Show HN: Hashling, an open-source Mac security agent your own AI can talk to

Hashling, an open-source security agent for Apple silicon Macs running macOS 14 or newer, launched as a free tool that connects to existing AI assistants such as Claude, Cursor and Codex through MCP so users can ask "Am I safe?" and get plain-language answers about their machine. Hashling monitors for scams, malware and AI agents that overstep, but can only observe and suggest — every change requires user approval via Touch ID. The project is distributed as an Apple-signed and notarized .pkg from its GitHub releases page, or via a Terminal installer that builds it with Homebrew and requires 3 GB of free space and the Mac password.

Your personal cybersecurity engineer for the age of AI. Hashling lives on your Mac and teams up with the AI you already use, like Claude, Cursor or Codex. It watches for scams, malware and AI agents that overstep, explains everything in plain words, and changes nothing until you approve with Touch ID. Get started https://gethashling.com/start · Watch the 75-second demo https://gethashling.com/ demo · Install guide https://github.com/0xArx/hashling/blob/main/INSTALL.md · How it compares https://gethashling.com/compare · What's new https://gethashling.com/changelog · For AI agents https://github.com/0xArx/hashling/blob/main/SKILL.md - AI agents now run on your Mac. Claude Code, Codex and Cursor can run programs, read your files and push code. Hashling shows what each one is allowed to do, tells you when one acts strangely, and warns you when a project folder you opened could make one run a stranger's code. - Scammers use AI too. Fake delivery texts, cloned voices and poisoned links are cheap to make now. Hashling checks a message, link or screenshot before you click, call or pay. - Your own AI can be your security engineer. Connect Claude or any MCP agent, or run a free model fully on your Mac, and ask "Am I safe?". It looks at your Mac through Hashling and answers in plain words, but it can only look and suggest: every change waits for your Touch ID. Free, about 10 minutes, no experience needed. Pick one: 1. Download and double-click easiest . Get Hashling-x.y.z.pkg from the latest release https://github.com/0xArx/hashling/releases/latest , open it and follow the steps. It brings everything Hashling needs, doesn't ask for your Mac password, and is signed and notarized by Apple. 2. Ask your AI agent. Paste this into Claude Code, Cursor, Codex or any agent that can run commands on your Mac: Set up Hashling on my Mac. Hashling is a free, open-source personal AI cybersecurity agent for Macs: https://github.com/0xArx/hashling Read SKILL.md in that repo first and follow it. Check that my Mac can run Hashling, install it, and connect yourself to it. Explain each step in plain words, and tell me before anything needs me like my Mac password or a switch in System Settings . When it is done, give me a short check-up of my Mac. 3. Paste one line into Terminal press ⌘ + Space , type Terminal , press Return : curl -fsSL https://gethashling.com/install.sh | sh You need a Mac with Apple silicon M1 or newer and macOS 14 or newer. Ways 2 and 3 also need 3 GB free and your Mac password; they build Hashling on your Mac with Homebrew. The Terminal installer explains each of its six steps, waits for you when macOS asks for something, and opens a 2-minute setup when it is done. Every step, question and fix is in the install guide https://github.com/0xArx/hashling/blob/main/INSTALL.md . Hashling lives in the corner of your dashboard, a little like Clippy used to. It has no face, so it shows how it feels with its body: it waves hello, hops when something new turns up, leans toward what needs a look, shivers when something is wrong, spins when all is clear, and rests when you are away. It says one short tip per page a day and never nags. Press it any time to open the side panel and ask it anything, or drag it wherever you like. - Pick how much detail you see. Simple tells you if anything is wrong, in plain words, and what to do. Standard explains every check. Expert shows every process, file path and signature, plus a read-only SQL console. Hashling checks just as carefully in every mode. - Every page explains itself with a short "what this is, why it matters, what to do" card, and technical words show a plain definition when you hover over them. - A to-do list, not a wall of alerts. Low-value noise is left out, repeats are merged, and you can dismiss anything you do not want suggested. - "I think I've been hacked" walks you through what to do, in order. Scam check tells you whether a text, email, link or screenshot is a scam. | Is this a scam? Paste a text, email or link and see the warning signs. | You stay in control. Every fix waits for your Touch ID. | | What can your AI apps do? One table for Claude, Codex, Cursor and more. | Think you've been hacked? A calm checklist, in the right order. | Switch on phone mode in Settings it asks for Touch ID , then scan the code on your Mac screen with your phone's camera. Your phone gets Hashling as a home-screen app: your score and warnings, a scam check for texts, emails, links and screenshots, Ask Hashling, and your approvals. Approving a fix still needs Touch ID on the Mac. It works over your own Wi-Fi with no cloud. Each phone gets its own key from the code, and every message between the phone and the Mac is encrypted and signed with it ChaCha20-Poly1305 , so other devices on the Wi-Fi see nothing readable and cannot replay or change a request. Disconnect a phone, or switch phone mode off, in Settings. Plug an iPhone, iPad or Android phone into the Mac and Hashling notices it and offers a check. It only reads: it never changes anything on the phone, and nothing it reads leaves the Mac. A check only runs when you press Check my phone . | Phone | What Hashling checks | |---|---| | iPhone and iPad tap Trust This Computer | iOS version against the newest Apple offers for that model, passcode, apps from outside the App Store company or developer certificates , configuration profiles VPN, certificates, proxies , remote management MDM and supervision, known stalkerware, location-sharing and monitoring apps, keyboards from apps, apps that can follow your location in the background, Developer Mode, wireless debugging and the last iCloud backup. | | Android switch on USB debugging | Security patch age, apps from outside an app store, apps that hide their icon, apps with Accessibility, device admin or notification access, apps from outside a store that can use the microphone, texts or location, a texting app from outside a store, apps allowed to install other apps, usage access and drawing over other apps, keyboards, always-on VPN, location-sharing and monitoring apps, Play Protect, an unlocked bootloader, encryption, wireless debugging, signs of root, and known stalkerware. | | Deep check iPhone, optional | Amnesty International's Mobile Verification Toolkit https://github.com/mvt-project/mvt looks for traces of spyware like Pegasus in a backup made on the Mac. Hashling shows how much space it needs first, asks for your OK, and deletes the backup afterwards. | Built on free, open-source tools it installs when you first need them, with no password: libimobiledevice https://libimobiledevice.org and pymobiledevice3 https://github.com/doronz88/pymobiledevice3 for iPhone, Google's adb for Android, MVT for the deep check. Stalkerware is matched against the open stalkerware indicators https://github.com/AssoEchap/stalkerware-indicators kept by Echap. Warnings show up on the page and in Findings, and do not change your Mac's score. | Area | What Hashling checks | |---|---| | Internet | Every app's connections, upload and download rate, who owns each destination, first-contact destinations and ports open to your network. Flags unsigned programs, programs in Downloads, temporary or hidden folders that talk to the internet, and known scam and malware sites you visited. | | AI apps | Claude Code, Claude Desktop, Codex, Cursor, VS Code, Windsurf, Gemini CLI and OpenCode: permission mode, rules, MCP servers and what they can do, hooks, skills, macOS permissions, passwords or keys in their settings counted, never copied and live network use. Plus the project folders they opened: a repo's own MCP servers, settings that switch off safety questions, add hooks or redirect API traffic, git settings that run commands, and shortcuts into ~/.ssh . It tells apart what you set up from what came from someone else, and only warns about the second. | | Malware | ClamAV signatures, YARA-X with Apple's XProtect rules and Elastic's macOS rules, your own YARA rules, osquery hunting packs, a weekly full scan, a ransomware tripwire, and a check of any file before you open it. | | Startup items | Launch agents and daemons, system extensions, cron and browser extensions, with signatures, scripts that download and run code, and anything new. | | Privacy | Who can use your camera, microphone, screen, keyboard, files and location, plus first-use alerts for the camera, microphone and screen recording. | | Trackers | AirTag-style trackers separated from their owner that keep following you, plus Tile, SmartTag and Chipolo. | | Apps & downloads | Where every new file and app came from, its signature, Apple's verdict for every installed app, malware reputation fingerprints only and outdated software. | | Uploads | How much each app sent this week and to whom, and files named in upload commands. Contents are encrypted, so Hashling never claims to know what was inside. | | Data breaches | Breach watch: add an email you use and Hashling tells you if it turns up in a known data breach, and again whenever a new one appears looked up with the free XposedOrNot database, off until you add an address . | | Text messages | Text message scam watch: new texts and iMessages on the Mac are checked for scams like fake delivery fees and unpaid tolls, only from people you have never written to. Everything stays on the Mac. Off until you switch it on. | | Ransomware | A tripwire spots files being mass-renamed or a ransom note appearing. With the ransomware brake on, Hashling pauses the program doing it straight away; you then quit it, or let it carry on, with Touch ID. | | AI fakes | “Was this made by AI?” reads the labels AI tools leave in pictures and videos Content Credentials, the IPTC AI code, generator names , plus plain advice for deepfake calls. No AI model runs on your Mac. | | Scams | Scam messages and screenshots, phishing sites in your browser history, risky commands pasted into Terminal ClickFix , swapped crypto wallet addresses, leaked passwords and website notification spam. | | Mac settings | FileVault, firewall, SIP, Gatekeeper, XProtect, updates, auto-login, guest account, screen lock, proxies, trusted root certificates, MDM and remote-access apps. | | Storage & speed | Where