A network observatory for macOS that shows you the evidence — every flow, every process, payload-free. Not a black box that cries wolf.
Notarized · Developer ID signed · macOS 15+ · Apple Silicon & Intel
| Time | Process | Destination | Proto | Verdict |
|---|---|---|---|---|
| 09:41:02 | com.apple.Safari | edge.apple.com:443 | tcp | allow |
| 09:41:05 | Code Helper | update.code.visualstudio:443 | tcp | allow |
| 09:41:09 | helperd UNSIGNED | auto.c3pool.org:443 | tcp | shadow blockmining |
| 09:41:11 | com.apple.nsurlsession | gateway.icloud.com:443 | tcp | allow |
| 09:41:14 | ssh | 10.40.0.12:22 | tcp | flag |
A signed system extension inspects every socket, a policy engine classifies it, and a private store keeps the evidence — never the payload.
A notarized NEFilterDataProvider sees every flow the moment it opens — before it leaves your Mac.
Priority rules match on destination, port, protocol, and the connecting process's real code signature. Mining pools and masqueraders get flagged.
A bounded, payload-free record of what your Mac has been saying. Metadata and verdicts only — hostnames never logged in the clear.
Thousands of routine connections become one process group, while unusual identities stay visible.
Close the window and inspection continues. Current health and controls remain one click away.
Copy a readable process profile with verdict, signature, team identity, path, and observations.
The two modes are separate systems, not a switch. Nothing in Lab mode can reach your live network.
Passive, always safe. Attribute every connection to a process and a verdict.
Structured, authorized assessment modules from the modernized dsniff toolkit.
Every alert is backed by verifiable facts about the process — its signature, team identity, and behavior — so you decide, not a vendor's guess.
Archipelago records that a connection happened and to where — never what was in it. Everything stays local; nothing is uploaded.
The provider reads flow metadata only. Message bodies, form fields, and credentials are never captured.
Evidence lives in a private, sandboxed store on your Mac. No telemetry leaves the device without your explicit configuration.
Developer ID signed, Apple-notarized, and source-available so you can verify exactly what it does.
The app, extension, and data model expose the evidence behind their claims.
Developer ID signed by Rocket Now LLC, notarized by Apple, and stapled for offline verification.
The sandboxed Network Extension only activates after macOS presents its system approval flow.
The control plane, policy engine, event schema, and redaction behavior live in the public repository.
Prefer the terminal? dsniff-tui gives you the full observatory as a keyboard-driven interface — free and open.
● ARCHIPELAGO OBSERVATORY mode: monitor flows: 18,432 ──────────────────────────────────────────────────────────── 09:41:09 helperd auto.c3pool.org:443 tcp shadow-block 09:41:11 nsurlsessiond gateway.icloud.com:443 tcp allow 09:41:14 ssh 10.40.0.12:22 tcp flag ──────────────────────────────────────────────────────────── [f]ilter [i]nspect [p]ause [/]search [q]uit
No subscription. The terminal observatory is free and open; the Mac app is a one-time purchase.
The terminal observatory, forever.
One time, no subscription.
No. The provider inspects flow metadata as connections open — it doesn't proxy or decrypt traffic, and it reads no payloads. In the default pass-through build it observes without blocking anything.
No. Archipelago only sees that a connection happened and where to — never the contents. Payloads, form fields, and credentials are never captured or stored.
Archipelago modernizes dsniff for compatibility, distributed under the original BSD license. The passive analyzers are hardened, redacted rewrites of that classic toolkit.
No. Everything is local-first and stored in a sandboxed App Group container on your Mac. Nothing leaves the device unless you explicitly configure it to.
The current build runs in shadow mode — it evaluates policy and flags matches but never blocks, so it can't disconnect you. Enforcement is a separate, safety-gated build in development.
Download the notarized DMG, or leave an email and we'll send the release notes when the enforcement build lands.