Zyvor · network intelligence

See every connection on your Mac.

Which app is talking to what, over which interface. Per-app flows, DNS, routes, VPNs, listeners and FluxVM workloads in a native SwiftUI app with a dependency-free collector. Local-first and observe-first: no payloads, no uploads, nothing blocked unless you say so.

Try the live demo Download 0.5.2 View source

Observe-first
macOS 14+
Local-first
Zero-dependency collector
v0.5.2
FluxVM aware

Nivora Flows pane, simulated telemetry, light appearance — Native app, Flows pane. Demo capture on simulated telemetry (host zyvor-mac-studio), not a real Mac.

Nivora Flows pane, simulated telemetry, dark appearance — Native app, Flows pane. Demo capture on simulated telemetry (host zyvor-mac-studio), not a real Mac.

New in 0.5.2

2026-10-16 · full changelog · feed

Fix: "Collector unavailable" on every Mac that runs FluxVM. FluxVM answers /v1/vms with {"items": [...]} and status; the collector forwarded that object, the native app expects an array, so decoding the whole snapshot failed and the app showed an error for a collector that was running fine. The collector now normalises vms and sandboxes to lists with state (fluxvm_workloads), the egress code accepts the envelope too, and the native decoder is tolerant: an unexpected shape in this optional section can no longer blank the app. Regression tests cover the collector, egress and the Swift decoder with real-shaped data.
Fix: the app no longer flashes "Collector unavailable" while the bundled collector starts (about 3 s). A failed poll within the first 20 s with no data keeps "Starting Nivora…"; once data has been shown a failed poll never replaces it.
Native: when the content-filter extension is not in the bundle the app says so ("Content filter is not included in this build") instead of showing a raw system error.
New: scripts/package-signed.sh builds a Developer ID signed, hardened-runtime, notarized and stapled DMG. It omits the content-filter extension and the capture helper (a plain Developer ID signature cannot carry their restricted NetworkExtension entitlements) and refuses to sign if restricted entitlements are present. package-dmg.sh gains SUFFIX/OUT_DIR and writes a relative checksum file. The GitHub release DMG from CI is unchanged: ad-hoc signed, not notarized.

Take the tour

Six panes of the native app, scrolled through. Every image is a demo capture on simulated telemetry.

Every app, one row
Traffic grouped by application with live download and upload rates, totals and destinations.
Proof: Changelog
Every connection, in the open
Per-flow protocol, remote endpoint, state, interface and round-trip time, filtered with one grammar.
Proof: Filter grammar
A score that shows its work
0 to 100 across route, DNS, latency, interfaces and safety, each component explained.
Proof: Changelog
Rewind the network
A local history of DNS, VPN, listener, interface and traffic-spike events.
Proof: Changelog
Trust, attributed
A per-app trust score where every point maps to a visible check.
Proof: Changelog
Alerts that only explain
Exposed services, DNS that may bypass the VPN, mixed tunnel traffic. Alerts never block.
Proof: Changelog

The Security and Capture panes (content filter, headers-only packet capture) are in the developer build only. They are compile-verified, not tested end to end, and are not part of this tour or of the signed build.

Highlights

Applications

See who is talking.

Traffic grouped the way you think about it: by app, with live rates and destinations.

Proof: Changelog →

Nivora Applications pane, simulated telemetry, light appearance — Applications pane. Demo capture, simulated telemetry.

Nivora Applications pane, simulated telemetry, dark appearance — Applications pane. Demo capture, simulated telemetry.

Flows

Every connection, with its interface.

Protocol, remote, state, interface and RTT per flow, plus a share menu and grouping.

Proof: Filter grammar →

Health

98 out of 100, and why.

A score built from route, DNS, latency, interfaces and safety. Nothing is a black box.

Proof: Changelog →

Nivora Health pane, simulated telemetry, light appearance — Health pane. Demo capture, simulated telemetry.

Nivora Health pane, simulated telemetry, dark appearance — Health pane. Demo capture, simulated telemetry.

Time Machine

What changed, and when.

Events stored locally in SQLite: DNS resolver changes, VPN state, new listeners, spikes.

Proof: Changelog →

Nivora Time Machine pane, simulated telemetry, light appearance — Time Machine pane. Demo capture, simulated telemetry.

Nivora Time Machine pane, simulated telemetry, dark appearance — Time Machine pane. Demo capture, simulated telemetry.

Exports

Take the evidence with you.

CSV, JSON or NDJSON, optionally redacted of private IPs, MACs, SSID and hostname. Never packet payloads.

Proof: Export API →

FluxVM

VMs beside host traffic.

When FluxVM is running, Nivora reads its local API on 127.0.0.1:7788 and shows its VMs and sandboxes. The demo shows the runner process and its vmnet8 interface.

Proof: FluxVM integration →

Pick a pane

Every screenshot is the real native app on simulated telemetry. Or open the dashboard and click around.

Nivora Applications pane, simulated telemetry — Native app · light · Applications · simulated telemetry · Open this pane in the demo

Questions it answers in one glance

Which app is using the network?

Applications grouped the way you think about them, with live ↓/↑ rates, destinations and an inspector per app and per flow.

