Local-first network visibility for authorized environments.
Discover assets. Understand changes. Investigate with evidence.
NetWatch is a defensive tool. Use it only on networks and devices you own or are explicitly authorized to assess.
NetWatch is a self-hosted network visibility platform for authorized networks.
- Asset discovery
- Device / OS intelligence
- Change detection
- Service review
- Evidence & history
- Optional AI investigation with your own API key
Overview
 Risk Advisor |
 Port Audit |
Optional. Choose OpenAI/GPT or Anthropic/Claude, using your own server-side API key:
# OpenAI (default)
export NETWATCH_AI_PROVIDER="openai"
export OPENAI_API_KEY="your-openai-api-key"
export NETWATCH_AI_MODEL="gpt-5-mini"
# Or, instead of the above, select Claude:
# export NETWATCH_AI_PROVIDER="anthropic"
# export ANTHROPIC_API_KEY="your-anthropic-api-key"
# export NETWATCH_AI_MODEL="claude-sonnet-5-5"Only bounded, de-identified evidence is shared. AI has no scan or remediation tools. Core monitoring works without any AI key. Opt-in automatic brief generation
is supported by setting NETWATCH_AI_AUTO_ANALYSIS_ENABLED=true, with a
minimum one-hour interval, durable change detection and the same safety/cost
limits. It is disabled by default. See AI setup.
git clone https://github.com/Adam-Ghanem/NetWatch.git
cd NetWatch
python scripts/start.pyOpen http://127.0.0.1:8000.
The supported FastAPI dashboard uses patched Pillow 13.0.0 and does not install the older Streamlit frontend. Legacy Streamlit execution is temporarily disabled because published releases still require vulnerable Pillow < 13. See deployment guidance.
Authorization-first, evidence-driven, scope-controlled, and local-first. Never commit secrets or use NetWatch against systems you are not authorized to assess.
See the 2026-10-22 security/CI evidence snapshot for exact passing workflow SHAs, regression coverage, and the open production-security gates.
The XERJ Corpus Hub contributor profile lists NetWatch as selected for its PCAP-analysis evidence work (selected commit e8f6d39132, 10 October 2026). As of 22 October 2026, the listing is in licence review, not a live or installable corpus. See XERJ recognition and status notes. This is attribution and selection, not an independent audit, certification, or endorsement of NetWatch's security posture.
MIT — see LICENSE.