What AgentWatch can actually see

Phase H1. The AI Agent Security Field Guide (section 5) assumes four data sources: an endpoint collector, provider admin APIs, a package-registry feed, and an agent runtime. AgentWatch has the following, and nothing else:

Source	What it gives us
SDK / POST /steps	Every step the agent chooses to report: tool name, arguments, output, tokens, cost, timing. Cooperative — an agent that stops reporting goes dark.
Gate (/gw/*)	Every LLM and MCP call routed through it, before it happens: model, tool, prompt sample, verdict, caller IP. The only non-bypassable path — for traffic that uses it.
Cursor hooks	The IDE agent's tool calls, shell commands and file reads, in the developer's own session.
F9 connectors	Runs pulled from OpenAI Assistants, Azure Foundry, Vertex Agent Engine, Datadog, webhooks. After the fact, no enforcement.
MCP tables	Servers and tools auto-discovered from mcp__<server>__<tool> step names, registered through POST /mcp/servers, or proxied through Gate. Only the last two carry tool definitions.
Passport / config	What the operator declares: allowed tools and models, approvals, data reachable, identity, sandbox, autonomy level.

Every check below is classed:

• A — computable today from existing tables.
• B — computable after a small addition. The addition is named, and it shipped in Phase H.
• C — needs a data source AgentWatch does not have. The collector is named, nothing fake was built, and the check reports status: not_collected on the API, never pass.

A check that does have a source but finds no data for this agent (e.g. an SDK agent with no passport, so its granted privileges are unknown) also reports not_collected with the reason. A posture check that silently passes because we have no data would be worse than no check.

Posture checks (AW-P)

ID	Check	Class	Computed from	Addition / collector needed
AW-P01	Lethal trifecta	A	Private data: AgentPassport.data_reachable + PII/secret SecurityEvents for the agent (recipient e-mail addresses excluded) + private-store tools. Untrusted input: web/e-mail/ticket/document tools and any MCP tool output. Outbound: send/post/upload tools, curl/wget in shell args, AgentStep.network_destination. Gate: approval_required_tools or an enforcing require_approval guardrail conditioned on the tool.	— (data_reachable, untrusted_input_sources, outbound_channels are optional declarations added in H4)
AW-P02	Unused privilege	A	Passport allowed_tools / allowed_models vs tools and models used in the last 30 days; wildcard grants are findings.	—
AW-P03	Borrowed identity	B	Declared AgentPassport.identity_type: human and shared (a default / shared service account) fail; Cursor hooks are inferred human (they run in the developer's session).	AgentPassport.identity_type (own / service / shared / human)
AW-P04	Long-lived keys	A	GatewayKey.expires_at / created_at per agent; ProviderCredential.created_at at account level.	—
AW-P05	Approvals off	A	Passport approval_required_tools; guardrails in scope, enforce vs dry_run.	—
AW-P06	Unpinned supply chain	B	MCP servers linked to the agent and model ids it used, against the approved catalogue's version / hash. Dated or numbered model ids count as pinned.	approved_components table. Packages and skills: needs a lockfile / package-manifest collector (C for that part, reported in evidence).
AW-P07	Unapproved component	B	Observed MCP servers, MCP tools and models vs approved_components. No catalogue at all is a finding, not a pass.	approved_components table
AW-P08	Unsafe model format	C	—	A model-artifact scanner that reads weight files in the model registry / on disk (pickle .bin/.pt/.pkl vs .safetensors). AgentWatch sees model names, never model files.
AW-P09	No sandbox	B	Code-execution tools observed in traffic + declared AgentPassport.sandbox. Undeclared → not_collected.	AgentPassport.sandbox. Verifying the sandbox needs an endpoint / runtime collector.
AW-P10	Unscreened model traffic	A	llm_call steps whose run has no GatewayVerdict for it. Reported as % screened per agent.	—
AW-P11	Content logging on	B	AgentPassport.content_capture and content_capture_approved_by.	Both fields; with capture off, steps keep only args_hash + args_redacted.
AW-P12	No kill switch	A	Control path: Gate verdicts for the passport with every model call screened = enforceable; SDK only = cooperative; mixed = partial. Plus kill_switch_tested_at or an observed obeyed stop, and stop violations.	AgentPassport.kill_switch_tested_at (optional)