Find anything fast

One filter grammar (app:Safari port:443 >1mbps !iface:lo0) with chips, saved views, grouping by app, host or interface, and baseline compare.

Is the network healthy?

A 0–100 score with explained components: route, DNS, latency, interfaces and safety, plus a local, offline investigator.

Take the evidence with you

Export flows, apps and the timeline as CSV, JSON or NDJSON, optionally redacted of private IPs, MACs, SSID and hostname.

Capture, only when you ask

Opt-in, headers-only packet capture through a separately approved helper: capped in time and size, downloadable as .pcap.

FluxVM aware

Sees your VMs and sandboxes beside host traffic, via FluxVM's local REST API on 127.0.0.1:7788.

How much should I trust this app?

A 0–100 trust score per app where every point is attributed to a visible check: code signing, new destinations, trackers, cleartext, exposure.

Why is this flow here?

Evidence and plain-language reasons for one connection, plus shadow rules that count what a block would match without enforcing anything.

What changed since it worked?

Diff any two points in the Time Machine and get an incident narrative: health delta, new destinations, DNS, routes and devices.

Policy as code

Keep rules in a file, plan them against the live rule store, apply only when you say so. Dry-run by default; blocks stay leased.

Ask from your tools

A read-only MCP server and a CLI expose summary, flows, explain, diff and path checks. Nothing that changes rules. MCP setup.

Widget and Shortcuts

A small and medium widget and “How is my network?” in Shortcuts and Siri. Compile-verified; not yet seen in the widget gallery. Details.

The CLI, on simulated data

This output was captured when the site was built, from nivoractl against --demo. Nothing here is hand-written.

$ nivoractl health
{
  "score": 97,
  "status": "healthy",
  "median_rtt_ms": 42.0,
  "components": [
    {
      "name": "Route",
      "score": 100,
      "detail": "Default route present"
    },
    {
      "name": "DNS",
      "score": 100,
      "detail": "2 resolver(s)"
    },
    {
… 16 more line(s)

$ nivoractl trust
[
  {
    "app": "Google Chrome",
    "score": 80,
    "level": "high",
    "flows": 1,
    "components": [
      {
        "name": "Code signing",
        "points": 20,
        "max": 40,
        "detail": "Signing identity not verified (collector could not read it)."
      },
      {
        "name": "Destination novelty",
        "points": 25,
… 290 more line(s)

$ nivoractl explain f1
{
  "flow": {
    "id": "f1",
    "process": "Google Chrome",
    "pid": 510,
    "bundle_id": "com.google.Chrome",
    "protocol": "tcp",
    "local": "192.168.1.42:53001",
    "remote": "142.250.183.14:443",
    "state": "ESTABLISHED",
    "bytes_in": 2629906002,
    "bytes_out": 126252420,
    "rx_bps": 1487045.59,
    "tx_bps": 74352.28,
    "total_bps": 1561397.87,
    "interface": "en0",
… 27 more line(s)

$ nivoractl policy-plan work.json
{
  "dry_run": true,
  "name": "work",
  "add": [
    {
      "domain": "example.com",
      "action": "shadow",
      "note": "policy:work"
    }
  ],
  "remove": [],
  "unchanged": []
}

How it fits together

A native app and a browser dashboard speak the same local JSON API. The collector is a single stdlib-only Python file.

            Nivora.app (SwiftUI)  /  browser dashboard
                          │  HTTP JSON · 127.0.0.1 · bearer token
                      nivora.py   (Python stdlib only)
          ┌───────────────┼────────────────┐
   NetworkExtension    nettop · lsof     FluxVM :7788
   content filter      ifconfig · netstat  VMs · sandboxes
   (signed, opt-in)    scutil · arp · ndp
          └───────────────┴──────→ SQLite time machine

Visibility tier	Needs	Gives you
Collector fallback	Nothing: works today	Per-app flows and byte counters from `nettop`/`lsof`, interfaces, routes, DNS, VPNs, neighbours, listeners
Content filter	Signed build and Apple's entitlement	Per-flow app attribution and byte reports straight from the system
Capture helper	Signed build and your approval	Headers-only .pcap of one flow, host or app, for a few minutes

What is verified, and what is not

Copied from the repository README at build time, so the site never claims more than the repo does.

Area	Status
Collector, API, dashboard, CLI, exports, filters	Built and tested in CI (Python, Node)
Native app (SwiftUI) and unit tests	Builds and runs unsigned with Xcode; XCTest suite passes
Content filter (system extension) and capture helper	Compile-verified only. Signing, entitlement approval, activation and root capture are untested; they need a provisioned, signed Mac
Insights pane, Shortcuts/Siri actions, widget	Build and unit tests pass; the widget in the macOS widget gallery and the Shortcuts/Siri phrases are not exercised
Release DMG from GitHub (free)	Ad-hoc sealed, unsigned by a Developer ID, not notarised (Gatekeeper asks for Open Anyway)
Signed and notarized build (`scripts/package-signed.sh`)	Verified on macOS 27.2, Apple silicon: Apple notarization accepted, stapled, Gatekeeper accepts the DMG and the app (also with a download quarantine flag), the app launches and its bundled collector serves data the app decodes (checked against a real FluxVM). It deliberately leaves out the content filter and capture helper. Not exercised: other macOS versions, Intel (the app is arm64 only)

Private by design

Local-first

No account, no cloud, no telemetry upload. The API listens on loopback with a random bearer token.

