What plugged in?
Attach and detach events for every USB and HID device: a readable name, its interfaces, and where it sits on the bus. A device with junk descriptor strings still gets a plain name, never raw hex.
USB security monitor for macOS · local-first · MIT · version 1.0
Plugsight shows you what your USB devices actually do.
Plugsight watches every device that plugs in, tells you what it claimed to be and what it then did, in plain words. It never pretends to block. For you, and for your AI agent over MCP.
v1.0 · signed & notarized. No account, no telemetry. Or point your agent at npx @plugsight/mcp
- SanDisk Ultra plugged in. Roles: storage.
- Scan started (ClamAV).
- Scan clean. 1,204 files.
- Warning · "Travel charger" also enumerated a keyboard. A charger has no reason to type.
- Started typing 0.4 seconds after it was plugged in. Human typists need a few seconds.
live · entries reveal as events arrive · motion respects reduced-motion
What it actually does
Every device gets a record. Every event gets an explanation. Three questions, answered in words a person can read without a security background.
What did it claim to be?
Devices announce roles: keyboard, storage, network adapter. Plugsight compares the claim against what actually enumerated. A "charger" that also brings up a hidden keyboard or network interface gets an alert that says exactly that.
What did it then do?
Typing behavior is scored for injection likelihood: plug-to-type latency, keystroke cadence, a second keyboard on a machine that already has one. Mounted storage gets a ClamAV scan, and infected files can be quarantined.
Caveat
The score is honest about itself. Behavioral scoring is probabilistic, and a patient attacker can evade it. Plugsight says so in the product, in the spec, and on this page.
Two faces, one API
One local daemon owns monitoring, scoring, and scanning. The menu-bar app and the MCP server are peer clients of it. Every capability a human has, an agent has: 19 tools, the same data, the same sentences. When your agent trusts a device or starts a scan, the action lands in your timeline with the actor named.
# any MCP client
$ npx @plugsight/mcp
> score_device { "deviceId": "dev_2ab919" }
{
"score": 78,
"confidence": "medium",
"signals": [
{ "id": "plug_to_type_latency",
"observed": "410ms", "verdict": "suspicious" },
{ "id": "inter_key_timing",
"observed": "mean 21ms", "verdict": "suspicious" },
{ "id": "redundant_keyboard",
"observed": "built-in present", "verdict": "suspicious" },
{ "id": "class_mismatch",
"observed": "none", "verdict": "clear" }
],
"caveat": "Behavioral scoring is probabilistic
and a patient attacker can evade it."
}
score
78
The whole app, honestly small.
A menu-bar glyph, a popover for the last thing that happened, and windows when you want the detail. This is the actual v1.0 interface. It ships a full dark theme too.
Menu-bar popover
The last alert and recent events, one click from the menu bar.
Popover
Event timeline
Every attach, scan and warning, in words, filterable.
Timeline
Live devices
What is connected now, and the role each one claims.
Devices
Settings
Each switch says what turns on, and what stays off.
Settingsscreenshots are the real v1.0 build, not mockups
Where Plugsight fits.
Most USB tools block, and run on Windows or a server console. Plugsight does the one thing they skip: it watches behavior and explains it, on your Mac, to you and your agent. It does not block, and says so.
| Capability | Plugsightv1.0 | macOS accessory promptApple, built in | Enterprise USB DLPe.g. Endpoint Protector | USBGuardLinux | No tooldefault Mac |
|---|---|---|---|---|---|
| Platform | macOS (native) | Apple Silicon laptops, macOS 13+ | Windows, macOS, Linux | Linux only | macOS |
| Device blocking? | No, by design (detector) | Allow / deny at connect | Yes | Yes | No |
| Explains behavior in plain language | Yes | No (allow / deny only) | No (policy / audit logs) | No (rules / descriptors) | No |
| Behavioral BadUSB / keystroke scoring | Yes | No | No (device-class control) | No (attribute allowlisting) | No |
| AI-agent access over MCP | Yes (19 tools) | No | No | No | No |
| Local-only, no cloud, no account | Yes | Yes | No (managed console) | Yes | Yes |
| Open source | Yes, MIT | Built into macOS | No (proprietary) | Yes, GPL-2.0 | n/a |
| Price | Free, no paid tier | Free (in macOS) | Enterprise (quote-based) | Free | Free |
Plugsight is a detector, not a blocker: on macOS, third-party software cannot veto a keyboard enumerating. The connect gate above is Apple's own. Plugsight watches what a device does and explains it, and raises the attacker's cost rather than promising to stop them.
sources: support.apple.com · usbguard.github.io · endpointprotector.com
What it does not do
Security tools usually bury their limits. Plugsight leads with them, because an alert is only worth reading if you know what the tool can and cannot see.
It does not block
macOS gives third-party software no veto over a keyboard enumerating. The only thing that stands in front of one is Apple's own accessory prompt, on Apple Silicon laptops. Plugsight is the explanation layer behind that prompt, not a substitute for it.
It cannot see a dormant implant
An idle malicious cable is electrically a cable. Finding the implant takes RF equipment, not host software. Plugsight's contribution starts the moment the implant does something observable, and it says so unprompted.
Trust is a bar-raiser, not a guarantee
VID, PID, and serial are attacker-controlled bytes. Marking a device trusted raises the bar for alerting; a critical finding still gets through. The app repeats this caveat the first time you meet the feature.
Scoring can be evaded
Slow, patient typing beats the cadence signals. What detection buys you: it raises the attacker's cost, catches the common commercial payloads as shipped, and leaves a legible record either way.
Every limit above is stated in the public spec, with the platform facts behind it. Anyone can read what the product claims it cannot do before installing it.
Nothing leaves your Mac
No telemetry, no phone-home, no account, no cloud. The event record is a SQLite file in your Library folder, and it is yours.
MIT licensed, with the full specification public in the repo. That includes the threat model and every platform limit the product is built on.
Free, and open source.
No paid tier, no trial, no upsell, no enterprise edition held back. Plugsight is free, and the whole thing is open source under the MIT license: the daemon, the menu-bar app, and the MCP server.
Free
No price, now or later. There is no paid edition of Plugsight to upgrade to, and no feature held back behind a license key. You are not the product, and nothing here is trying to sell you anything.
Open source
Every part is public: the daemon that watches, the menu-bar app you click, and the MCP server your agent talks to. Read the code, build it yourself, fork it, or lift a piece into your own tool.
MIT licensed
The most permissive common license. Use it privately or commercially, modify it, redistribute it. The full text ships in the repo, next to the spec and the threat model.
Proof
Read the MIT license and browse the full source before you install anything. The price is zero and the license is MIT, and neither one is going to change on you.
Get Plugsight
Version 1.0 is out. The app is open source under MIT, the full spec is public, and nothing here signs you up for anything or reaches us.
For you
Download the signed, notarized app and drag it to Applications. Setup is a two-minute permission walk, and each step says what turns on and what stays off if you skip it.
Download for macOSFor your agent
Point Claude, or any MCP client, at the Plugsight server. Your agent gets the same 19 tools and the same honest data you see, with every action landing in your timeline with the actor named.
npx @plugsight/mcp
Storage scanning uses ClamAV, installed separately through Homebrew. Plugsight guides the install from its Settings.