Runtime detections (AW-D)

ID	Detection	Class	Computed from	Limits / collector needed
AW-D01	Hijack after untrusted read	A	Outbound or destructive step within N steps of an untrusted-input step in the same run, to a destination / tool the user's prompt or run goal did not name.	Needs the H4 untrusted_sources / network_destination fields; the scored injection engine is Phase C2.
AW-D02	Tool outside allowlist	A	Gate deny verdicts (passport check_tool / check_model) and enforcing guardrail kills.	Existing; mapped, not duplicated.
AW-D03	New destination	A	AgentStep.network_destination never seen before for this agent (after a 5-step baseline). Flag-only unless the payload carries PII/secrets.	Destinations inside an MCP server's own code (e.g. a hidden BCC) never appear in the agent's arguments. Allowlist enforcement is Phase C1.
AW-D04	Tool description or version changed	A	tool_definitions hash of each tool's name + description + schema, and the server version, re-hashed on every Gate tools/list / initialize and registry sync. Diff in the finding.	Servers seen only through mcp__ step names have no definition to hash.
AW-D05	Approval-skipping launch	A	Bypass flags (--dangerously-skip-permissions, --yolo, --trust-all-tools, …) in a monitored agent's own command arguments.	Launches by an install script outside any monitored agent need an endpoint process collector (C).
AW-D06	Secret hunting	A	Credential paths (.env, ~/.aws/credentials, id_rsa, keychain, wallets, key stores) in tool arguments, scored against the agent's last 500 steps.	Reads that never pass through a reported tool call are invisible.
AW-D07	Key misuse	B	Gateway-key use from an IP never seen for that key, or a call rate far above its own baseline; key use after revocation is AW-D11.	Client IP on GatewayVerdict.detail (added). Provider keys used outside Gate need the provider's admin / audit-log API (C).
AW-D08	Cost or volume spike	A	cost_velocity, token_explosion, runaway detectors.	Existing; mapped. Single-agent spikes are LLM10, not ASI08.
AW-D09	Memory write from untrusted source	A	A memory-write tool (MCP memory server, save_memory, …) within N steps of an untrusted read from another source.	Recognises memory tools by name; first-class memory step types are Phase C6.
AW-D10	Rubber-stamp approvals	B	ApprovalRequest created→resolved time under a floor (default 2 s); approver approve rate ≥ 98 % over ≥ 10 decisions (approvals + Gate holds).	ApprovalRequest.decided_by (added).
AW-D11	Ignored stop	A	Every step / preflight on a killed run (the 409 we used to throw away), every Gate call on a killed session, every use of a revoked key or passport → stop_violations.	SDK violations prove disobedience but AgentWatch cannot block them; Gate ones are blocked (enforced).
AW-D12	Package install of unknown name	C	—	A package-registry reputation feed (PyPI / npm existence, first-publish date, downloads). Without it a hallucinated name looks like any new dependency.
AW-D13	Autonomy rising	A	Passport edits removing approval_required_tools or raising autonomy_level; guardrails switched enforce→dry_run, disabled or deleted.	Changes made outside AgentWatch (in the agent's own config) are invisible.

What a typical install does not collect

For an SDK-only install (no Gate, no passports declared):

• Always not_collected: AW-P08, AW-D12.
• not_collected until the passport is filled in: AW-P02, AW-P03, AW-P04, AW-P09 (for code-executing agents).
• Fails by construction: AW-P10 (0 % screened) and AW-P12 (cooperative only). That is the honest result, not a bug.
• AW-D04 works only for MCP servers registered with their tool list or proxied through Gate.

For a Gate install, AW-P10 and AW-P12 can pass, AW-D07 has IPs to work with, and AW-D11 violations are blocked rather than only recorded.

The live list is GET /posture/data-sources; tests/test_posture.py fails if this document and the code disagree about any class.