Know the moment your Mac changes.
Nightlatch: a security-change diary for your Mac — not another 'protected!' app. It records your Mac’s security baseline and tells you the moment something drifts — a new LaunchAgent, a remote-access toggle, a new listening port.
$19 founding-user price (goes to $29 after the first 150 licenses) · Notarized · zero telemetry · nothing to quarantine
Your Mac changed. Did you notice?
Coding agents, terminal automation, and always-on developer Macs are a new kind of attack surface. In July 2026 alone, a fake “Claude Code installer” ad delivered an infostealer that persisted through a disguised LaunchAgent — the exact category of change most people never look for. Nightlatch watches for it continuously, and tells you in plain English when it happens.
Baseline. Watch. Review.
First launch records your Mac’s current security-relevant state — persistence items, remote access settings, listening ports, security posture.
Nightlatch rescans automatically every few minutes and on demand, comparing against your clean baseline.
Changes appear as a readable timeline. Mark reviewed, export a redacted report, move on.
Multi-domain drift, in plain English.
- New or changed LaunchAgents, LaunchDaemons, and login items
- Remote Login, Screen Sharing, and Remote Management toggles
- New inbound network listeners
- Proxy, DNS, VPN interface, and root-certificate drift
- Firewall, Gatekeeper, and admin-account changes
- Privacy permission grants (with Full Disk Access)
Nightlatch’s Porch Light indicator
Porch Light is Nightlatch’s named resource-shape indicator — a resettable green / yellow / red signal that means check the porch, I heard something. It shows when this Mac’s joint CPU, memory, energy, disk, and network behavior has statistically drifted from its own baseline.
It does not name a process, cause, or verdict. A nightlatch is a passive lock; a porch light comes on because something triggered it. The job is to say something is here — without pretending to know what.
Resource shape: normal
Resource shape: shifted — nothing identified
Significant, sustained divergence from baseline
Porch Light ships in v1.0 (not the $19 MVP binary). MVP already never says Quiet unless monitoring is complete. Porch Light extends the same honesty to resource shape: if sensors fail, it shows Shape monitoring unavailable — never a false green.
This indicator reflects a statistical shape change in resource use, not a diagnosis. It does not identify a cause, a process, or malware.
What it is NOT
Nightlatch is not antivirus, not EDR, and not a firewall. It doesn’t block, quarantine, or delete anything. It’s an early-warning change diary — think of it as noticing a stranger’s car slow down outside your house, not catching them inside. When Nightlatch can’t see something, it says “Monitoring incomplete.” It never tells you “Quiet” unless it actually is.
Who it’s for
- Developers running Cursor, Claude Code, Codex, or custom automation on an always-on Mac
- Small studios who want a readable security timeline without enterprise weight
- Privacy-conscious users who won’t install a cloud security agent
- Enterprise fleet management
- Anyone expecting automatic blocking or quarantine
- iOS
Free tools do one job. Nightlatch is the multi-domain diary.
| Nightlatch | Little Snitch | BlockBlock | LuLu | KnockKnock | |
|---|---|---|---|---|---|
| Continuous baseline drift | Yes | Partial | Persistence only | Network only | On-demand |
| Multi-domain story | Yes | No | Limited | No | Limited |
| Local-only | Yes | Yes | Yes | Yes | Yes |
| Price | $19 founding → $29 after 150 licenses | $50–60 | Free | Free | Free |
Goes to $29 after the first 150 licenses
Lifetime updates through v1.x · 14-day refund · No subscription
Notarized · zero telemetry · nothing to quarantine
30–45 seconds, no narration.
Demo GIF placeholder — Quiet → LaunchAgent → Attention timeline → Export → Mark reviewed.
Capture pending (ORCH M-06). Poster uses brand wordmark until then.
Answers, short.
Related AI incidents worth knowing about
Selected from the AI Incident Database, an independent, open catalog of real-world AI harms. We link out — we don’t reproduce their reporting.
Nightlatch is built for AI-agent intrusion and tool-misuse risk on a Mac you own — not a claim that models are breaking out of every machine. Local Nightlatch watches for unexpected security-relevant changes; it does not issue malware verdicts or actuate containment.
No curated incidents are published here yet. Phase 1 is static-only: a human must approve each entry before it goes live.
Incident data via the AI Incident Database (incidentdatabase.ai). Nightlatch does not verify or endorse third-party incident reports beyond linking to the original source.