# Crowsnest

> Fast, lightweight task manager for AI-agent workstations — Claude Code / MCP sessions, live activity, token-cost estimates, a watchdog, and safe kill. Tauri + Rust + React.

- **Type:** MCP server
- **Install:** `agentstack add mcp-blakestone-x-crowsnest`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [blakestone-x](https://agentstack.voostack.com/s/blakestone-x)
- **Installs:** 0
- **Category:** [Integrations](https://agentstack.voostack.com/c/integrations)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [blakestone-x](https://github.com/blakestone-x)
- **Source:** https://github.com/blakestone-x/crowsnest

## Install

```sh
agentstack add mcp-blakestone-x-crowsnest
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Crowsnest

A lightweight task manager for AI-agent workstations. If your machine runs several
Claude Code sessions plus a crowd of MCP servers, the stock task manager tells you
nothing useful: every session is just another `claude.exe`. Crowsnest classifies the
agent ecosystem, shows what each session is doing and what it has spent in tokens,
ranks what's draining the machine, and can stop a runaway process without guessing.
Built with Tauri 2: a Rust backend on `sysinfo`, a React 19 + TypeScript frontend.

## What it does

- **Agents.** Each Claude Code session is a tile: model, effort, permission mode,
  live state (working / active / awaiting / idle), CPU/RAM rolled up across the
  session's whole process tree, a context meter that fills toward red as the session
  nears its context limit, an estimated dollar cost, and the MCP servers the session
  owns as nested rows. Session metadata is parsed from the command line (`--model`,
  `--effort`, `--permission-mode`, the embedded `--mcp-config`, working dir).
  MCPs that are configured but not running show as dashed chips.
- **Load.** Every process ranked by combined CPU and memory impact, with gradient
  impact bars, so you can see what's actually draining the machine.
- **Tree.** A virtualized, sortable process tree. Agent and MCP processes carry an
  accent spine. Pure-system subtrees collapse on first load; agent chains stay open.
  Filter with `/`.
- **Watchdog.** Three modes: `off`, `alert`, `auto-kill`. It detects sustained
  CPU/RAM overload, context drift, and stuck agents (CPU busy while the transcript
  goes stale). Auto-kill only fires on processes that stay critical past a kill
  window, never touches protected system processes or Crowsnest itself, and excludes
  agent sessions unless you opt in. The default is alert-only.
- **Security flags.** Masquerade (a system-named binary running from a non-system
  path), execution from Temp or Downloads, and UNC execution, surfaced as chips and
  alerts.
- **Kill.** Inline arm-in-row, no modal. End a single process or its whole descendant
  subtree. Kills verify PID identity (start time) first so a reused PID is never
  terminated by mistake, and access-denied or elevation failures surface honestly.
- **Cost model.** A deliberately small two-table design: an append-only usage fact
  log (`usage/usage-YYYY-MM.csv` in the data dir) joined against an editable pricing
  table (`data/model-pricing.csv` + `src/data/pricing.ts`), so costs can be re-rated
  later. An audit log records kills and critical alerts.
- **Comforts.** Light and dark themes (remembers your choice, follows the OS on first
  run), pin-on-top, start-on-boot, a frameless custom title bar.

Everything is read locally. Crowsnest makes no network calls.

## What the Rust side does

The Tauri backend (`src-tauri/`, ~2,200 lines) owns everything that touches the OS:

- **`monitor.rs`** builds one snapshot per poll: it enumerates processes via
  `sysinfo`, classifies the agent/MCP ecosystem by command-line signature, builds the
  parent-to-child tree, rolls CPU/RAM up to ancestors with cycle and orphan guards,
  parses session metadata, computes the security risk flags, and dedupes MCP servers
  to their subtree root. CPU is normalized to a share of the whole machine, like
  Task Manager.
- **The kill path** is defense-in-depth. `kill_process` refuses to terminate
  Crowsnest itself; `verify_identity` checks the process start time (with an
  image-name fallback) so a reused PID can't be killed; `assert_killable` blocks a
  protected-process list resolved from the live snapshot rather than trusted from
  the UI; `is_self_or_ancestor` refuses tree-kills of Crowsnest's own chain. Kills
  run through `taskkill`, `kill`, or `pkill` per platform and report failures as-is.
- **`agentlog.rs`** maps each session to its transcript JSONL under
  `~/.claude/projects/`, tail-reads the last 64 KiB to derive live state and current
  action, and accumulates lifetime token totals incrementally with an mtime/offset
  cache, so unchanged transcripts are never re-parsed.
- **`usage.rs`** writes the append-only usage and event CSVs, with escaping against
  CSV row-splitting and spreadsheet formula injection.
- **`autostart.rs`** handles start-on-boot per platform: HKCU Run key on Windows,
  LaunchAgent plist on macOS, XDG `.desktop` on Linux.
- **`lib.rs`** exposes the Tauri commands (`snapshot`, `process_details`,
  `kill_process`, window controls, usage logging) over one persistent `System`
  behind a `Mutex`, so CPU deltas stay accurate across polls.

The watchdog's decision logic (thresholds, sustained-overload detection, auto-kill
selection) is a pure TypeScript function in `src/lib/watchdog.ts`, run once per poll
in the frontend; when it decides to act, it calls the guarded Rust kill path. Cost
math and sparkline history also live in TypeScript. Rust owns enumeration,
classification, rollups, transcript parsing, and the kill itself.

## How agent / MCP detection works

Processes are classified by command-line signature. A Claude Code session is `claude`
running `--output-format stream-json --model ...`. MCP servers are recognized by
common server names (postgres, github, filesystem, playwright, slack, memory, fetch,
and so on) or the generic `@modelcontextprotocol` / `*-mcp` patterns, and attributed
to the session that launched them.

**Custom MCP labels.** To recognize servers Crowsnest doesn't know, or relabel ones
it does, drop an `mcp-labels.json` in the data dir (`%LOCALAPPDATA%\Crowsnest` on
Windows, `~/Library/Application Support/Crowsnest` on macOS, `~/.config/crowsnest`
on Linux). See [`mcp-labels.example.json`](mcp-labels.example.json):

