AI tool observability
See what your AI tools send.
Every connection from Claude Code, Cursor, Codex and the MCP servers and commands they start: which program made it, where it went and how much it carried. Portwhistle only watches, so it can never break your internet.
The problem
Your AI tools have a shell.
Agents run commands, start MCP servers and install packages. In August 2025 a poisoned npm package used its victims' own AI tools to find their secrets and upload them to GitHub. A firewall would have shown a program talking to GitHub, which looks normal. The chain of processes behind it is what gave it away.
It only watches.
- Never in the way
- Portwhistle reads copies of your traffic. It never sits between an app and the network, so if it stops, nothing else does.
- Every program named
- Each connection carries the program that made it and the chain of processes that started it, down to the command or MCP server.
- Where and how much, never what
- It reads where each connection goes and how much it carries. It installs no certificates and decrypts nothing.
AI tools
Every tool, and everything it started.
Portwhistle recognises Claude Code, Cursor, Codex, Gemini CLI, Claude, ChatGPT and more, then splits each one's traffic into what it sent itself, what its MCP servers sent, and what the commands it ran sent.
tool → where it came from → destination
Named by what started it
Every connection carries the chain of processes behind it, so a bare node shows up as the MCP server it really is.
nodeMCP server · server-github
- MCP servers named by their project or package
- Commands an agent ran, grouped by program
- Known trackers flagged from an offline catalog
- A portwhistle command for your terminal and scripts
Alerts
Told when something is unusual.
Each tool gets a day to learn what normal looks like. After that, Portwhistle tells you when a tool reaches somewhere new, when an install script launches an AI tool or a program like curl, or when anything connects to a paste or tunnel service.
Unusual, not alarming
An alert says what happened and what started it. It never calls anything malicious; you decide what it means.
- The install-script check needs no learning day
- Optional macOS notifications
- Kept on your Mac with the rest of your history
- Install script launched a tool
- New destination
- Paste or tunnel service
Map
See where your data goes.
A world map of everywhere your apps and tools connect. Pick a country to see which programs reach it, and what they touch there.
- US United States
- IE Ireland
- SE Sweden
- DE Germany
- NL Netherlands
from a database bundled in the app
Bundled offline
The IP-to-country database ships inside the app, so a destination can be placed on the map with the network off.
- Every connection placed on the map as it happens
- Pick a country, see the programs behind it
- Covers every app on your Mac, not only AI tools
This week's report
What each AI tool sent over the last seven days, which MCP servers and commands did the work, and which trackers they reached. Clear it whenever you like.
- Claude Code ↑ 1.2 GB
- Cursor ↑ 310 MB
- Codex CLI ↑ 88 MB
- Gemini CLI ↑ 24 MB
For teams · early access
AI tool observability for the whole team.
See which AI tools and MCP servers your engineers run, set the boundaries they should stay inside, and send alerts to Slack or your SIEM. It deploys through your device management, collects metadata only, and stays out of every connection.
- Every AI tool and MCP server across your Macs, in one place
- Approved tools, servers and destinations, with an alert when one is crossed
- Alerts to Slack and Microsoft Teams, events to your SIEM
- Deploys with Jamf, Kandji, Intune or Mosyle
Metadata, never content
Which tool, which program, where and how much. Never prompts, code or what was sent, and people can see on their own Mac exactly what is collected.
Watch your AI tools in the open.
AI tool observability for your Mac. It only watches, so it is never in the way of your connections.