Vigil app icon — an eye on a blue gradient background

See what your processes are doing and spot what's abnormal.

Vigil is a native macOS system monitor that watches your processes and file activity, learns what “normal” looks like, and surfaces anything unusual. Think of it as a behavioral antivirus — it doesn’t block anything, it tells you what’s happening so you can decide.

Download Vigil

Requires macOS 14 (Sonoma) or later

Why Vigil?

Activity Monitor tells you CPU and memory. But it doesn’t tell you whether a process is behaving normally, whether something unexpected appeared, or what files are being touched right now. Vigil fills that gap — it monitors process behavior over time, builds baselines, and flags deviations.

No kernel extensions, no elevated privileges. Vigil uses the same system APIs available to any app on your Mac.

Features

Overview

A system health score (0-100) with top concerns, process breakdown by category, and file activity summary — all at a glance.

Processes

Detailed process list with memory, disk I/O rates, categories, and descriptions. A knowledge database of ~572 known macOS processes helps identify what's what.

File Activity

Real-time file system event stream showing files being created, modified, deleted, and renamed across your system.

AI Activity

Dedicated monitoring of AI coding tools — Claude Code, Copilot, Cursor, Ollama, and others — including what files they touch and what permissions they have.

Behavioral Heuristics

Vigil runs six automated heuristics against live process data:

  • Unknown high I/O — flags unrecognized processes doing more than 1 MB/s of disk I/O
  • Missing system processes — alerts if essential processes (launchd, WindowServer, Dock, Finder) aren’t running
  • Lifetime violations — catches transient processes that have been running suspiciously long
  • I/O anomalies — detects known processes significantly exceeding their historical baseline
  • High energy consumers — identifies any single process using more than 50% of total energy
  • Phantom processes — surfaces processes with no verifiable executable path

AI Activity Monitoring

Vigil identifies AI coding assistants (Claude Code, GitHub Copilot, Cursor, Windsurf, Aider), chat apps (ChatGPT, Claude Desktop), and local model runners (Ollama, LM Studio, llama.cpp). It shows what files they’re touching and reads their configuration to surface what permissions each tool has been granted.

Vigil AI Activity view showing Claude Code and Codex CLI processes with agent permissions including allowed commands, blocked tools, and environment variables

File Sharing Monitoring

Track cloud sync activity (Dropbox, OneDrive, iCloud Drive, Google Drive), backup operations (Time Machine, Backblaze, Arq), and file transfer processes (AirDrop, rsync, Syncthing) in one dedicated view.

History and Baselines

Vigil stores daily I/O aggregates per process in a local SQLite database and computes behavioral baselines using Welford’s online algorithm. The History tab compares process behavior across time windows (7-day, 30-day, 90-day, 365-day) so you can see trends and spot drift.

Vigil lives in your menu bar with a persistent health score and quick access to current findings without opening the full app.

Technical Details

  • Native macOS app built with Swift and SwiftUI
  • Zero third-party dependencies — uses only Apple system frameworks
  • libproc for process enumeration and resource usage snapshots
  • FSEvents for real-time file system monitoring
  • SQLite (via the C API) for behavioral baseline persistence
  • Privacy-respecting — all data stays on your machine; no network requests, no analytics