Every app on your Mac is talking to the internet - I built a map of it (zero telemetry)

Your Mac makes hundreds of outbound connections every hour, including updaters, analytics SDKs, crash reporters, and CDNs. These connections are not visible unless you specifically look for them. Tools like lsof -i or Little Snitch provide some visibility, but they come with limitations. To address this need, the developers built Snitch, an open-source, local-first network traffic visualizer for macOS.

Snitch offers a live graph of every outbound connection, grouped by process, a world map plotting destination IPs, per-app breakdowns of bytes in/out, destinations, and an anomaly alert system when a process connects to a new destination. The tool also features a demo mode for exploring the UI with synthetic data and does not require root access.

Privacy is a key focus; Snitch's network monitor only binds to 127.0.0.1, and no destination IP ever leaves the machine. Anonymized GeoIP lookup is performed against a bundled database. Snitch's backend is written in Python using FastAPI, and it polls nettop / lsof to attribute per-process connections. Connections stream to the React frontend over a token-authenticated WebSocket, rendered as a force-directed graph and an SVG world map.

While Snitch visualizes connections, it does not block them, leaving blocking functionality to complementary tools like LuLu. Currently, the macOS build is unsigned, but builds for Windows and Linux are planned. Snitch is AGPL-3.0 licensed and free forever, with bilingual documentation available in English and French. The project encourages contributions, with four good first issue tickets available for those interested in getting involved.