What plugged in?
Attach and detach events for every USB and HID device: a readable name, its interfaces, and where it sits on the bus. A device with junk descriptor strings still gets a plain name, never raw hex.
USB security monitor for macOS · local-first · MIT
Plugsight shows you what your USB devices actually do.
It watches, explains, and never pretends to block. Every device that plugs in, what it claimed to be, and what it then did, in plain words. For you, and for your AI agent.
Get Plugsight
Repo goes public with v1.0
- SanDisk Ultra plugged in. Roles: storage.
- Scan started (ClamAV).
- Scan clean. 1,204 files.
- Warning · "Travel charger" also enumerated a keyboard. A charger has no reason to type.
- Started typing 0.4 seconds after it was plugged in. Human typists need a few seconds.
What it actually does
Every device gets a record. Every event gets an explanation. Three questions, answered in words a person can read without a security background.
What did it claim to be?
Devices announce roles: keyboard, storage, network adapter. Plugsight compares the claim against what actually enumerated. A "charger" that also brings up a hidden keyboard or network interface gets an alert that says exactly that.
What did it then do?
Typing behavior is scored for injection likelihood: plug-to-type latency, keystroke cadence, a second keyboard on a machine that already has one. Mounted storage gets a ClamAV scan, and infected files can be quarantined.
Caveat
The score is honest about itself. Behavioral scoring is probabilistic, and a patient attacker can evade it. Plugsight says so in the product, in the spec, and on this page.
Two faces, one API
One local daemon owns monitoring, scoring, and scanning. The menu-bar app and the MCP server are peer clients of it. Every capability a human has, an agent has: 19 tools, the same data, the same sentences. When your agent trusts a device or starts a scan, the action lands in your timeline with the actor named.
# any MCP client
$ npx @plugsight/mcp
> score_device { "deviceId": "dev_2ab919" }
{
"score": 78,
"confidence": "medium",
"signals": [
{ "id": "plug_to_type_latency",
"observed": "410ms", "verdict": "suspicious" },
{ "id": "inter_key_timing",
"observed": "mean 21ms", "verdict": "suspicious" },
{ "id": "redundant_keyboard",
"observed": "built-in present", "verdict": "suspicious" },
{ "id": "class_mismatch",
"observed": "none", "verdict": "clear" }
],
"caveat": "Behavioral scoring is probabilistic
and a patient attacker can evade it."
}What it does not do
Security tools usually bury their limits. Plugsight leads with them, because an alert is only worth reading if you know what the tool can and cannot see.
It does not block
macOS gives third-party software no veto over a keyboard enumerating. The only thing that stands in front of one is Apple's own accessory prompt, on Apple Silicon laptops. Plugsight is the explanation layer behind that prompt, not a substitute for it.
It cannot see a dormant implant
An idle malicious cable is electrically a cable. Finding the implant takes RF equipment, not host software. Plugsight's contribution starts the moment the implant does something observable, and it says so unprompted.
Trust is a bar-raiser, not a guarantee
VID, PID, and serial are attacker-controlled bytes. Marking a device trusted raises the bar for alerting; a critical finding still gets through. The app repeats this caveat the first time you meet the feature.
Scoring can be evaded
Slow, patient typing beats the cadence signals. What detection buys you: it raises the attacker's cost, catches the common commercial payloads as shipped, and leaves a legible record either way.
Every limit above is stated in the public spec, with the platform facts behind it. Anyone can read what the product claims it cannot do before installing it.
Nothing leaves your Mac
No telemetry, no phone-home, no account, no cloud. The event record is a SQLite file in your Library folder, and it is yours.
MIT licensed, with the full specification public in the repo. That includes the threat model and every platform limit the product is built on.
Get Plugsight
Being built in the open toward v1.0. When it ships, the source goes public at github.com/plugsightlabs/plugsight; watch the repo there and GitHub tells you the moment it releases. Nothing to sign up for here, and nothing reaches us.
For you
At v1.0, download the signed, notarized app from GitHub Releases and drag it to Applications. Setup is a two-minute permission walk; each step says what turns on, and what stays off if you skip it.
For your agent
At v1.0, point Claude, or any MCP client, at npx @plugsight/mcp. Same 19 tools, same honest data.
Storage scanning uses ClamAV, installed separately through Homebrew. Plugsight guides the install from its Settings.