Fortitude Group has released Omnis Watchtower, a supply-chain security tool designed specifically for Claude Code agents. The plugin acts as a pre-execution tripwire, intercepting every npm and PyPI installation attempt before the agent runs the command. It addresses a critical vulnerability in autonomous coding: agents often install packages without human review, making them susceptible to typosquats, non-existent package names, and freshly published malware.

The Sentinel Protocol

Watchtower doesn't just block; it investigates. When a package is suspicious but inconclusive, the tool deploys a Sentinel, a hidden, read-only subagent that analyzes the registry page, repository, and install scripts. This allows the primary agent to continue working while the Sentinel returns a verdict. If the verdict is negative upon retry, the install is refused. For brand-new releases of popular packages, Watchtower enforces a 72-hour cooldown, pinning installs to the previous stable version to mitigate hijacked release risks.

Measured Performance and Privacy

The team claims zero runtime dependencies, a significant feat for a supply-chain tool. Validation sweeps against the top 500 npm and PyPI packages showed 998 passed, 2 held, and 0 refused. Median decision time sits at 468 ms for new packages, dropping to effectively instant from cache. Privacy is handled by querying only public registries and OSV for the specific packages in question. Private packages are excluded from public scoring unless a name collision check is required to catch dependency confusion attacks.

Visualizing the Fleet

The interface is a nod to hacker culture, featuring a demoscene-style radar in the terminal. Agents orbit the ring, and packages turn green, amber, or red as they are processed. Users can switch between a radar theme and a cracktro theme with copper bars. The tool requires Claude Code 2.1.296 or later and is installed via the plugin marketplace. It currently supports npm and PyPI, with other ecosystems like Cargo and Go listed as future targets.

Key Takeaways

  • Watchtower enforces a 72-hour cooldown on new package releases to prevent hijack exploits.
  • A hidden Sentinel subagent performs deep scans on suspicious packages without blocking agent workflow.
  • The tool has zero runtime dependencies and validated 998 of 1,000 top packages without refusals.
  • Human-only commands prevent agents from self-unblocking refused installs.

The Bottom Line

This is the guardrail autonomous coding desperately needed. By treating agent installs as untrusted input and adding a visual, interactive layer of defense, Fortitude Group has turned supply-chain security from a background headache into a tangible, controllable process.

Technical Notes

Watchtower is not a sandbox; it decides if an install should run but does not isolate the execution. For deeper analysis, the sister project PoisonBox runs install scripts in throwaway microVMs. The current version is terminal-only, with the renderer architecture prepared for future desktop support. Agents cannot override blocks or allowlists; only humans can type the /watchtower allow or block commands at the prompt.