WATCH//FLOOR

Inspiration

I’m a security practitioner, and I keep seeing investigations reduced to an LLM summary. The summary helps, but it can leave the analyst a step away from the evidence. Meanwhile, people are building personal agent setups with their own models, memory, skills, and runbooks. I wanted a workbench where you could bring that agent into the case without giving it the final say.

What it does

WATCH//FLOOR is a visual WebMCP workbench for escalated cases. The agent runs approved skills, shows the exact KQL and raw records, and adds evidence to a live graph as it works. It can investigate, model impact, and prepare a response. Evidence sufficiency, restricted telemetry, response approval, and case closure stay with the analyst.

How we built it

I registered page tools with document.modelContext.registerTool and tied them to the current case and revision. Fixed KQL contracts stop the agent from quietly widening a query. The app is TypeScript and React on Cloudflare Workers with D1. It uses synthetic data and records response actions instead of contacting real systems. I used Codex to build and test it in a couple of days.

Challenges we ran into

The hard part was deciding what the agent should do and what must remain human. I also had to keep a growing graph readable and make real WebMCP activity easy to follow in a three-minute video.

What’s next for WATCH//FLOOR

Next I want to connect real SIEM, EDR, identity, and cloud data, add team policy around the gates, and make skill packs portable. Bring your own harness; keep authority with the analyst.