FREE · OPEN SOURCE · GPL-3.0 · NO TELEMETRY

See and control what is actually happening on your Windows machine.

A free, open-source outbound firewall. Think LuLu or Little Snitch, for Windows. A startup-program scanner that goes deeper than Task Manager and, unlike Autoruns, watches for new entries. Alerts when an app turns on your camera or microphone. Ransomware detection, DNS visibility and more: eight auditable tools in the spirit of Objective-See.

Download for WindowsView source

Windows 10/11 · x64 & Arm64 · no account · no paywall

THE SUITE

Eight tools. One roof.

Everything observes and reports. Nothing acts on its own: what changes the machine happens only when you choose it, is recorded in a journal, and a block or an allow can be undone.

Persistence scanner

27 autostart surfaces, catalog-aware Authenticode verdicts, and the command line a signed interpreter is handed.

≈ KnockKnock

Outbound firewall

Per-application block/allow enforced through the Windows Filtering Platform. Audit-only until you arm it.

≈ LuLu

Guardian

A decision window the moment a new startup item appears (Allow, Block or decide later), plus reconciliation of what changed while WinSight was off.

≈ BlockBlock

Ransomware detection

Visible decoy files, rename/delete-burst and entropy-on-write heuristics. Opt-in.

≈ RansomWhere?

Camera & mic monitor

Which app turned the webcam or microphone on, now and in the past, matched to its process where possible.

≈ OverSight

Connections & DNS

Connection snapshots and live DNS queries, attributed to processes where Windows exposes an owner.

≈ Netiquette, DNSMonitor

Signature verification

Authenticode, catalog and MSIX package verdicts, used by every tool, and for any file from File Explorer.

≈ What's Your Sign?

Hijack scan

Unquoted service paths, writable directories and phantom DLL imports, graded by exploitability on this machine.

≈ DHS

Plus write attribution, which no macOS original has, and Windows counterparts to TaskExplorer and DoNotDisturb: a per-process drill-down and physical-access evidence. Explore every tool →

THREE WAYS TO USE IT

Dashboard, command line, or your AI client.

Dashboard

A desktop and tray application in English, French and Spanish. Every check explains what it observes and what an alert means.

Command line

28 verbs with --flagged and --json. Exits non-zero when anything is notable, so it drops straight into a scheduled task.

MCP server

Local stdio only, read-only, for MCP-compatible AI clients. No network listener.

# run every check

winsight all

winsight persistence --flagged --json

# one process: lineage, modules, connections

winsight process 4242

# when this machine woke, and whether anyone was there

winsight presence

SECURITY POSTURE

A security tool that never overstates its own protection.

No telemetry, no account

The only outbound connection is an explicit, user-initiated VirusTotal hash lookup: a hash, never file contents.

Authenticated privileged boundary

The dashboard is an unprivileged IPC client. An unelevated administrator is refused exactly like a standard user.

Opt-in enforcement

Nothing is filtered until an elevated operator arms it. There is no command-line path to arming, by design.

Honest state reporting

If enforcement cannot be verified exactly, WinSight reports Degraded rather than claiming Active.

Path-trust hardened

The service refuses to install from any path an unprivileged principal can write, and re-checks NTFS file identity before use.

No kernel driver

Driver-backed interception is deferred rather than half-built: a production driver needs signing and a safety programme.

Read the full security posture and threat model →

Know your machine.

Per-user install, no administrator rights required, no .NET runtime to install. Verify every download with checksums and build provenance.

Download WinSight