Beyond this Mac
Footprint
New in 1.2.0 Requires Cloak Watch 1.2.0 or later.
Cloak Watch's Footprint tab lists the repositories, domains, servers, clusters, cloud accounts and registries your Mac's config files name, read without contacting any of them.
A stolen laptop key reaches more than the laptop: the repositories you push to, the servers you SSH into, the clusters and cloud accounts your configs name. Footprint, a tab in Inventory, lists them, so after an incident you know what else to check and which keys to rotate. Watch reads names only, from config files, never a token or password, and it contacts none of them.
What it lists
Section titled “What it lists”Columns: Name, Type, Provider, Found in, Where.
| Type | Where Watch looks |
|---|---|
| Repository | Git remotes in .git/config in your code folders: GitHub, GitLab, Bitbucket, Codeberg and Azure DevOps. A user name or token in a remote URL is dropped (and still flagged by REPO-8). |
| Domain | Cloudflare wrangler.toml and wrangler.json routes and zones, Fly.io fly.toml (<app>.fly.dev), and GitHub Pages CNAME files |
| Server | Hosts in ~/.ssh/config and files it includes (never ProxyCommand or Match exec), ~/.ssh/known_hosts (hashed lines can’t be read), and remote Docker contexts |
| Cluster | Cluster names and API servers in your kubeconfig. The users section, with its tokens, is skipped. Local clusters aren’t listed. |
| Cloud account | AWS account IDs and profiles in ~/.aws/config (never ~/.aws/credentials), Google Cloud projects, Azure subscriptions, Heroku apps, Cloudflare Workers, Fly.io apps, Vercel and Netlify projects, and Firebase projects |
| Registry | Private npm registries in .npmrc, Docker registries you’re logged in to (host names only), and private Python indexes in pip.conf and uv.toml |
Found in says which file or setting named it, such as git remote origin or ssh config.
What you can do from it
Section titled “What you can do from it”Select a row. The inspector’s Beyond this Mac section says what Watch can do with it:
| Row | Inspector |
|---|---|
| A GitHub repository | Check it on GitHub, read-only, through GitHub: Connect GitHub…, or Show in GitHub once connected. Until connecting GitHub is available, you can’t connect from here; Watch keeps checking the workflows and lockfiles in the clone on this Mac. |
| A domain | Check This Domain… adds it to Domains, which checks its certificate and DNS once a day, or Show in Domains once it’s added |
| Anything else | “Watch only lists it. It doesn’t connect to servers, clusters or cloud accounts.” |
From Terminal
Section titled “From Terminal”watchctl footprint prints the same list, and watchctl footprint --counts a count by type and provider. See watchctl footprint.