AppAlibi
AppAlibi is a Mac app that keeps a history of what AI agents and apps did on your Mac: who recorded the screen, took over the mouse and keyboard, opened your files, or used the camera and microphone.
Why?
AI agents work fast, and quietly
Coding agents and AI assistants read your folders, record your screen and drive your mouse, often in seconds and often while you're in another window. macOS asks once and then stays quiet. AppAlibi recognizes Claude, Claude Code, ChatGPT, Codex, GitHub Copilot, Gemini, Cursor, Perplexity, Kimi, Windsurf, Ollama and LM Studio (and any app or tool you add), and keeps a timeline for each one.
Computer use, spotted
When an assistant records the screen and also controls the mouse and keyboard, AppAlibi marks it as probable computer use. Command-line agents that run inside Terminal are caught too, including when they use Terminal's Full Disk Access.
macOS doesn't remember
The green and orange dots tell you something is using the camera or microphone right now. Once they go away there's no record of what it was. AppAlibi keeps one, for every app, along with which apps asked for protected folders and Full Disk Access, and when an app was given administrator rights.
While you were away
AppAlibi knows when the screen was locked. If an app or agent used the camera, microphone, screen or input while you were away, it tells you when you come back.
Summaries
Daily and weekly summaries show which apps used what, and for how long. History can be exported as CSV.
Private
Everything stays on your Mac in a local database. AppAlibi makes no network requests.
Getting Started
Installation
Download the latest release from the Releases page, open the disk image and drag AppAlibi to Applications. Requires macOS 15 or later.
Releases are signed with a Developer ID and notarized by Apple.
FAQ
There's a FAQ here.
Building from Source
You need Xcode 26 and XcodeGen.
xcodegen generate
open AppAlibi.xcodeproj
Run the AppAlibi scheme. Unit tests for the log parsers and the database:
swift test --package-path AlibiKit
How It Works
AppAlibi follows the macOS unified log with /usr/bin/log. It reads the Control Center events behind the privacy dots, permission checks from tccd, screen locks from loginwindow and authorization grants from authd. The log messages aren't a public API, so a macOS update can change them; alibi-probe replays recent log history through the parsers to check they still work:
swift run --package-path AlibiKit alibi-probe 6
Support
AppAlibi is free and open source. If you find it useful, you can sponsor it on GitHub, buy me a coffee or support me on Suppi.
License
MIT
