AI Access Auditor finds every permission, folder, login and privilege your AI agents have, pops up the moment that changes, and lets you take any of it back with one click.
macOS 13 Ventura or later · Windows 10 and 11 · Linux: Ubuntu 22.04, Debian 12 or later, and similar · Nothing else to install
Checks the agents you already use
Why it exists
AI agents collect access quietly: an "always allow" here, a trusted folder there, an MCP server with your GitHub token, a terminal running in YOLO mode. AI Access Auditor puts all of it in one place.
Tool permissions, trusted folders, MCP servers, agent skills, AI tools being installed, saved logins, browser and editor extensions, background jobs and macOS privacy permissions.
When any agent gains new access, a window asks you to keep it or remove it, within seconds.
Approve or deny commands and file changes from Claude Code, Codex CLI and Gemini CLI in one native popup, even when they run in "YOLO" mode.
Spots agents started with --yolo, --dangerously-skip-permissions and similar flags, or running as root, and stops them if you ask.
Every change is backed up first. Restore anything from History at any time.
Allow a folder or tool for an hour, a day or a week. It's removed automatically when the time is up.
If a script or tool an agent started sends data out, or any app uploads a lot, you see where it's going and which files it has open. Stop it or allow it.
When a new AI agent, MCP server, skill or plugin is set up, by you or by an agent, it tells you what it is, what it's connecting to, and offers to put it behind Allow / Deny.
Lists the skills your agents load on their own, and flags the ones that bring scripts or reverse-engineering tools. Remove one with a click.
Live protection
A small shield lives in your menu bar. It watches your agents' settings and running processes in the background and asks you the moment something changes.
Plain language
Every grant comes with a risk level and a one-line explanation, like "the agent can run any shell command without asking", so you can decide in seconds.
How it’s different
Other tools look at AI agent setups too, mostly by scanning MCP server configs and listing problems. AI Access Auditor is built around four things they usually don’t do.
Most scannersTell you about risky settings after they’re already in place.
AI Access AuditorShows an Allow / Deny popup before Claude Code, Codex CLI or Gemini CLI acts, and offers it the moment a new agent is installed. Saved answers can be taken back later.
Most scannersFocus on MCP servers and their tool descriptions.
AI Access AuditorAlso checks macOS privacy permissions, background jobs, extensions, agents running with safety off, AI tools being installed, data leaving your Mac, and the access agents quietly get from your own logins: sudo, SSH keys, GitHub, AWS, gcloud and Kubernetes.
Most scannersReport the issue and leave the fix to you.
AI Access AuditorRemoves, turns off or stops each item in one click, backs up the file first, and can undo it from History.
Most scannersAre written for security engineers, often run from the Terminal.
AI Access AuditorA desktop app for Mac, Windows and Linux with a safety score and a one-line explanation of every permission, so anyone can decide in seconds.
Privacy
A security tool shouldn't create a new risk. AI Access Auditor has no account and no tracking. The only thing it asks the internet is whether a new version is out, once a day, and you can turn that off.
What it finds never leaves your Mac. It watches other apps' traffic using macOS's own counters, without reading what they send.
Tokens are masked on screen. For Keychain items it reads only names, never the passwords.
It never removes access on its own, except for time limits you set yourself.
Every change is backed up first. Your data is in one folder you can delete.
Install
The Mac app is signed and notarized by Apple, so it opens like any other app.
Drag AI Access Auditor into the Applications folder.
Double-click the app in Applications. The first time, macOS checks that it's an app downloaded from the internet. Click Open.
It walks you through Full Disk Access, the Allow / Deny popups and Open at Login. You can change everything later.
When a new version is out, the app tells you once, with a link to download it. Install it the same way, over the old one.
For most PCs: Windows (x64). For ARM PCs, such as Snapdragon laptops: Windows on ARM (not tested yet). It installs for your account only, without administrator rights.
The Windows version isn't signed yet, so Windows may say Windows protected your PC. Click More info, then Run anyway. Then follow the welcome screen.
Download the .deb for your computer: Intel or AMD (x64) or ARM (arm64). Then install it from the Terminal: sudo apt install ./AI-Access-Auditor-*.deb
Download the AppImage, make it executable and open it: chmod +x AI-Access-Auditor-*.AppImageOn Ubuntu 22.04 or later, AppImages also need libfuse2: sudo apt install libfuse2t64(on 22.04 the package is called libfuse2).
FAQ
Yes. It's free to download and use.
Windows programs need a paid code-signing certificate to install without a warning, and the Windows version doesn't have one yet. The steps under Install show how to run it. The Mac app is signed and notarized by Apple.
Macs with macOS 13 Ventura or later, Apple Silicon and Intel. Windows 10 and 11. On Linux: Ubuntu 22.04, Debian 12 or later and similar distributions, on x64 and ARM. Everything it needs is included, so there's nothing else to install.
For Claude Code, Codex CLI and Gemini CLI, yes. Turn on "Ask before it acts" for each one on the Overview, and you approve actions before they run. With Claude Code and Codex, the popup replaces the agent's own prompt. With Gemini, it steps in when Gemini would otherwise act without asking (YOLO or auto-edit mode). Codex asks you to trust the new hook once: type /hooks inside Codex. Other agents don't offer a way to be paused from outside, so for them you're alerted within seconds of any new access, and can remove it right away.
MCP scanners such as Snyk Agent Scan look deeply at MCP servers, for example checking their tool descriptions for hidden instructions. AI Access Auditor doesn’t do that deep analysis. It covers the wider picture instead: every kind of access your agents have, a popup before Claude Code, Codex or Gemini acts, and one-click removal. The two work well side by side.
It can stop the program that's sending it, and it asks you first. It can't block a single connection while letting the program run. That needs a network filter, like the free LuLu firewall, and the two work well together. It checks every 2 seconds, so a very short upload can slip past it, and it shows the IP address rather than a website name, because looking names up would mean contacting the internet.
Only to read macOS's list of which apps can record your screen, control your Mac or read all your files. Without it, everything else still works. Those system permissions just aren't included.
~/.ai-access-auditOn Linux, turn off the same switches, quit it from the tray icon, then remove it with sudo apt remove ai-access-auditor (or delete the AppImage).
On Windows, turn off the same switches, quit it from the tray icon, then uninstall it in Settings → Apps → Installed apps.
Free for macOS 13 or later, Windows and Linux.
Download AI Access Auditor Windows Linux