SquirrelOps for macOS · Free
Know your network. Control your network.
See the devices your Mac can reach, deploy decoys that fit your LAN, and investigate unexpected interactions.
Requires Apple Silicon (ARM64) and macOS 14 (Sonoma) or later. Intel Macs are not supported. Free for personal use.
Home 2.1.2 includes app 2.1.1 and sensor 2.1.1. Signed and notarized installer.
The App
A native macOS experience.
Captured from Home 2.1.2 with synthetic devices, decoys, and alerts. App and sensor version: 2.1.1.
Dashboard1 / 7
Install. Build Local Sensor. Investigate.
The signed package installs the app and sensor on the same Mac. macOS asks for administrator approval during installation. Choose Build Local Sensor for automatic mutual-TLS enrollment.
Security note for upgrades from before 2.0.2
If you configured Home Assistant, Slack, or classifier credentials in a release before 2.0.2, rotate them after installing 2.1.2. Those releases cached configuration responses unencrypted. Current releases purge that cache, but they cannot undo a past disclosure.
Home 2.1.2: corrected help and documentation
One Mac-shaped decoy groups real SSH/SFTP and Samba shares with synthetic Ollama, OpenAI-compatible, and MCP endpoints. SSH and SMB run in a disposable Linux guest with no network adapter or host file access. The API decoys do not run inference or execute tools; full Time Machine backup and restore remain unverified.
- The in-app help and README now describe the implemented decoy protocols, LAN Scout workflow, and alert and notification limits. Automatic behavioral-baseline collection remains inactive. Sensor and guest behavior are unchanged from Home 2.1.1.
- The app groups repeated decoy connections into one alert with service counts and a recent activity timeline.
- The package installs the local sensor and helper. Choose Build Local Sensor for automatic mutual-TLS enrollment; macOS asks for administrator approval during installation.
The installer, checksum, and canonical release notes are public, immutable release assets. You can also view the complete GitHub release and the release verification report.
To verify the package yourself, paste this command into Terminal. It assumes the package is in your default Downloads folder:
shasum -a 256 ~/Downloads/SquirrelOpsHome-2.1.2.pkg | cut -c 1-64Terminal should print:
ac0090459c212c4fa278d8e10a4534813ac53454256d7fb0c2ed3467183fea5cInstalling for the first time? to choose the local or remote sensor path.
Choose where the sensor runs
For normal setup on this Mac, install the signed package and choose Build Local Sensor. The app creates its private key in macOS Keychain and enrolls with the packaged sensor automatically over mutual TLS. Closing the app does not stop protection; the sensor continues across logins and restarts.
Connect to Another Sensor
If the sensor runs elsewhere on your network, choose Connect to Another Sensor, select the sensor discovered through mDNS, and enter its one-time setup key. Certificate storage, mutual TLS, and the authenticated connection stay the same.
Use Setup Key on this Mac
If automatic local enrollment cannot finish, Use Setup Key remains available as a recovery path. Open Terminal and run:
sudo -u _squirrelops \
/Library/SquirrelOps/sensor/python/bin/python3 \
-m squirrelops_home_sensor \
--config /Library/SquirrelOps/sensor/config.yaml \
--show-pairing-codeEnter your Mac administrator password when prompted, then paste the displayed 20-character key into the app. The key expires after 10 minutes or after it is used.
If the key expires, restart the sensor with this command, then run the pairing command above again:
sudo launchctl kickstart -k system/com.squirrelops.sensorWhat It Does
Four layers of network awareness.
Discovers reachable devices
Periodic ARP scans, TCP port probes, MAC vendor data, and mDNS/SSDP metadata build an inventory of reachable devices on your selected IPv4 LAN. Optional Home Assistant enrichment adds names, areas, manufacturers, and models. AI classification can use a local or cloud provider you configure. Sleeping devices can be missed, and identification is heuristic.
Flags scan-based security findings
Scans flag risky exposed services and ambiguous ARP ownership, grouping affected devices by issue. You can review unfamiliar devices and record trust decisions. Automatic connection-baseline learning and passive DHCP capture are not active in this release.
Deploys decoy tripwires
Classic decoys emulate HTTP file directories, dev-server pages, and Home Assistant login/error routes. Scouts group observed service samples and banners under a shared virtual IP and hostname. Studio Build Mac adds real SSH/SFTP and Samba in an isolated Linux guest with Mac-shaped content, plus synthetic model and MCP APIs.
Plants synthetic credential bait
Decoys expose synthetic passwords, SSH keys, tokens, and .env files that may include AWS keys, database URIs, or GitHub PATs. Bait-file retrieval records decoy activity; supported requests submitting recognized bait can raise Critical alerts. Studio's opaque SSH/SMB relays record connections, not login success or file operations.
How It Works
One package, local setup.
