Argus

A native macOS menu bar app that shows what your Mac is doing: what talks to the network, what runs, what starts by itself, what macOS allowed or stopped, and what fills the disk, joined together in plain words.

Features

• Network: every connection by app or by destination, with live rates, totals and a thirty-day history that answers "who caused this peak?".
• Activity: apps and processes with CPU, memory, energy and disk writes; every program started, short-lived ones included; macOS's own record of privacy decisions, Gatekeeper verdicts and admin rights.
• Startup: launch agents and daemons, login items, extensions, scheduled jobs and shell startup files, with who signed each one.
• Disk: Disk Tree Mac, a fast treemap of what fills the disk, with safe removal.
• Find: files by name from a live index, by content, or by meaning ("beach at sunset" finds the photo). Off until you turn it on.
• Palette (⌥Space): search everything Argus knows and run its tools: clipboard history, snippets, window management, an uninstaller, and more.
• Why? on any row: what caused it, what it led to, and what else happened in the same minute.

Signatures are described, never judged: no "safe", no "malware", no score.

What it can't do

Argus watches and never blocks. Holding or refusing a connection takes a network extension, and macOS grants that only to apps signed by a paid Apple developer account. Argus is built to run with a free one, so its rules are expectations: a connection they don't expect becomes a finding, and still goes ahead. Some things macOS hides from unprivileged apps (the names apps looked up, Apple's QUIC traffic, other accounts' command lines); Argus lists its blind spots on screen.

Requirements

• Apple silicon, macOS 15 or later
• Xcode 26, or its Command Line Tools
• cmake (brew install cmake), to build llama.cpp for the meaning model's helper

Build and run

make argus          # build and sign build/Argus.app
make run-argus      # build, then open it
make install-argus  # copy it to ~/Applications
make run            # Disk Tree Mac on its own

The first build clones llama.cpp and downloads the map data, each pinned and checked by SHA-256. The build signs with your first Apple Development identity, or ad hoc without one (SIGN_IDENTITY overrides); see Scripts/bundle.sh.

Privacy

• Everything stays on your Mac: no telemetry, no update checks, no account.
• On its own, Argus only looks up reverse names for the addresses your Mac talks to, through your DNS server (Settings › Names turns it off). The meaning model's download, currency rates and AI chat are each off until you turn them on.
• The history (thirty days or 200 MB) lives in ~/Library/Application Support/Argus/, readable only by you.
• It never asks for a permission on its own and changes nothing unless you start the action.

Develop

make lint   # build everything, tests included, with warnings as errors
make test   # run the tests

During development, don't launch the app bare: draw any view of the demo data into a PNG instead, without screen recording or the real history.

open -n -W build/Argus.app --args --snapshot /tmp/network.png --section network

LaunchOptions in Sources/ArgusUI/App.swift lists every flag, and argusctl runs the engine without the app. The design notes are in docs/: docs/argus/PLAN.md for Argus, docs/PLAN.md for Disk Tree Mac, and the research beside them.

License and credits

MIT, see LICENSE. Disk Tree Mac began as a rebuild of tobi/disktree. Argus ports code and ideas from DigUp, fsearch, TraceAnalysis and Rooms; features inspired by Tinycast are re-implemented without its code. It builds on llama.cpp, with Google's EmbeddingGemma downloaded on request, and on map data from DB-IP and Natural Earth. See THIRD-PARTY-NOTICES.md.