Cloak Watchfor Mac · by Subcloak

Is your Mac affected? Know in seconds.

Cloak Watch checks everything installed on your Mac against new supply-chain attacks, tells you in plain words, and fixes what it finds in one click. Free, and nothing leaves your Mac.

Join the waitlist See how it works

Free · 1.0 coming soon · macOS 14 or later · No account

Checks

npm · PyPI · crates.io · Go · RubyGems · Packagist · Homebrew · VS Code · Open VSX · Chrome · Firefox · MCP · Claude Code · Cursor · Codex

Against

OSV · GitHub advisories · VS Code Marketplace · MCP Registry · Subcloak Headlines

Promises

Never deletes
Never runs your code
No account

01 · An ordinary afternoon

A package you trust turns on you.

This is how a typical worm reaches a developer's Mac.

2:05 PM
An account is taken over
Someone takes over the npm account behind quickcache-utils-demo and publishes 6.0.0, with a hidden install script.
2:22 PM
You run npm install
In shopapp, like any other afternoon. The script runs as you, with everything you can reach.
Seconds later
It moves in
It collects your GitHub and npm tokens, adds a Claude Code hook, and leaves a background program that wipes your home folder if a token is revoked.
5:40 PM
npm pulls the version
The bad release is gone from the registry. What it left on your Mac is still there, and nothing tells you.
With Cloak Watch
Affected: yes. Fix it.
When the feed lists the release, Watch finds every trace on your Mac and gives you the safe order to clean up.

02 · Watch tells you

Affected or not, in plain words.

When the feed brings a new attack, Watch checks it against everything on your Mac, right there on your Mac. If you're affected, you get one notification and a page that says what happened and what it means for you.

Yes or no, because: Where it found it, which version, and whether it arrived while the bad release was live.
Sources, linked: The GitHub advisory, the OSV record and the researchers' write-up, one click away.
Quiet otherwise: Only things to fix now notify you. Everything else waits in the Inbox.

An incident page in Cloak Watch: “A malicious version of quickcache-utils-demo is on this Mac”, a red Fix It button (“Watch does 4 things, and shows you first”), What happened in plain words with links to a research write-up, the GitHub advisory and the OSV record, What this means for you, and three steps to do yourself

Cloak Watch's menu bar window: two things to fix now, with Fix All

What it looks at

Everywhere an attack hides, read, never run.

Packages and caches: Lockfiles, node_modules, global installs and caches for npm, pnpm, Yarn and Bun; Python, Cargo, Go, RubyGems, Composer and Homebrew.
Editor and browser extensions: VS Code, Cursor, Windsurf and other VS Code–based editors; Chrome, Brave, Edge, Arc, Firefox and more.
MCP servers and agent configs: Claude Code, Claude Desktop, Cursor, Codex, Gemini CLI, Zed and others, including base-URL overrides and broad allow rules.
Skills and hooks: Agent skills, Claude Code hooks and files like CLAUDE.md and AGENTS.md, in your home folder and in every repo.
Startup items: Launch agents and daemons, shell profiles, Git hooks and Python startup files: where malware stays once the package is gone.
Keys in plain text: Tokens left in .env files, dotfiles and MCP configs. Masked the moment they're found, never stored.

Inventory: packages grouped by project and cache with version, status, ecosystem and first seen; the malicious quickcache-utils-demo 6.0.0 is selected and the inspector shows where it is, its install script and how to fix it

03 · One click fixes it

Fix it. Undo any of it.

Fix it shows exactly what it will do, in order, before anything changes. Background programs stop first, so nothing reacts when you replace a token. On Home, Fix all does every fix at once.

Quarantine, never delete. Files move to Watch's Quarantine, and edited configs keep their original.
Undo every step. Settings › Quarantine puts anything back, and Watch checks it again.
Your steps, with links. What only you can do, like replacing a GitHub token, opens the right page.

The Fix it sheet before it runs: Watch will stop the background program com.user.gh-token-monitor, remove the SessionStart hook from shopapp's Claude Code settings, and move the package and the npm cache to Quarantine; afterwards you reinstall from a clean lockfile and replace your GitHub and npm tokens

04 · Stay ahead

Read about it before it reaches you.

The Feed tab is the news for your toolchain. Every story and every listing has Check my Mac, and anything that affects you rises to the top.

Headlines

The few big incidents each week, written up properly: what happened, who's affected, how to check and what to do. Written from public reports, published only after automated checks against at least two independent sources, with every source linked. Soon on the web too, at headlines.subcloak.com.

Every 10 minutes: OSV's malicious-package records, GitHub's malware advisories, VS Code Marketplace removals and the MCP Registry.
About 287,000: Known-bad package versions, matched on your Mac. About 3.7 MB the first time, then only changes.
Signed: Checked against a key built into the app. Old or altered data is refused.

05 · Your AI agents · optional

See what your agents send, and stop what shouldn't leave.

Every prompt, model request and tool call from Claude Code, Cursor, Codex and more, with secrets highlighted. Guard rules can redact a key before it reaches a model, or block or ask before a risky command. It all stays on your Mac.

