xinbetween

Flowlight — Data skill for Claude Code

Data community

Native macOS network monitor: see every app's traffic to every domain, and watch AI agents for data leaving your Mac.

How to install Flowlight

This entry records only its repository, not the path inside it, so there is no exact command to give. Open xinbetween/flowlight and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What Flowlight does

Native macOS network monitor: see every app's traffic to every domain, and watch AI agents for data leaving your Mac. Free, open source, no telemetry.

Alternatives in Data

Financial Services — Reference agents, skills, and data connectors for the financial-services workflows we see most — investment ba 34.5k ★
Claude Code Usage Monitor — by Maciek-roboblog - A real-time terminal-based tool for monitoring Claude Code token usage 7k ★
Arcgis To Portaljs — Migrate a whole ArcGIS Hub site (opendata.arcgis.com or a Hub Premium custom domain) into a PortalJS Arc porta 2.3k ★

README

Flowlight

**See every connection your Mac makes, and every move your AI agents make.**

A native macOS network monitor that ties each byte to the app that sent it and the domain it went to. It watches AI agents for the things you'd never approve: emailing files, opening SSH sessions, or uploading your repo while you're away.

[**Download for macOS**](https://github.com/xinbetween/flowlight/releases/latest/download/Flowlight.dmg) · [Website](https://flowlight.xinbetween.com) · [Build from source](#build-from-source) · [How it works](#how-it-works)

![macOS 15+](https://img.shields.io/badge/macOS-15%2B-111?logo=apple) ![Swift](https://img.shields.io/badge/Swift-6-F05138?logo=swift&logoColor=white) ![License: GPL-3.0](https://img.shields.io/badge/license-GPL--3.0-4a3aa7) ![No telemetry](https://img.shields.io/badge/telemetry-none-1baf7a)

Flowlight's AI Agents view listing Claude Code, Cursor, Codex and a Python script, with risk badges for SMTP, SSH, FTP, a large upload and a raw-IP connection

Why Flowlight

Your Mac now runs software that makes its own decisions. Coding agents read your files, run shell commands and call tools, and any of those tools can open a socket. Activity Monitor shows *how much* traffic there is. A firewall asks you to allow *each* connection. Neither answers the question that matters now:

**What are my agents talking to, besides their model provider?**

Flowlight answers that for every app on your Mac, then goes deeper for AI agents.

Features

Every app × every domain × every protocol

Per-app attribution for every TCP and UDP flow, including CLI tools and background daemons, not just windows.
Real hostnames, not bare IPs. Taken from TLS server names and DNS answers seen on the wire, with an optional fallback to the network owner (*Cloudflare,