avoids cloud dependency and stores logs locally.
- Paid notifications and dashboard suit unattended, always-on agents.
- Opt-in logging gives users a choice between privacy and centralized audit visibility.
Limits and Risks
- Sparse public documentation and no inspectable public agent source at the linked GitHub URL on the check date.
- No published security audit, threat model, bypass tests, or fail-closed guarantee.
- Same-host filtering is a different and generally weaker boundary than a dedicated VM against kernel-level or privileged attackers.
- Human approvals can be delayed, unavailable, or mistakenly granted.
- Cloud approvals and policy sync add an account, service-availability, and notification-channel dependency.
- Logged request and response data can contain source code, secrets, personal data, or model output.
- Free static rules omit remote human approval and advanced cloud features.
- File access is advertised, but its supported operations, paths, and Windows/Linux enforcement details are not public.
- Network filtering alone does not prevent damage to already-authorized files or services.
Activity and Maturity
- Privacy policy effective 2026-03-12.
- The maker described Watch.ly as active work on HN in April 2026 and again in the Clawk thread on 2026-07-14.
- The live site offered sign-up, trial, pricing, privacy, terms, and a setup flow.
- The FAQ says the team also operates FastComments.com and plans to run Watch.ly long-term.
- Public technical documentation was not yet available, and the site’s “View on GitHub” target
watch-ly/agentwas unavailable through GitHub on the check date. - Practical maturity: an early commercial product with a live control plane, but limited public verification of the endpoint agent.
Best Fit
- An always-on OpenClaw agent whose owner wants remote approval for unusual file or network actions.
- Linux or Windows users who want local rule evaluation plus web or chat notifications.
- Teams willing to combine Watch.ly with a VM or container for stronger host isolation.
- Users who can tolerate pauses while a human decides.
It is less suitable for fully unattended workflows, macOS users today, high-assurance environments requiring audited enforcement, or developers seeking a complete per-project sandbox.
Comparison Facts
| Fact | Watch.ly | Clawk |
|---|---|---|
| Main control | Local file/network interception plus human approval | Disposable local Linux VM |
| Isolation | Same-host policy layer; no VM included | Dedicated guest VM boundary |
| Network policy | Rules plus one-time/temporary approvals | Domain allowlist before dialing |
| File policy | Vendor claims interception and approval | VM blocks host filesystem by separation |
| Remote control | Cloud dashboard and notifications | Local CLI workflow |
| Credentials | Existing agent credentials remain with agent | Credentials remain inside project VM workflow |
| Offline option | Free static local filtering | Local operation |
| Platforms | Linux, Windows; macOS planned | macOS and Linux VM paths |
| Price | Free local, $6.99 personal, enterprise custom | Open-source local tool |
The products can complement each other: Clawk supplies the hard machine boundary; Watch.ly supplies remote approval and policy decisions. Integration is not documented.
Hacker News Context
In the Clawk thread, Watch.ly author winrid said the product intercepts all network and filesystem traffic on the machine originating from the agent and sends approval requests to the user. No replies or independent validation appeared in that comment chain.
The same author described it in an April 2026 “What are you working on?” thread as a remote human-in-the-loop networking and filesystem sandbox for agents such as OpenClaw.
Unknowns
- Exact Linux and Windows interception architecture, required privileges, and filesystem coverage.
- Fail-closed behavior when the local daemon, cloud service, or notification channel fails.
- Protection against a privileged agent disabling the service or bypassing its hooks.
- Cryptographic authentication and replay protection for remote approvals and policy sync.
- TLS, DNS, UDP, raw socket, container, VPN, and localhost coverage.
- Security audit results, source availability, release history, support terms, and measured latency.
- macOS and Docker delivery dates.