Know who is really asking
before you click Allow.

What whoRU answers while the dialog is still open

What the first question cannot settle. Any program can ask macOS to display an alert, and macOS draws it with the same process, and the same appearance, it uses for a genuine permission prompt. Nothing in that window tells them apart. whoRU falls back on the system’s own record of the request, and when there is no record it says the prompt could not be confirmed instead of vouching for it. Under strict, such a dialog cannot be green.

↓ a few seconds later, optionally

Hard evidence in 0.3 seconds. The model comes after.

What a scan of the Claude Code binary looks like from the terminal today, without AI and then with the Claude Code engine. The deterministic verdict is on screen before any model runs.

  0.00s  subject  2.1.258 · ~/.local/share/claude/versions/2.1.258  [manual_path, high]
  0.11s  ✔ codesign.verify    valid on disk, satisfies its designated requirement
  0.11s  ✔ codesign.identity  Developer ID: Anthropic PBC (Q6L2SF6YDW)
  0.22s  ✔ official_manifest  matches downloads.claude.ai manifest for 2.1.258 (darwin-arm64)
  0.30s  GREEN Safe to allow — Signed by Anthropic PBC and identical to the official release.
  ...
 56.00s  Safe to allow · 90% · allow · fit: matches
        This is the genuine Claude Code tool from Anthropic, and the request fits what it does.
        • The file is byte-for-byte the official Claude Code 2.1.258 release published by Anthropic. [official_manifest]
        • It carries an Apple Developer ID signature issued to Anthropic PBC (team Q6L2SF6YDW). [codesign.identity]
        • It was started from your own terminal session, not by a web browser. [parent_chain]
        ∘ A tool whose job is reading project files plausibly needs a network drive when the project lives on one.

• evidence, from a deterministic check ∘ inference, from the model The two never mix visually.

One menu-bar app. No daemon, no system extension.

Seven components in one process with clear boundaries, so each can be tested alone. Public Apple APIs and standard commands only.

1. 01

   Watcher

   Notices a new permission dialog through the window list and the Accessibility API, reads its text and position, and checks who drew it. Only a window owned by one of macOS’s own dialog processes, signed by Apple as part of the platform, counts as a prompt.

2. 02

   Resolver

   Turns the display name in the dialog into a file on disk, a process, and a bundle identifier, with a confidence level. Two programs with the same name stay amber until the system says which one asked.

3. 03

   Identity

   Reads the system’s own record of the request, which names the responsible process with its process id and path. It confirms the resolver’s answer, corrects it, or reports that the request could not be confirmed. Once confirmed, the process in memory is checked against the file on disk.

4. 04

   Collector

   Runs independent evidence checks in parallel. Each one is a deterministic command or system API whose raw output you can inspect.

5. 05

   HardScore

   Turns the evidence into a red / amber / green floor and ceiling. A broken signature, a revoked certificate, or a process that is not the file on disk is red, no matter what anyone says afterwards.

6. 06

   AI Analyst

   optional

   Receives the evidence bundle and returns a structured verdict. It can lower confidence and raise suspicion. It cannot turn a red into a green, and it can never recommend allowing on an amber score; the app enforces that in code, not in the prompt.

7. 07

   Companion panel

   A glass panel beside the dialog: identity, evidence rows, verdict, and a chat to keep asking. Every scan goes to History.

Every row is a command you can run yourself

Each check is an independent unit with a name, a command or API, a parser and a weight. Fast checks run in parallel with a 4-second timeout; slow ones run after the first results are on screen. Every evidence row opens the command and its raw output.

Optional, slow, on request: lsof -p <pid> -i for current network connections, and a VirusTotal lookup by hash. An impersonation, a name matching a system app or a known publisher whose path or Team ID does not match, is a red finding on its own and is shown first.