cortexark · cortexark · Apr 8, 2026 · Apr 8, 2026
diff --git a/.mcpbignore b/.mcpbignore
@@ -0,0 +1,14 @@
+.git
+node_modules
+dist
+dist-old*
+releases
+data
+tests
+docs/screenshots
+electron/assets
+homebrew
+.project
+.unused
+*.dmg
+*.zip
diff --git a/README.md b/README.md
@@ -555,6 +555,132 @@ See [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines on:
 - Creating new notification types
 - Running and writing tests
 
+## Claude Desktop MCP Extension
+
+Argus ships with a built-in MCP server that integrates directly with Claude Desktop. Ask Claude questions about what AI agents are doing on your machine — in natural language.
+
+### Setup
+
+Add to your Claude Desktop config (`~/Library/Application Support/Claude/claude_desktop_config.json`):
+
+```json
+{
+  "mcpServers": {
+    "argus": {
+      "command": "node",
+      "args": ["/path/to/argus/src/mcp/server.js"]
+    }
+  }
+}
+```
+
+Restart Claude Desktop. Argus tools appear automatically.
+
+### Available Tools
+
+| Tool | Description |
+|------|-------------|
+| `get_active_ai_processes` | List AI agents detected in the last N hours |
+| `get_file_accesses` | Sensitive file access alerts (credentials, browser data) |
+| `get_network_activity` | Network connections to AI endpoints |
+| `get_sessions` | Session history with start/stop/duration |
+| `get_daily_summary` | Daily stats for any date |
+| `get_injection_alerts` | Prompt injection detections |
+| `get_ai_usage` | Token usage and estimated API costs |
+| `get_monitoring_status` | Overall Argus status and stats |
+
+All tools are **read-only** — they query the local SQLite database and never modify anything.
+
+### Example 1: Check what's running
+
+**Prompt:** "What AI agents ran on my machine today?"
+
+**Response:**
+```json
+[
+  { "name": "claude", "app_label": "Claude Code (CLI)", "category": "AI Code Editor" },
+  { "name": "Claude", "app_label": "Claude Desktop", "category": "LLM Desktop" },
+  { "name": "ollama", "app_label": "Ollama", "category": "Local LLM" }
+]
+```
+
+### Example 2: Check for credential access
+
+**Prompt:** "Did any AI app access my SSH keys or credentials?"
+
+**Response:**
+```json
+[
+  {
+    "process_name": "Claude",
+    "app_label": "Claude Desktop",
+    "file_path": "/Users/you/.ssh/id_rsa",
+    "sensitivity": "credentials",
+    "is_alert": 1,
+    "timestamp": "2026-04-03T14:22:19.000Z"
+  },
+  {
+    "process_name": "Claude",
+    "app_label": "Claude Desktop",
+    "file_path": "/Users/you/Library/Keychains/login.keychain-db",
+    "sensitivity": "credentials",
+    "is_alert": 1,
+    "timestamp": "2026-04-03T14:10:04.000Z"
+  }
+]
+```
+
+### Example 3: Daily summary
+
+**Prompt:** "Give me a summary of AI activity for yesterday"
+
+**Response:**
+```json
+{
+  "date": "2026-04-02",
+  "processCount": 4,
+  "fileAlertCount": 21,
+  "networkEventCount": 5265,
+  "topPorts": [443, 80, 9222],
+  "aiServicesHit": ["Anthropic", "OpenAI", "GitHub Copilot"]
+}
+```
+
+## Privacy Policy
+
+Argus is a **local-only** privacy monitoring tool. This policy covers both the Argus application and its MCP extension for Claude Desktop.
+
+### Data Collection
+- Argus monitors AI application activity (processes, file accesses, network connections) on your local machine
+- All monitoring data is stored in a local SQLite database at `~/.argus/data.db`
+- The MCP extension reads from this same local database
+
+### Data Transmission
+- **No data is ever transmitted to any external server, cloud service, or third party**
+- The MCP extension communicates only with Claude Desktop via local STDIO (standard input/output)
+- There is no telemetry, analytics, crash reporting, or tracking of any kind
+- The application makes zero outbound network connections
+
+### Data Storage
+- All data remains on your local filesystem at `~/.argus/`
+- Database file permissions are set to owner-only (mode 0600)
+- You can inspect, export, or delete the database at any time
+- Old events are automatically cleaned up after 7 days
+
+### Data Sharing
+- Argus does not share data with anyone
+- The MCP extension provides data only to Claude Desktop running on the same machine
+- No third-party services, APIs, or SDKs are used for data processing
+
+### Your Control
+- You can pause/resume monitoring at any time via the tray menu
+- You can delete all data by removing `~/.argus/`
+- All source code is open source and auditable at https://github.com/cortexark/argus
+- Uninstall instructions: `argus uninstall && npm uninstall -g argus-monitor`
+
+### Contact
+For privacy questions or concerns, open an issue at https://github.com/cortexark/argus/issues
+
 ## Related Tools
 
 - **Little Snitch** — Network firewall (port-level monitoring)

diff --git a/manifest.json b/manifest.json
@@ -0,0 +1,59 @@
+{
+  "manifest_version": "0.3",
+  "name": "argus",
+  "version": "1.0.0",
+  "description": "Monitor what AI agents access on your machine — files, credentials, network connections, and browser data. Argus sees everything your AI apps do.",
+  "author": {
+    "name": "cortexark",
+    "url": "https://github.com/cortexark"
+  },
+  "homepage": "https://github.com/cortexark/argus",
+  "documentation": "https://github.com/cortexark/argus#claude-desktop-mcp-extension",
+  "support": "https://github.com/cortexark/argus/issues",
+  "license": "MIT",
+  "server": {
+    "type": "node",
+    "entry_point": "src/mcp/server.js",
+    "mcp_config": {
+      "command": "node",
+      "args": ["${__dirname}/src/mcp/server.js"]
+    }
+  },
+  "tools": [
+    {
+      "name": "get_active_ai_processes",
+      "description": "List AI agents and LLM apps detected on this machine"
+    },
+    {
+      "name": "get_file_accesses",
+      "description": "Show sensitive file accesses by AI agents (credentials, browser data, documents)"
+    },
+    {
+      "name": "get_network_activity",
+      "description": "Show network connections made by AI agents"
+    },
+    {
+      "name": "get_sessions",
+      "description": "Show AI agent session history (start, stop, duration)"
+    },
+    {
+      "name": "get_daily_summary",
+      "description": "Get daily stats — process count, alerts, network events, AI services"
+    },
+    {
+      "name": "get_injection_alerts",
+      "description": "Show prompt injection attempts detected in files"
+    },
+    {
+      "name": "get_ai_usage",
+      "description": "Show AI tool token usage and estimated costs"
+    },
+    {
+      "name": "get_monitoring_status",
+      "description": "Check monitoring status and overall stats"
+    }
+  ],
+  "privacy_policies": [
+    "https://github.com/cortexark/argus#privacy-policy"
+  ]
+}
diff --git a/package.json b/package.json
@@ -67,6 +67,7 @@
     }
   },
   "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.29.0",
     "better-sqlite3": "^12.8.0",
     "blessed": "^0.1.81",
     "chalk": "^5.3.0",
@@ -78,7 +79,8 @@
     "pino": "^10.3.1",
     "pino-pretty": "^13.1.3",
     "pino-roll": "^4.0.0",
-    "ps-list": "^8.1.1"
+    "ps-list": "^8.1.1",
+    "zod": "^4.3.6"
   },
   "type": "module",
   "engines": {