Reference
Security model and FAQ
How Cloak Watch protects your Mac and your data, what it trusts, what it can't catch, and answers to common questions about privacy, cost and performance.
A tool that reads everything on your Mac has to be safe itself. This page explains what Cloak Watch can touch, what it trusts, where its limits are, and answers common questions.
What Watch can touch
Section titled “What Watch can touch”| Action | Rule |
|---|---|
| Reading | Watch reads files in your home folder, your code folders and system folders such as /Library/LaunchAgents, with size limits on every file. It never follows symbolic links while scanning. Full Disk Access is optional. |
| Running programs | Watch never runs what it inspects: no package managers, scripts, MCP servers, project code or binaries. The programs it starts are macOS’s own: launchctl, to stop a malicious background program, when you click Fix It; pluginkit, to list Safari extensions; and log, to see when XProtect Remediator last ran, only when you click Check in I think I’ve been hit. It also asks each running container engine for its image list, over the engine’s local socket. |
| Stopping programs | Only when you click Stop… and confirm, in I think I’ve been hit. Watch sends the normal quit signal, only to a program running as you, after checking it’s still the one it found. |
| Changing files | Only after you click Fix It, Apply or Put Back, and always after showing you the change. Fix it only moves files into Quarantine or removes one entry from a config file, keeping the original. It refuses paths outside your home folder and a few system folders, and never moves your ~/.ssh, Keychains, Documents or Desktop folders. |
| Deleting | Never. |
| Your secrets | Values are never shown in full, logged, stored or exported. Watch keeps a type, a masked form, the path and line, and a fingerprint made with a key only this Mac has. Credential files are checked for presence and kind; their contents aren’t kept. A key leaves the Mac only when you click Check or Revoke on it, and only to its issuer, GitHub’s revoke service or GitGuardian, never to Subcloak. |
What Watch trusts
Section titled “What Watch trusts”The feed, only once it’s verified. Every file Watch downloads is checked against Subcloak’s root keys built into the app, with protection against old or mixed copies; see How the feed is signed and verified. Watch also checks every incident pack against its own safety rules before using it. Feed data can make Watch flag something, but a pack can’t make Watch delete anything, change files outside the paths above, or skip a step’s confirmation. A stolen signing key could at worst raise false alarms; it couldn’t silence a detection on your Mac.
Remote switches only within limits. The signed feed’s configuration can turn off the AI gateway, the network extension or automatic fixes if one has a problem, and ask you to update. It can’t turn off a detection or the Inbox, and it can’t make Watch change anything on your Mac.
Not your projects. A malicious repository controls its own files, so nothing in a project changes how Watch behaves. Watch parses project files with size limits and treats their contents as data.
Only this Mac, for its local servers. AI Activity’s receiver (127.0.0.1:47318) and gateway (127.0.0.1:47319) listen on this Mac only and refuse requests from web pages. The receiver also needs a private token that Watch writes into the tool settings it connects.
How Watch keeps checking
Section titled “How Watch keeps checking”- Live watching. With Watch for changes as they happen on (the default, in Settings › General), Watch follows file changes in your code folders, global package folders, download caches, launch agents and daemons, shell profiles, editor extensions, AI agent and MCP configs, and from 1.2 the folders that hold Python startup files, credential files and wallet apps. After a burst of changes settles, it rechecks only what changed: a known-bad install becomes a Fix now incident in about a second. It ignores Git internals, build output and your exclusions, and rechecks busy download caches at most every 10 minutes.
- Running programs, once a minute, with Check running programs on. See Watch mode.
- A full scan every day, while the Mac is idle and on power, and after waking if the last full scan is more than a day old. A quiet scan also runs about 90 seconds after launch.
- Feed changes are matched against what Watch already knows about your Mac at once, without reading the disk again.
- Pause holds changes back; Watch checks them when the pause ends.
All of this happens on your Mac. Nothing about the changes is sent anywhere.