AI Activity: a Claude Code session in ShopApp, with model requests, a prompt blocked because it held a GitHub token, an rm -rf that Watch asked about, a blocked read of ~/.ssh, and a model request where two secrets from .env were redacted before sending — A Claude Code session, event by event. Two keys from a .env file were replaced with [REDACTED] before the request left.

06 · Private by design

It runs on your Mac. Nothing about your Mac leaves it.

01
Local first
The inventory, the matching and every finding stay on your Mac. Nothing is sent to be checked.
02
Reads, never runs
It reads files and metadata. It never runs a package manager, a script or an MCP server to learn about them.
03
Never deletes
Fixes quarantine and unload. Everything can be put back, and keys are never shown in full.
04
Never paywalled
Every detection is free. The live feed only buys speed.

What leaves your Mac

The whole list, not the highlights.

No account, no sign-in, no analytics in the app. Privacy policy

Not an antivirus
Not a firewall
Not a CVE scanner

What	Sends	Never sends
The feed	Downloads of signed, static files. Our host, Cloudflare, sees your IP address and the time.	Your inventory, paths, package names or prompts
Update check	A request for the latest version number, at launch and once a day. Our host sees your IP address and the time.	Anything about your Mac
Live feed plan	Your licence key and a random install ID, when you activate and when it renews.	Anything about your Mac
Feed health	Off unless you turn it on: feed delay and error codes.	Everything else
AI Activity	Nothing. Events stay on your Mac, with secrets masked before they're stored.	Prompts, files, commands

07 · Free

Free does everything. The live feed buys minutes.

Every check, every detection and every fix is free, for good. Later, an optional live feed gets Subcloak's incident packs to your Mac within minutes instead of a day later.

Cloak Watch

$0for good

The whole app. No key, no account.

Every check, every detection, watching around the clock
Fix it, Fix all, Quarantine and Undo
The Feed: Live and Headlines
AI Activity and Guard rules
Install Guard cooldowns for npm, pnpm, Yarn, Bun, uv and pip
Subcloak's incident packs a day after they're published

Join the waitlist

Live feed Later · November 2026

$18a year

$15 for your first year if you join early. 14 days free to try, no card, no account.

Everything in Free
Subcloak's incident packs within minutes, not a day later
Early warnings about suspected packages
Up to 3 Macs on one key, still no account

Prices in US dollars, plus local tax where it applies. Paddle is our reseller. 30-day refunds. Terms

FAQ

Questions, answered.

Something else? Email hello@subcloak.com or book a call.

When can I get it?

Cloak Watch 1.0 is almost ready. Join the waitlist and we'll email you once, the day it's out. It's free and needs macOS 14 Sonoma or later.

Is it really free? What would I pay for?

Every check, every detection and every fix is free, for good. Detections are never behind a paywall. The optional live feed, planned for November 2026, pays for speed: Subcloak's incident packs within minutes instead of a day later, for $18 a year ($15 for your first year if you join early), with a 14-day trial with no card or account. Subcloak is a security testing company; our testing work pays for the rest.

Does it upload my code or what I have installed?

No. The inventory, the matching, AI Activity and any keys it finds stay on your Mac. The app downloads the signed feed and, if you buy the live feed, exchanges a licence key. No account, and no telemetry unless you turn on feed-health reports. See what leaves your Mac.

What does Fix it actually do?

It shows the plan first: each step, in order, before anything changes. Then it stops background programs, removes a bad hook or MCP entry from its config (keeping the original), and moves files into Cloak Watch's Quarantine. Every step has Undo, and Settings › Quarantine puts anything back. It never deletes, and it never runs npm or pip for you. Steps only you can do, like replacing a token, come with a link to the right page.

Where does the threat data come from?

The feed checks the OSV database's malicious-package records, GitHub's malware advisories, VS Code Marketplace removals and the MCP Registry every 10 minutes, and signs what it publishes; the app checks the signature against a key built into it. Headlines are written from public reports and published only after automated checks: at least two independent sources, including a primary one, and every indicator taken word for word from a primary source. Every source is linked.

Does it need Full Disk Access or a system extension?

No. The first scan reads the code folders you pick. Full Disk Access only fills named gaps, like Safari's extensions. The network extension and the connections to Claude Code, Cursor and Codex are optional, and every config change is shown to you as a diff first, with Undo.

Will it slow down my Mac?

It isn't built like an antivirus: it doesn't check every file your tools open or block programs from starting. It reads files when they change and matches them against a list on your Mac. If the optional network extension stops, your network keeps working.

How is it different from Cloak Proxy?

Cloak Proxy is a free debugging proxy for looking inside your apps' traffic. Cloak Watch protects the Mac you build on. They're separate apps from the same team, and you can run both.

Know before it's a headline.

Cloak Watch 1.0 is almost ready. Free, for macOS 14 Sonoma or later. Leave your email and we'll send one message, the day it's out. Meanwhile, Cloak Proxy is free today.

Get Cloak Watch 1.0

Free. No account, no payment.

One email when Cloak Watch 1.0 is out, nothing else. Privacy