SquirrelOps for macOS has two parts: a lightweight sensor that watches your network and a native app that serves as your control plane. The signed package installs both on the same Mac. macOS asks for one administrator approval, then Build Local Sensor enrolls the app automatically without a Terminal command or setup key.
The sensor does the heavy lifting: scanning, fingerprinting, running decoys, and recording inventory and alert evidence in local SQLite. Configuration uses YAML and an encrypted secret store. The app keeps its private key in macOS Keychain and connects to the sensor over mutual TLS. You can see your device inventory, manage decoys, review alerts, and configure notifications locally. Cloud classification and external delivery are optional.
Already run a sensor elsewhere on your network? Choose Connect to Another Sensor and keep the existing one-time setup-key flow.
The sensor runs in the background across logins and restarts. Keep the paired app running for native Mac notifications, or configure Slack delivery from the sensor.
What You Get
Confidence in your own network.
An inventory you can investigate
Review discovered devices, observed ports, names, trust status, and last-seen history. Add your own names and notes as you investigate unfamiliar entries.
Evidence behind the alert
Unexpected decoy activity produces High alerts; recognized credential submission can produce Critical alerts. Source addresses, service activity, and related evidence help you investigate. Operator tests and legitimate scanners can also trip a decoy, while automatic printer discovery is retained without an intrusion alert.
Insight without surveillance
The sensor does not passively inspect unrelated traffic. Scout probes read bounded service samples, and decoys inspect interactions sent to them. Inventory and evidence remain local unless you configure optional cloud classification or external alert delivery.
Native Mac notifications
The paired Mac app offers Notification Center alerts, menu-bar status, and High/Critical prompts while it is running, subject to macOS permissions. Slack delivery is optional. APNs sender code exists, but app token registration and an iPhone client are not implemented.
What It Isn't
Scans, decoys, and local alerts.
Not a firewall.
SquirrelOps does not block real devices. Its helper publishes isolated virtual decoy addresses and scoped port-forwarding rules. You do not need to replace your router or redirect DNS; reserve the virtual-IP pool outside DHCP to avoid conflicts.
Core operation is local.
Inventory, alerts, and evidence stay on your Mac. No cloud account or subscription is required for core operation. Cloud AI and external notifications are optional, and requested update checks contact GitHub.
Who It's For
Built for people who care about their network.
Smart home enthusiasts who have dozens of IoT devices and want to know they're all behaving as expected.
Privacy-conscious households who want network visibility without handing their data to a cloud service.
Remote workers who want confidence that their home office network is clean.
Anyone who has ever looked at their router's device list and thought, I don't recognize half of these.
How it is built
Local sensor.
Native Mac app.
The sensor combines active scanning, HTTP decoys, Scout service sampling, and synthetic Studio APIs. A separate unprivileged Virtualization.framework runtime runs Studio's OpenSSH and Samba in a memory-only Linux guest with no network adapter or shared host directory. The native app keeps pairing keys in macOS Keychain and connects to the sensor over mutual TLS.
FAQ
Common questions.
Is my network data sent to the cloud?
Inventory, alerts, and decoy evidence stay in local SQLite. Configuration uses local YAML and an encrypted secret store; pairing keys stay in macOS Keychain. Core operation needs no cloud account. Cloud AI and external alert delivery are optional, and requested update checks contact GitHub.
What devices can SquirrelOps monitor?
Reachable devices on the selected IPv4 LAN, including phones, computers, NAS devices, and smart-home equipment. ARP, TCP port probes, MAC vendor data, and mDNS/SSDP metadata help identify them; Home Assistant enrichment and AI classification are optional. Sleeping devices and other network segments can be missed, and classification is heuristic. Passive DHCP capture is not active.
How do decoy tripwires work on a home network?
Classic decoys present an HTTP file directory, a dev-server page, or Home Assistant-style login and error routes. Scouts assemble partial service emulations from observed ports on a shared virtual IP and hostname. Studio Build Mac provides real SSH/SFTP and Samba in an isolated Linux guest with Mac-shaped content; its model and MCP APIs are synthetic. Unexpected activity raises High alerts, and supported requests submitting recognized bait can raise Critical alerts. Operator tests and legitimate scanners can also trigger alerts.
Does it slow down my network?
The sensor uses periodic active scans and bounded service probes, so it generates some network traffic. Resource profiles adjust scan frequency and decoy capacity. It does not passively inspect unrelated traffic; Scouts read service samples and decoys inspect requests sent to them. Automatic connection-baseline learning is not active in this release.
Is SquirrelOps for macOS really free?
Yes, for personal, research, and educational use under PolyForm Noncommercial 1.0.0. Commercial use requires a separate license. Third-party components retain their own licenses. The signed installer, verification instructions, notices, inventory, and source companion are available from the public GitHub release.
Free. Local. Yours.
Free for personal use. Download the signed, notarized installer and verify it against the published checksum before installation.