Every Claude session,traced to the person behind it.
OpenWatch keeps a session's messages, tool calls, models and tokens on one record, attributed to the person signed in to Claude. Open it in the dashboard, ask Claude through MCP, or query the REST API.
The record exists.It's just in three places.
01
Transcripts and cost live apart
Anthropic's Compliance API returns session records without token usage or cost. Those sit in a separate Analytics API.
02
Local sessions can go unrecorded
When HIPAA readiness is on, Anthropic captures no local session data, so Desktop and Cowork work leaves nothing server-side.
03
Nobody can see context
A transcript alone doesn't show which branch, folder or tool call a session ran through, or which person was signed in.
What you get
From first promptto last tool call.
Session record
One record per session, with the context around it
Messages, tool calls, models and token counts sit together, alongside the git branch and working directory the session ran in.
- Input, output and cache tokens on every message
- Tool calls grouped by category, with errors flagged
- Audit events for results, rate limits and system messages
Search
Find the prompt behind a question from compliance
Search message text across captured sessions, narrow it to a person or message type, and open the session each match came from.
- Filter by person, message type and time window
- Jump from a match to the full session
- Export a filtered list as CSV from the dashboard
Access
People see their own sessions. Admins see everyone's.
In an Attri deployment, sign-in runs through Microsoft Entra. Each person sees their own Claude activity; admins see the whole organisation, including claude.ai chats from Anthropic's Compliance API.
- Microsoft Entra single sign-on
- Two roles, enforced in the API and the database
- claude.ai chats and activity alongside device sessions
Everything a session holds,one query away.
Session list
Filter by person, project and time window. Sort by most recent or by message count.
Message history
Each message with its type, model, token counts and whether extended thinking was used.
Tool calls
Every tool call with its name, category and outcome, and errors marked.
Audit trail
Results, rate limits, system messages and tool summaries in order.
Session summary
Request count, tools used, git branches, directories and totals in one view.
Message search
Search message text across people and sessions, then open the match.
Three ways in.
The dashboard comes with an Attri deployment. The MCP server and REST API are in the open-source repository.
Open the dashboard
Browse and filter sessions, then export what you need. Signed in with Microsoft Entra.
Ask Claude through MCP
Add the OpenWatch MCP server to Claude Code, then ask which sessions ran longest this week.
claude mcp add openwatch -s user -- python /absolute/path/to/openwatch/run_mcp.pyCall the REST API
Read-only endpoints under /api/v1. Interactive docs are served at /docs.
curl "http://localhost:8788/api/v1/sessions?days=7&sort=messages"
What a session record holds.
Collected on the device and from Anthropic's APIs. Nothing is written back to Claude.
| Field | What it holds | Source |
|---|---|---|
| Identity | Account id, email and display name from the Claude Desktop sign-in | Device collector |
| Messages | Type, model, input, output and cache tokens, stop reason | Device collector |
| Tool calls | Name, category, error flag and result, stored up to 4,000 characters | Device collector |
| Context | Git branch, working directory and permission mode | Device collector |
| Documents | File name, path and size. Never file contents | Device collector |
| claude.ai chats | Chats, messages, projects and activity events | Anthropic Compliance API |
Secrets such as API keys, private keys, tokens and password values are redacted on the device before upload.
Questions about sessions
Which Claude surfaces are covered?
Claude Desktop, Cowork and Claude Code sessions run inside Desktop, through the device collector, plus claude.ai chats through Anthropic's Compliance API. Claude Code in a standalone terminal isn't collected yet.
Does OpenWatch store the contents of documents?
No. For documents in a session, the collector records the file name, path and size only.
Are secrets sent to OpenWatch?
The collector redacts private keys, API keys, GitHub and Slack tokens, JWTs and password-style values on the device before anything is uploaded.
Can I run the open-source version on my own data?
The public repository serves the REST API and MCP server over a database and loads sample data out of the box. Collecting from your organisation's devices and Anthropic's APIs comes with an Attri deployment.
Does it show sub-agents?
Sidechain messages are stored with each session, but there isn't a dedicated sub-agent view yet.
Someone will ask what happened.Have the answer ready.
Run OpenWatch on sample data in minutes, or have Attri deploy it inside your cloud with live data from your organisation.