Observe-first

Rules default to observe. Block rules are one-hour leases and need the signed content filter to take effect.

No payloads

Flow metadata only. The one exception, packet capture, is off until you start it, headers-only, capped and deleted after 24 hours.

Get Nivora

Nivora is early. Free for personal, non-business use. If you use it in a business, buy a licence: ₹299 including GST (about US$2.99), one-time, for the build you choose. Foreign cards pay the same rupee amount, converted by your bank.

Signed & notarized

Signed with our Apple Developer ID and notarized, so it opens without a Gatekeeper warning. It uses the built-in collector; it does not include the content filter or the capture helper, which need Apple entitlements we do not have.

₹299 incl. GST · business-use licence

Buy the signed app

Developer build

Includes the content-filter and capture-helper code. It is not signed or notarized: Apple restricts the entitlements those need, so it cannot be notarized here, and macOS will not activate them unless you sign it yourself with your own Developer ID and provisioning profile. Those parts are compile-verified only, not tested end to end.

₹299 incl. GST · business-use licence

Buy the developer build

A purchase licenses business and commercial use of that version and later ones on machines you own or operate. It does not cover redistribution or resale. Several companies or a larger rollout: sales@zyvor.dev. Licence terms. After payment you get a GST invoice and a download link by email.

The free builds are unsigned (personal, non-business use)

The downloadable app is not signed or notarised, so macOS Gatekeeper blocks the first launch with “Nivora” cannot be opened because the developer cannot be verified. This is expected. You have three options:

Build it yourself (below). A locally built app is never quarantined.
Open Anyway. Try to open the app, then go to System Settings → Privacy & Security, scroll to Security and click Open Anyway. On macOS 14 you can instead Control-click the app and choose Open.
Terminal: xattr -dr com.apple.quarantine /Applications/Nivora.app, only after checking the download against SHA256SUMS.txt.

Details and uninstall steps: the install guide.

Nivora 0.5.2 for Mac

Apple silicon · macOS 14 or later · unsigned, not notarised (see the notice above).

Download Nivora-0.5.2.dmg

SHA-256

9ee24b4386c78d97e6f34fb878341e7e9dca3e775d7c2df2895bd6de0eeba99d

Verify: echo "9ee24b4386c78d97e6f34fb878341e7e9dca3e775d7c2df2895bd6de0eeba99d Nivora-0.5.2.dmg" | shasum -a 256 -c

Or with Homebrew (Apple silicon, same unsigned build):

brew install --cask zyvorai/tap/nivora

# try it with simulated data, no install
python3 agent/nivora.py --demo

# monitor this Mac (dashboard + API on 127.0.0.1:9857)
python3 agent/nivora.py

# build the native app (needs Xcode and xcodegen)
brew install xcodegen
./scripts/build-native.sh
open native/build/Build/Products/Release/Nivora.app

Releases Full quickstart Install guide Signing and entitlements

FAQ

Does Nivora see inside my traffic?

No. It records which app talks to which endpoint, how much, and over which interface. Packet capture is a separate, opt-in feature that keeps only packet headers by default.

Does it block anything?

Not by default. Rules start in observe mode. Blocking needs the signed content-filter extension and your explicit rule, and expires after an hour unless made permanent.

Why does the demo show the same apps every time?

The hosted demo runs the real dashboard on simulated telemetry. A web page cannot read your processes, so the banner says so on screen.

What is tested and what is not?

The collector, API, dashboard and native app are built and tested with Python, Node and Xcode (unsigned). Signing, extension activation and the privileged capture helper have not been tested on a provisioned Mac; the docs say so.

macOS says Nivora can't be opened. Is it broken?

No. Release builds are unsigned and not notarised, so Gatekeeper blocks the first launch. Use System Settings → Privacy & Security → Open Anyway, or build the app yourself. See the install guide.

Which macOS versions?

macOS 14 or later. The app is SwiftUI with the Netra design language, shared with the browser dashboard.

See every connection on your Mac.

New in 0.5.2

Take the tour

Every app, one row

Every connection, in the open

A score that shows its work

Rewind the network

Trust, attributed

Alerts that only explain

Highlights

See who is talking.

Every connection, with its interface.

98 out of 100, and why.

What changed, and when.

Take the evidence with you.

VMs beside host traffic.

Pick a pane

Questions it answers in one glance

Which app is using the network?

Find anything fast

Is the network healthy?

Take the evidence with you

Capture, only when you ask

FluxVM aware

How much should I trust this app?

Why is this flow here?

What changed since it worked?

Policy as code

Ask from your tools

Widget and Shortcuts

The CLI, on simulated data

How it fits together

What is verified, and what is not

Private by design

Local-first

Observe-first

No payloads

Get Nivora

Signed & notarized

Developer build

The free builds are unsigned (personal, non-business use)

Nivora 0.5.2 for Mac

FAQ