# Cloak Watch

> Cloak Watch is a free Mac app that checks the packages, extensions, AI tools and startup items on your Mac for known attacks and fixes what it finds, locally.

Source: https://docs.subcloak.com/cloak-watch/

Cloak Watch is a free macOS app from Subcloak that answers one question: is this Mac affected by a new supply-chain attack? It reads everything a developer's Mac has installed, checks it on the Mac against a signed feed of known attacks, and helps you clean up when it finds something. It also shows what your AI tools and agents send where, if you turn that on.

*[Screenshot: Cloak Watch's main window: the sidebar with Home, Inbox, Feed, Inventory, AI Activity, Install Guard and Settings, and Home showing a teal hero with the headline Your Mac is clear, a round Scan button and five chips for Packages, Extensions, AI tools, Startup items and Keys. Home: one answer for the whole Mac, and one button.]*

## What it checks

Cloak Watch reads files and metadata. It never runs a package, a script, an MCP server or any project code to learn about it.

| Area | What Watch reads |
|---|---|
| Packages | Lockfiles and installed packages in your code folders (npm, pnpm, Yarn, Bun, PyPI, crates.io, Go, RubyGems, Packagist), global installs, Homebrew, and the npm, pnpm, Yarn, Bun, pip, uv, Cargo, Go and gem download caches |
| Editor extensions | VS Code, Cursor, Windsurf, VSCodium and other VS Code-based editors, and JetBrains IDEs |
| Browser extensions | Chrome, Brave, Edge, Arc, Vivaldi, Opera and other Chromium browsers, Firefox, and Safari (with Full Disk Access) |
| AI tools | MCP servers configured in Claude Code, Claude Desktop, Cursor, Windsurf, VS Code, Codex, Gemini CLI, Zed and others; agent settings and hooks; rules files such as `CLAUDE.md` and `AGENTS.md`; agent skills |
| Startup items | Launch agents and daemons, shell profiles, Git hooks and config, Python startup files, self-hosted GitHub Actions runners |
| Keys and tokens | Whether credential files exist (SSH keys, cloud, npm, GitHub and AI-tool logins), what kind of credential each holds, and keys left in plain-text files or in git history, always masked |
| Repositories | GitHub Actions workflows, Git remotes, Terraform state and package-manager settings in your local clones |
| Apps and tools | The versions of macOS, Safari and other browsers, editors, runtimes and developer tools, checked for flaws known to be exploited |
| Trust stores | The certificate authorities trusted by macOS, Homebrew, each Python certifi, Node, Electron apps and Java |
| Services | Which hosted services this Mac holds a login, token or config file for, without reading them |
| Homebrew and Docker (added in Cloak Watch 1.2.0) | Homebrew settings, taps and casks; Docker plugins, registry logins and hosts; and the images in each running container engine |
| Running programs (added in Cloak Watch 1.2.0) | Once a minute, programs running from places Mac stealers use; crypto-wallet apps' signatures; Apple's XProtect |
| Beyond this Mac (added in Cloak Watch 1.2.0) | The repositories, servers and accounts your configs name; the domains you add; and, once you connect it, your GitHub account |

The [Inventory](https://docs.subcloak.com/cloak-watch/inventory/) page lists every location, and the [detection catalogue](https://docs.subcloak.com/cloak-watch/detections/) lists every check. Every headline in the Feed gets an answer from [Check my Mac](https://docs.subcloak.com/cloak-watch/check-my-mac/): **This Mac is affected**, **Relevant to you**, **Not affected** or **Not checked**, with what to do.

## Promises

- **Local first.** Inventory, matching, events and secrets stay on your Mac. Watch downloads the signed feed and checks for updates; nothing about what's installed is uploaded, and there's no account. Anything else, such as checking a key, revoking a token or checking a domain, happens only when you ask, and never goes to Subcloak. See [what leaves your Mac](https://docs.subcloak.com/cloak-watch/settings/#what-leaves-your-mac).
- **Never runs what it inspects.** Packages, scripts, MCP servers and binaries are read, never executed.
- **Never deletes.** When Watch fixes something, it moves files to [Quarantine](https://docs.subcloak.com/cloak-watch/quarantine/) with a manifest, or keeps the original of a file it edits. You can put any of it back.
- **Quiet by default.** Only things that need fixing now notify you at once; things worth a look get at most one reminder a day. Unusual things worth a look that were already on your Mac when you started Watch stay quiet; anything that needs fixing now always alerts, from day one.
- **Detections are never paywalled.** Every check and every fix is free. A paid plan only makes warnings and Subcloak's incident packs arrive sooner. See [Plans and pricing](https://docs.subcloak.com/cloak-watch/plans/).

## Tour of Cloak Watch

The main window has a sidebar with these sections. Choose them from the **Watch** menu too, with <kbd>⌘</kbd> <kbd>1</kbd> to <kbd>⌘</kbd> <kbd>9</kbd>.

| Section | What it's for |
|---|---|
| **Home** | Whether this Mac is clear, and one button: **Scan**, or **Fix it** / **Fix all** when something needs fixing now. See [Home, Inbox and incidents](https://docs.subcloak.com/cloak-watch/inbox/#home). |
| **Inbox** | Everything Watch found, grouped by how urgent it is, with what happened and how to fix it. Fixed items move to History. **I Think I've Been Hit…** opens a step-by-step [incident plan](https://docs.subcloak.com/cloak-watch/respond/). |
| **Feed** | New attacks on developer tools as they're reported (**Live**), and write-ups of the big incidents (**Headlines**), each with **Check my Mac**. |
| **Inventory** | Everything Watch checks, in eleven tabs, with where each item lives. |
| **AI Activity** | Which apps and agents talk to AI services, what they sent, and Guard rules that stop secrets and risky tool calls. |
| **Install Guard** | Cooldowns that make package managers wait a few days before installing brand-new versions, and a check for a package name before you install it. |
| **Settings** | Code folders, watch mode, alerts, permissions, Quarantine, privacy and data. |
| **GitHub** (added in Cloak Watch 1.2.0) | Under **Beyond this Mac**: read-only checks of your GitHub repositories and account. Connecting is [coming soon](https://docs.subcloak.com/cloak-watch/github/). |
| **Domains** (added in Cloak Watch 1.2.0) | Under **Beyond this Mac**: certificate and DNS checks for the [domains you add](https://docs.subcloak.com/cloak-watch/domains/). |

Cloak Watch is a menu bar app first. Closing the window keeps it running in the [menu bar](https://docs.subcloak.com/cloak-watch/menu-bar/); the app shows in the Dock only while its window is open.

## What it isn't

Cloak Watch isn't an antivirus, a firewall or a vulnerability (CVE) scanner. It doesn't block programs from running or ask about connections. It looks for the developer-tool attacks that matter most: hijacked package versions, malicious extensions and MCP servers, and the hooks, background programs and startup files they leave behind. It flags a known flaw only when the flaw is being exploited and it's in macOS or an app or tool installed on the Mac, never in your projects' libraries.

## Get started

  - [Install Cloak Watch](https://docs.subcloak.com/cloak-watch/install/): Requirements, download, first launch and permissions.
  - [Home, Inbox and incidents](https://docs.subcloak.com/cloak-watch/inbox/): Read what Watch found and fix it.
  - [Detection catalogue](https://docs.subcloak.com/cloak-watch/detections/): Every check, its tier and how it avoids false alarms.
  - [Respond to an incident](https://docs.subcloak.com/cloak-watch/respond/): What to do when you think you've been hit.
  - [AI Activity](https://docs.subcloak.com/cloak-watch/ai-activity/): See what your AI tools send, and stop secrets leaving.