Flowlight Brings AI Agent Network Monitoring and Controls to macOS

Summary

Flowlight is a free, GPL-3.0 network-monitoring application for macOS 15 and later that attributes TCP and UDP activity to applications, command-line tools, background services, and recognized AI-agent child processes. It records destinations, protocols, hostnames when available, and byte counts in a local SQLite file, with views covering live activity, historical reports, alerts, rules, natural-language queries, devices, and optional inspection. The AI Agents view recognizes 16 agents by name and classifies other non-browser processes that contact 27 known LLM API providers; supported names include Claude Code, Codex, Cursor, Gemini CLI, Aider, Goose, OpenCode, Ollama, LM Studio, ChatGPT, Claude, Zed, Perplexity, and ZCode. Users can create allowlists and refuse connections through the macOS Network Extension, or block an MCP server, tool, or resource so it is removed from an agent's declared tool list. HTTPS inspection is separate and opt-in: for routed agents, Flowlight can decrypt supported traffic locally, correlate model-requested tool calls with their network requests, and show request bodies, results, headers, and model or token information. The product also flags sensitive channels, possible uploads to non-AI hosts, unnamed hosts, new destinations, and activity while the user is away. Coverage includes 108 protocols, but ICMP, other raw-IP protocols, some system traffic, and individual tool calls inside long-running MCP servers may remain outside its visibility. Flowlight says it sends no telemetry, keeps metadata and inspection data on the Mac, and can optionally query Team Cymru only for public IP ownership. It is available as a signed and notarized download, Homebrew cask, or source build; the current page identifies version 0.9.6 and macOS 15+ support.