Vigyl

What Vigyl saw, in plain words

The overview opens on one sentence: how many things Vigyl watches, when it last looked, how many programs are running. The banner has three tones: red when Vigyl saw something abnormal, orange when a change waits for your decision, neutral when nothing abnormal was seen. Never green and never “protected”: Vigyl says what it saw, nothing more.

Below, a To handle list: one line per item, with “It was me” or “Seen”, and macOS settings to review that you can keep as they are. A strip sums up the day: network flows, connections you blocked, apps heard for the first time, Apple rules, blind sensors. Then the state of each sensor, and the five programs using the processor, refreshed every 10 seconds.

• A sensor that cannot see is shown as blind, never as active
• “What’s going on on my Mac?” measures the moment and offers buttons computed by Vigyl, such as quitting the app that uses the most memory; an AI only explains
• “Freeze the scene” keeps a case file of the moment
• The menu bar icon turns red while a serious alert is unseen

Downloads checked against two antivirus bases

Every new program or archive arriving from the network gets a fingerprint (SHA-256), which Vigyl looks up on VirusTotal and MalwareBazaar with your keys. Only the fingerprint leaves the Mac, never the file. The same fingerprint is not asked again for 24 hours, and lookups pause when a quota is reached. Drop any file on the window, or choose one, to check it.

A history keeps the last 500 files checked, with the result of each service and each engine, a link to the VirusTotal page and an Explain button. The first real detection: a renamed disk image flagged by 2 of 60 engines, checked in 8.4 seconds.

• Notification when a base recognizes a download: off, silent or with sound
• Keys kept in the Keychain

Who talks to whom, and how much

A system network extension sees every outgoing connection. The Network view lists every app heard today with its throughput, its number of connections, the time of its last flow and a switch to cut it off. Apps you blocked are listed on top with the number of connections refused.

Search by app, address or port. Expand a line to see the destinations.

• Alert when an app talks for the first time
• Blocking is a rule you set, per app, and Vigyl only cuts what you cut

What launches on its own

Agents, daemons, login items, cron, shell profiles, system extensions: Vigyl keeps a baseline and notes what appears, changes or disappears. Disable moves the item to a reversible quarantine; Restore puts it back. The same goes for files that run something when you open a project: mcp.json, npm scripts, git hooks.

Why the Mac lags

Every 10 seconds, without any privilege, Vigyl reads processor load, memory pressure and swap, thermal state, and the work of WindowServer, the program that draws every window. A table compares the 24 hours before startup, the 2 hours after and the last hour.

When the Mac stutters, press “My Mac is lagging now”: Vigyl keeps a snapshot of the heaviest programs at that moment. No threshold is guessed in advance; it learns from these moments to warn you, once per episode.

• Memory tab: memory per app, with a Quit button for apps (never macOS or web pages)
• Cleanup measures disk space and erases nothing

A log that cannot be rewritten quietly

The Logbook shows the last 30 days, one timeline per day, in red, orange and gray, filtered to what is worth keeping or everything. Each line opens what it means, what was happening at that moment, what to do, and the raw trace.

Under it, every line carries the fingerprint of the line before it (SHA-256), one file per day. A deleted or altered line breaks the chain, and Vigyl names it. The Chain view shows the state of the chain, the number of lines, the heartbeat and the head of the chain. The goal is undeniable, not untamperable.

• After an incident, a case file: APFS snapshot and process tree, no secrets
• Vigyl holds no Accessibility permission: no sensor needs it