```json
[{ "match": "my-server", "kind": "my-server", "label": "My Server MCP" }]
```

`match` is a case-insensitive substring of the process command line; the first match
wins. Loaded at startup (restart to apply). A malformed file is reported on stderr
and ignored.

## Cost estimates

Token costs are estimates from a small, editable price table using approximate public
list prices, with a separate row for the 1M-context premium tier. Treat all dollar
figures as estimates and edit `data/model-pricing.csv` / `src/data/pricing.ts` to
match your actual rates.

## Build and run

Prereqs: [Rust](https://rustup.rs) (stable), Node 18+, and the
[Tauri prerequisites](https://tauri.app/start/prerequisites/) for your OS.

```bash
npm install
npm run tauri dev      # native dev window with live data
npm run tauri build    # optimized release build + installer
```

The frontend also runs in a plain browser against a realistic mock snapshot, which is
handy for UI work without the native shell:

```bash
npm run dev            # then open http://localhost:1420
```

To verify the classifier against your live machine without the GUI:

```bash
cd src-tauri && cargo run --example snapshot
```

Tests: `npm test` runs the frontend suite (vitest, cost math), and `cargo test` in
`src-tauri` runs the Rust suite (classifier, flag parsing, risk flags). CI runs both.
The release profile is size-optimized (`lto`, `codegen-units = 1`, `opt-level = "s"`,
`strip`, `panic = "abort"`).

## Keyboard

| Key | Action |
|-----|--------|
| `1` / `2` / `3` | Switch view (Agents / Tree / Load) |
| `/` | Focus filter |
| `p` | Pause / resume polling |
| `Esc` | Clear filter / close detail drawer |

## Status and platform support

Version 0.1.0, early but functional, actively developed. Built and runtime-tested on
Windows 11, which is the primary platform. The macOS and Linux code paths are
implemented (process classification, kill, risk flags, autostart, the data dir, and
the transcript location) but not yet runtime-tested there. Issue reports and PRs are
welcome.

## Design

Styled as an engineering instrument: cold grounds, hairlines instead of boxes,
tabular monospace numerics that don't jitter, and color reserved for agent identity
and heat. Motion is gated to real change. The token system is in
`src/styles/tokens.css`.

## License

[MIT](LICENSE) © Blake Stone

## Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [blakestone-x](https://github.com/blakestone-x)
- **Source:** [blakestone-x/crowsnest](https://github.com/blakestone-x/crowsnest)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/mcp-blakestone-x-crowsnest
- Seller: https://agentstack.voostack.com/s/blakestone-x
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.