For a whole organization, or for one developer's machine.
Website · Docs · ThinkWatch · ThinkWatch Lite · ThinkWatch Core
Claude Code, Codex, Cursor, and your own agents talk to model providers directly. API keys end up scattered, nobody sees what was sent, and the bill is a surprise. ThinkWatch puts a gateway in that path, so every model request and tool call is routed, checked, and accounted for.
It comes as two products, built for different people.
|
For teams and enterprises A self-hosted AI API and MCP gateway. Virtual keys, SSO and RBAC, audit logs, rate limits and budgets, and cost attribution, all in one control plane.
Rust · React · PostgreSQL · Redis · Kubernetes |
For individual developers A desktop app for a local AI API gateway. Point Claude Code or Codex at a local port, and see what a session cost, where each request was routed, and what was redacted before it left your machine. Tauri 2 · React 19 · Rust |
Underneath both sits ThinkWatch Core, a set of MIT-licensed Rust crates for routing, failover, cost accounting, and redaction.
| If you… | Use |
|---|---|
| run AI access for a team and need keys, permissions, audit, and budgets in one place | ThinkWatch |
| need to govern MCP tool calls across an organization | ThinkWatch |
| are one developer who wants to know what your coding agents cost and where their requests go | ThinkWatch Lite |
| are building your own gateway, or want the routing and redaction engine as a library | ThinkWatch Core |
Just as an SSH bastion host is the single gateway through which all server access flows, ThinkWatch is the single gateway through which all AI access flows.
Every model request. Every tool call. Every token. Authenticated, authorized, rate-limited, logged, and accounted for.
┌──────────────────────────────────────┐
Claude Code ──────>│ │──> OpenAI
Cursor ───────────>│ Gateway :3000 │──> Anthropic
Custom Agent ─────>│ AI API + MCP Unified Proxy │──> Google Gemini
CI/CD Pipeline ───>│ │──> Azure OpenAI / AWS Bedrock
└──────────────────────────────────────┘
┌──────────────────────────────────────┐
Admin Browser ────>│ Console :3001 │
│ Management UI + Admin API │
└──────────────────────────────────────┘
- AI API gateway. OpenAI, Anthropic, Google Gemini, Azure OpenAI, and AWS Bedrock behind one endpoint, with scoped virtual keys per team, project, or developer.
- MCP gateway. A central tool proxy with namespace isolation, tool-level RBAC, and an audit trail for every invocation.
- Security and compliance. SSO through any OIDC provider, role-based access control, PII redaction, and encryption at rest.
- Rate limits and budgets. Request and token limits per key or per user, with spend budgets and alerts.
- Observability. Searchable audit logs, cost analytics, and Prometheus metrics.
Start with the Quick Start, or read the docs.
- What a session cost, and how far to trust that number. Measured, estimated, and unpriced are shown separately, never added together.
- Where each request went, and why. The rule it matched, the policy group, and the full failover chain.
- What went out with it. Secrets caught on their way to an untrusted upstream, redactions applied, and tool calls that looked dangerous.
- Spend at a glance. Today's spend, or remaining subscription quota, right in the menu bar.
ThinkWatch Lite is in development. macOS comes first, and for now you run it from source:
pnpm install
pnpm tauri devRule-based routing, mid-flight failover, cost accounting against a price
snapshot, outbound secret redaction, and inspection of tool calls coming back
from upstream. twcore is a complete, self-contained gateway binary built from
these crates:
cargo run -p twcore -- init # write a commented config.yaml
cargo run -p twcore -- serve # start the gateway and control plane| Repository | What it is | License |
|---|---|---|
| ThinkWatch | Enterprise AI API and MCP gateway: server, proxy, and web console | BSL 1.1 |
| ThinkWatch Lite | Desktop app for individual developers | MIT |
| ThinkWatch Core | Shared gateway engine, as Rust crates and the twcore binary |
MIT |
| thinkwatch.github.io | Source of thinkwat.ch |
ThinkWatch Lite and ThinkWatch Core are released under the MIT License.
ThinkWatch is source-available under the Business Source License 1.1.
Non-production use is free. Production use is free up to 10,000,000 Billable
Tokens and 10,000 MCP Tool Calls per UTC calendar month. See
LICENSING.md
for the full terms, the tiering model, and the changeover to GPL-2.0-or-later.
Made with ❤️ for AI-native engineers and teams