Streptococcus thermophilus
Stores a snippet of each virus it survives, then cuts that virus on sight.
→
Memory. A replayed attack is a test the detector must pass.
Barrangou et al. · Science · 2007
Artificial Immunity. Know fast. Recover fast.
An immune system for the Mac where your AI agents work. When something gets in, it tells you what could have leaked and which keys to change.
Read-only · 2 min · nothing sent
Paste into Claude Code, Cursor or Codex. Or get it by email
Event log simulated
Why now
Your agents ship faster than you can read. With your keys.
Antivirus looks for known malware; your agents run code nobody has read. Big companies have security teams for that. This is that layer, for one Mac.
- A poisoned package
Your agent installed it. You pressed Enter.
- A leaked key
It turns into a bill. The spending limit kicks in late.
- A take-home repo
The interview test you cloned and ran was a stealer.
- The morning after
Nobody can tell you what leaked or which keys to change.
What you see
Quiet until it matters.
Every alert is a cost. Only what is bad and certain reaches you.
- Homeostasis most days
A menu bar icon and one line: is the Mac watched, is it quiet.
- Symptom rarely
One finding as a card. Answer “expected” or “seen”.
- Fever when it's real
A notification, a verdict, and a list of what could have leaked.
You decide. Nothing irreversible happens without you.
This Mac is watched in part. Nothing needs you.
Checked 12 minutes ago · watched live
Check now
Details
Quit
A project you just cloned has an editor task that runs when the folder opens.
.vscode/tasks.json
If you didn't expect it, read the task before you open the folder again.
Why
Editor tasks with runOn: folderOpen start code the moment the folder opens.
Example data.
Borrowed from biology
Three billion years of field-tested defense.
Life never found an unbreakable shell. It evolved layers.
Mammalian cells
Raises the alarm when DNA turns up in the cytosol, where it doesn't belong.
→
Context decides. An interpreter that detaches and keeps a connection open is a flag.
Civril et al. · Nature · 2013
Homo sapiens
Regulatory T cells stop the body from attacking itself. Nobel Prize, 2025.
→
No autoimmunity. Weak rule matches are counted, not shown.
Nobel Assembly · 2025
Anatomy of an immune response
A repo from a stranger, start to finish.
You clone a project to take a look.
-
01 Infection
It carries an editor task set to run the moment the folder opens.
.vscode/tasks.json
runOn: folderOpen -
02 Recognition
Rules flag it within seconds. A theft can be faster than that.
FLAG · rules only
models involved: 0 -
03 Fever
A notification, then three model steps give a verdict. Secret values are cut out first.
verdict: three model steps
secrets: cut before sending -
04 Recovery
A list: what could have leaked, where to revoke it. You do the fixing.
could have leaked: 3 keys
status: proposed -
05 Memory
The whole attack, replayed, is a test every step must pass.
replay: finding at every step
Open core
An open detection core. A paid response layer.
The core that watches your Mac is open source and free. The layer that explains a case is paid.
Host You
Read the status, answer rare findings, decide.
↑ notification · verdict · list
Adaptive · paid · soon Response
Explains a case, tells you what to change. Closed source.
Will include
- Three-step verdict
- What-could-leak list
- macOS notification
- Offline alarm
↑ flags and findings
Innate · open and free Detection core
Deterministic rules, running on your Mac.
Watches
- Claude Code
- Cursor
- Codex
- MCP servers
- VS Code tasks
- git hooks
- package scripts
Every program start
198 published macOS rules, from SigmaHQ and Elastic, check every program start and new file.
What runs by itself
Places where code starts on its own.
Poisoned dependencies
Checks npm, pnpm and Cargo lockfiles against OSV and CISA KEV.
Includes
- Menu bar panel
- Expected / seen answers
- Hand-off to your agent
- Replayed-attack test
- Editor extensions
Downloads public vulnerability lists, nothing else.
- No model in the detection core.
- The paid layer sends a redacted case summary to our server, which calls models. Secret values stay on your Mac.
- “Docker or a VM is enough.” A sandbox limits the damage; it doesn't tell you what could have leaked.
- “A tool with root is a hole itself.” That's why the core is open source and sends nothing off your Mac.
Get started
Get the first dose.
Leave your email. We'll send you the setup steps.