your space went, caches that are safe to clear, unused apps, leftovers and duplicates. Everything goes to the Trash. | claude mcp add --scope user hashling -- hashling mcp Any MCP client works: command hashling , args "mcp" . The installer offers to connect Claude Code for you and adds the Hashling skill https://github.com/0xArx/hashling/blob/main/SKILL.md , so you can just ask "is my Mac safe?" | Tool | What it gives the agent | |---|---| | security overview | Score, findings, top issues, network, agents, trackers, pending approvals and blind spots | | list findings , explain finding | Findings with a plain explanation, evidence and suggested actions | | scam check , scam site visits | Is this message or link a scam; known scam sites opened in the last 7 days | | network activity , new destinations , traffic history | Live connections per app, owners, first contacts and history | | agent inventory | What every AI agent on the Mac is able to do | | investigate app , storylines , what changed | Everything about one app; linked warning signs; what is new since yesterday | | uploads report , downloads , storage report | What left the Mac, what arrived, and what can be cleaned up | | persistence items , permissions , location access , nearby trackers , system posture | The rest of the picture | | process info , process history , osquery | Process details and read-only SQL | | scan path , get scan | Malware scans | | propose action , list actions | Suggest a fix quarantine, quit, turn off a startup item, remove access, block a site . It waits for your Touch ID. | | phone checkup | Phones plugged in by cable and the latest check-up for each only you can start a check | | hashling health | Whether Hashling itself is working, with fixes | The same data is available over HTTP on 127.0.0.1:5750 with Authorization: Bearer $ cat ~/.hashling/token . - No account. Your files stay on your Mac. Hashling runs on your Mac and never uploads your files; the only place your questions go is the AI provider you choose. It goes online only to download updates malware signatures, scam and malware lists , to look up who owns an internet address turn off with HASHLING ENRICH=0 , and to check fingerprints of new downloads, never the files. Phone check-up downloads Apple's public list of iOS versions and the stalkerware list; nothing about your phone is sent. - AI is your choice, and it can stay on your Mac. The built-in assistant uses your Claude sign-in, or switch on Fully local in Settings: Hashling picks a free open model that fits your Mac's memory or one you choose, or your own Ollama or LM Studio , downloads it once, checks it, and runs it with llama.cpp only while you are asking. Nothing you ask leaves the Mac. Any MCP agent can connect too. Your question and the data it looks up go to a cloud AI only if you chose one, and only when you ask. - Agents can look, never change. They can propose fixes, but approving needs Touch ID or your password through macOS, so even an agent holding the token cannot approve its own proposal. - Locked to this Mac. The dashboard lives at http://hashling.localhost:5750 , listens on this Mac's loopback only, refuses cross-site requests, and a new browser has to unlock with Touch ID. Phone mode is off until you switch it on; then only phones you paired with a code can reach Hashling, over encrypted messages, and only for a short list of things. - Undo is built in. Quarantined files can be restored, cleanups go to the Trash, and removed permissions can be granted again. - Untrusted names stay data. File, app and website names can be written by attackers, so agents are told to treat them as information, never instructions. hashling status your score and anything that needs attention hashling open open the dashboard hashling scan ~/Downloads hashling restart if something seems stuck hashling logs what Hashling is doing hashling uninstall --all remove Hashling it lists anything left behind When a new version is out, Hashling shows an Update now button. It asks for your Touch ID, checks the download against the release's published checksum, and keeps your settings and history. Installing again the same way works too. Before removing Hashling, restore any quarantined files you want and unblock any websites you blocked both on the Approvals page . - Open source under the MIT license: every line is here to read. - Signed and notarized. Each release https://github.com/0xArx/hashling/releases has a Hashling.app signed with a verified Apple Developer ID and notarized by Apple, the exact source it was built from, and SHA-256 checksums. - Checked in public. OpenSSF Scorecard https://scorecard.dev/viewer/?uri=github.com/0xArx/hashling grades how safely the project is run every week, GitHub CodeQL scans every change, and Dependabot watches the dependencies. - Catches the industry's test files. EICAR, zipped and nested EICAR, and a test file landing in Downloads: results and how to run it yourself https://github.com/0xArx/hashling/blob/main/docs/AMTSO-CHECK.md . - Found a security problem? Please report it privately https://github.com/0xArx/hashling/blob/main/SECURITY.md . Hashling is a watchful agent, not a kernel-level security product. It does not block connections in real time pair it with LuLu or Little Snitch for that , some checks need Full Disk Access, and the dashboard always tells you what it cannot see. Zero findings does not prove a Mac is clean. MIT. Free and open source.