Nick
Open Sourcev1.0 ReleasedOpen-source macOS security suite with six detection layers and on-device AI behavioral threat scoring
Context
macOS ships with XProtect, Gatekeeper, and SIP — all signature-based defences that catch known threats after the fact. For developers, sysadmins, and privacy-conscious users this leaves a wide gap: behavioural threats that abuse signed Apple binaries, persistence dropped by compromised installers, and multi-signal attack sequences that only become critical when correlated across monitors.
Problem
Existing macOS security tools either cost $60+/year, require running five or six separate utilities with no unified view, or are enterprise-grade products far beyond what individual users can operate. There was no free, open-source, on-device-AI-powered security suite that replaced all of them in a single native app.
Constraints
- —All inference must run on-device — no cloud dependency, no telemetry, no accounts
- —Under 1% CPU and 50 MB RAM in steady state — must not affect daily workflows
- —AGPL-3.0 licence — every line of code must be publicly auditable on GitHub
- —Six independent detection layers must correlate signals without introducing false positives at idle
Solution
- •Built six detection layers in a single native SwiftUI app: System Integrity Audit, Persistence Monitor (FSEvents), Network Watchdog, Process Auditor, YARA Scanner, and Camera & Mic Sentinel
- •Designed a ThreatCorrelator with a 30-second sliding window across all monitors, feeding a CoreML model for a 0–1 behavioural threat score
- •Integrated Foundation Models to generate plain-English alert explanations — no cloud call, no human-written rule translations required
- •Released under AGPL-3.0 on GitHub — free forever, fully auditable, community-extensible
Outcome
v1.0 shipped on GitHub under AGPL-3.0. Replaces BlockBlock, LuLu, KnockKnock, and OverSight in a single native app. CoreML inference runs at under 1% CPU in steady state. Foundation Models generates alert explanations without any network call. The only free, open-source macOS security suite with on-device AI behavioural scoring.
The design premise: every alert must be explainable in plain English, with every inference decision auditable down to the model weights.
Technical Highlights
- →FSEvents-based Persistence Monitor watching all LaunchAgent and LaunchDaemon directories in real time
- →libyara + CoreML heuristics for YARA scanning — no cloud signature updates required
- →Network Watchdog: reverse shell and SSH tunnel detection via outbound connection pattern analysis
- →Foundation Models on-device LLM for alert explanations — zero tokens leave the Mac