netmon

NetWatch is a real-time network diagnostics tool that runs in the terminal as a single, configuration-free binary. It captures network activity, attributes connections to processes where available, decodes application-layer protocols, fingerprints clients with JA4, tracks streams, and displays connections, interfaces, packets, protocol statistics, topology, timelines, per-process bandwidth, and egress destinations. Its diagnostic engine learns baselines, applies diagnostic rules, ranks possible causes, and records issues through verified closure. Egress linting observes destinations, promotes policies, and alerts when activity drifts from them; the tool also supports TLS 1.3 decryption for user traffic, PCAP export, display filters, beaconing and DNS-tunneling analysis, and Prometheus metrics. NetWatch provides full, lite, and dense terminal views and can run without elevated privileges for basic information, while capture features may require sudo or Linux capabilities. It is distributed for macOS, Linux, Windows, and other platforms through package managers, binaries, and a container. The repository is MIT-licensed; optional LLM commentary in the Diagnose view is disabled by default.

numbat is an open-source endpoint security tool for monitoring AI-agent activity across supported desktop, CLI, IDE, and gateway agents. It combines local hooks and plugins, OTLP/HTTP logs, and on-disk session artifacts, normalizes live and stored activity into a common event model, and evaluates it locally with built-in, sequence-based, or custom YAML CEL rules. The tool can produce NDJSON events, findings, enforcement decisions, indicators, and scan summaries for alerting and forensic reconstruction, including read-only artifact scans, per-session timelines, and portable case bundles with SHA-256 manifests. Optional pre-action blocking is disabled by default and is limited to supported synchronous hooks and explicitly enforced rules. It is distributed as a single cgo-free binary for macOS, Linux, and Windows, with read-only inventory and scanning commands.

TapMap is a local network-observability application that monitors a computer's active connections, enriches their IP addresses with GeoIP data, and displays them on an interactive world map. It uses psutil on Windows and Linux or lsof on macOS to scan sockets, extracts IP addresses, performs local GeoIP lookups, and renders the results with Dash and Plotly. TapMap identifies applications and network operators, shows local and unmapped services, and provides application verification details, open-port views, notifications, and MQTT publishing for significant connection events. It maintains a rolling 30-day history covering new and frequent applications, providers, countries, ports, and activity patterns, with a daily activity report. The application runs locally as a web server and is available as Windows, Linux, and macOS desktop distributions, with Docker support on Linux hosts. It states that it collects data locally and sends no telemetry or analytics. TapMap is developed by Ola Lie at TIP Teknologi i Praksis AS and is released under the MIT License.

Nmap, the Network Mapper, is a network-discovery and port-scanning tool for identifying devices, open ports, operating systems, and services. It can scan targets such as a home-lab network and includes Zenmap as a graphical front end. The project provides source code and binary installers for Windows, macOS, and Linux, and is released under a custom license based on but incompatible with GPLv2; commercial redistribution licensing is also available.

Monid is an API and connector framework for AI agents, providing one base URL and key for discovering and calling tools across providers. Its catalog covers services such as web search, scraping, enrichment, social data, reviews, market data, and media generation. The discover operation ranks candidate endpoints across providers for a task and returns pricing, live health, observed p50 and p95 latency, and alternative endpoint hints. Providers and endpoints are defined declaratively with authentication, metadata, request schemas, timeouts, and usage models. The engine validates inputs, builds and sends provider requests, settles usage against the raw response envelope, maps outputs, and validates the final result; provider errors are returned as data and settle at zero usage. Connectors run locally with vendor credentials, in fixture-based offline tests, or on the hosted platform with credentials injected into the transport. The open-source repository requires Deno 2.x and includes catalog, compilation, execution, recording, and replay-test tooling. It is licensed under the MIT License.