An SSH Bastion for LLMs and MCP Tools

What it does

ThinkWatch is a unified gateway that sits between your developers—and their agents—and upstream AI services. It proxies OpenAI, Anthropic, Gemini, Azure, and Bedrock requests on a single port while simultaneously acting as an MCP gateway for tools like GitHub, Notion, and Slack. A Rust-backed control plane and React admin console handle authentication, rate limits, cost tracking, and audit logging in one place.

The interesting bit

Most MCP proxies forward every request under a shared service account, rendering upstream audit logs useless. ThinkWatch propagates the real end-user identity—via OAuth tokens or PATs—so GitHub sees @octocat, not a generic bot. It also applies the same multi-window rate limits and token budgets to MCP tool calls that it uses for LLM requests, and caches per-user tool catalogs so scoped permissions never leak across accounts.

Key highlights

• Drop-in replacement for Cursor, Claude Code, and standard SDKs: serves OpenAI Chat Completions, Anthropic Messages, and OpenAI Responses APIs with automatic format conversion.
• Virtual tw- API keys can unlock both the AI gateway and the MCP gateway via a per-key surfaces allowlist.
• Per-user upstream credentials are AES-256-GCM encrypted; the system supports multi-account binding, race-free OAuth refresh via PostgreSQL advisory locks, and SSRF-hardened discovery probes.
• Pre-seeded MCP Store with 23+ curated templates and a generic client UX that surfaces authorization prompts instead of hiding tool catalogs.
• Full audit trail in ClickHouse covering every model request and tool invocation, down to parameters, latency, and error codes.

Verdict

Organizations already struggling with API key sprawl, unexplained AI bills, or compliance auditors asking “who called what” should look here. Solo developers who just want to hit an endpoint directly can safely skip it.