What the network extension does
Section titled “What the network extension does”The network extension takes only connections to known AI providers, relays them unchanged and records metadata. It never decrypts, installs no certificate, and passes everything else through. From 1.2 it also notes which program opens each outgoing web connection and where it goes, to raise network alerts; it keeps a record only of the connections that match. If it fails, connections go direct.
AI Activity content
Section titled “AI Activity content”When you connect a tool with hooks or the gateway, Watch keeps what it sends and receives on your Mac for 7 days by default, with secrets masked first. That content can include code, file contents and commands. It never leaves your Mac, but anyone with your user account can read it. Turn content off per project or entirely in the content settings, and use Delete All Activity… when you’re done.
What Watch can’t catch
Section titled “What Watch can’t catch”- It isn’t an antivirus or EDR. It looks for attacks on developer tools, not malware in general, and it doesn’t block programs from running.
- It finds installs after they happen. Install scripts have already run by the time a malicious version is on disk. Watch’s job is to say whether you were affected and clean up what was left; a cooldown is what keeps most bad versions off in the first place.
- It sees changes, and checks programs once a minute. Watch notices files appearing and changing within seconds, but only while it’s running and not paused, and an install script has already run by then. Watch mode looks at running programs once a minute, so one that starts and stops in between isn’t seen.
- It doesn’t see general network traffic. Connections are seen only with the optional network extension, and only who connected where. Short-lived processes and Keychain access aren’t visible without Apple’s Endpoint Security entitlement, which Subcloak has requested.
- It can’t know about an attack nobody has reported unless a built-in check recognizes its shape.
Report a security problem
Section titled “Report a security problem”Found a vulnerability in Cloak Watch? See subcloak.com/security for how to report it.
Is Cloak Watch free?
Section titled “Is Cloak Watch free?”Yes. Every check, every fix and AI Activity are free, with no account. A paid plan only gets Subcloak’s incident packs to your Mac within minutes instead of a day later. See Plans and pricing.
Does it upload my inventory or code?
Section titled “Does it upload my inventory or code?”No. Matching happens on your Mac. Watch downloads the signed feed, which is the same for everyone, and checks once a day for a new version; neither sends anything about what you have. See what leaves your Mac.
Why didn’t Watch tell me about something that was already there?
Section titled “Why didn’t Watch tell me about something that was already there?”On the first scan Watch records a starting point. Unusual things already present that are only worth a look or good to know stay quiet, so you aren’t buried in alerts on day one. Anything that needs fixing now always alerts, on day one too, and so does every feed match. Everything is still listed in Inventory, where items from the starting point show a dash in Status. The starting point’s date is in Settings › Advanced.
Will it slow down my builds?
Section titled “Will it slow down my builds?”Watch doesn’t hook into file access or process launches. It’s told when files change and rechecks only those, waiting for a burst such as npm install to settle first. The daily full scan reads files at background priority, while the Mac is idle and on power. The network extension only touches connections to AI providers.
Does it run npm or other package managers?
Section titled “Does it run npm or other package managers?”Never. It reads lockfiles and package folders directly. Steps such as reinstalling from a clean lockfile are for you to run.
Does it work offline?
Section titled “Does it work offline?”Yes. Without a connection Watch keeps matching against the last verified copy of the feed, and AI Activity works entirely on your Mac.
Can I use it with Cloak Proxy?
Section titled “Can I use it with Cloak Proxy?”Yes. They’re separate apps. If both of their network extensions are on, Cloak Proxy’s App Capture takes the AI traffic of the apps it captures; see Use it with Cloak Proxy’s App Capture.
Is it on Linux or Windows?
Section titled “Is it on Linux or Windows?”No, Cloak Watch is a Mac app, for macOS 14 or later.
Can my AI assistant ask Cloak Watch questions?
Section titled “Can my AI assistant ask Cloak Watch questions?”Not in 1.0. There’s no MCP server for Cloak Watch yet.