Who watches your agents? Thunzi does.
Your agents send email, push code and spend money in your name. Thunzi reads what they did on your Mac and tells you when one does something risky that you didn't ask for. Your data never leaves your computer.
For Mac. Will work with Claude Code and Claude Desktop. Codex and Cursor are next. Reads logs only. Never blocks or changes anything.
You asked: "fix the CI deploy step." You did not ask for this.
Is your agent acting like you would?
One view across all your agents
Each AI lab watches its own agent. Thunzi reads across them on your Mac, so you see what every agent did in one place. The first version will read Claude Code and Claude Desktop. Codex and Cursor are next.
Checked against how you work
For each action, Thunzi asks one question: did you ask for this? It compares what the agent did with your recent requests and with the tasks you allowed.
Allow this task (Pro): if you expect a flag, allow it for that agent and task. Thunzi then stops flagging it.
How it works
Your agents send email, push code and spend money for you. Each tool has its own permission prompts, and most of us click through them. You can't read seven thousand tool calls a week. What your agents do still reflects on you.
Reads your agents' logs
Claude Code and Claude Desktop already keep logs of what they do on your Mac. Thunzi reads those logs and does not change them. It does not block anything. You do not need to change your setup.
Checks them against your line
Rules in five areas catch risky actions: Security, Secrets & personal data, Sent as you, Changes & deletes, and Spend. Thunzi also checks whether you asked for the action.
Tells you in one line
Each flag is Red, Yellow or Noted. Red arrives as a notification right away. The rest goes into a short daily digest. Thunzi groups repeats into one card. The card shows a count and a fix that you can copy to the agent.
On first launch, Thunzi reads your last 30 days, so you see results on day one.
Where agents most often cross the line
Five areas, each a tab in the app. Most examples come straight from our own testing.
~/.claude/…/6f1c.jsonl:412
Security
A live GitHub token printed into a transcript. A repo created public. A token parked in /tmp.
vercel deploy --prod .env.local
Secrets & personal data
Secrets or private data headed for a public deploy, a Slack post or a shared file.
to: dana@clinet.co (guessed)
Sent as you
Emails sent to a guessed address. Messages or posts you did not ask for.
crm: 16 contacts updated
Changes & deletes
Records changed in your CRM. Files written outside the project or deleted.
credits: no cap set
Spend
A purchase made around a block. Credits burned with no cap.
Your own rules (Pro). Turn a rule on or off, set its level, or add a phrase to watch for, like “client-acme.” Your changes stay on this Mac.
One line, with a fix ready.
An agent printed a live GitHub token
~/projects/app · Today, 11:22 AM PT · 3 events
git credential fill returned ghp_****Xy9. It is now in plaintext in the session log, line 412.
You asked: “fix the CI deploy step.” You did not ask for this.
An agent emailed a customer without you
Your rule: “Never email a customer without me.”
To: dana@client.co · Oct 3, 4:08 PM PT
Every alert answers five questions: what happened, where, when, did you ask, and what to do.
Your agents, your Mac.
How Thunzi is built:
- Logs are read, never changed. Thunzi never blocks your agents.
- Secrets are masked before Thunzi stores anything.
- When you copy or export a finding, Thunzi masks secrets. It shows only the first 4 characters.
- Findings live in a local database on your Mac. Nothing is sent off it.
- No content telemetry. No open ports.
- Made for individuals running agents on their own Mac.
Everything stays on your Mac.
Why Thunzi
Isithunzi is the isiZulu word for shadow. It also means dignity: the standing and respect a person carries, which their actions can build up or wear down. Its root, umthunzi, is shade, the cool cover of a tree. Thunzi is your shadow on every agent, keeping what they do in line with your values and covering you without getting in the way.
Say it TOON-zee.
We ran it on our own agents first.
Before building the app, we replayed one week of one founder's agents (7,466 tool calls, 16 agents) through Thunzi's rules.
We keep testing every rule against a masked replay set of real incidents.
Real Thunzi v0 output, personal data masked · Aug–Sep 2026
Emailed a guessed address after a bounce (4×)
to user01@…
Did you ask?
No. The agent picked an address after the real one bounced.
Fix
After a bounce, stop and ask.
Made a repo public
Did you ask?
No. You never said “public”.
Fix
Default to private.
Secret printed into a log: gho_****
Did you ask?
Doesn't matter. Approval can't clear a leaked token.
Fix
Rotate it, and never print credential output.
FAQ
Who is Thunzi for?+
Anyone running AI agents on their own Mac: founders, developers, solo operators, power users.
Which agents does it work with?+
The first version will work with Claude Code and Claude Desktop. Codex and Cursor are next.
Does it block actions?+
No. Thunzi will only read logs and tell you. It will never stop or change what an agent does.
Does my data leave my Mac?+
No. Thunzi will read and store everything on your Mac, with no telemetry. When you copy or export a finding, Thunzi will mask secrets and personal data first.
Can I set my own rules?+
Yes, on Pro. Thunzi will start with rules in five areas: Security, Secrets & personal data, Sent as you, Changes & deletes, and Spend. On Pro you'll be able to turn rules on or off, change their level, add a phrase to watch for, and always allow a task you trust. On Free you'll see every rule.
What do Red, Yellow and Noted mean?+
Red means look now, and Thunzi will send a notification. Yellow means look when you can. Noted is kept as a record, with no alert.
Will there be a free version?+
We plan a Free tier and a Pro tier. Free is planned to include the first 30-day scan, all local agents, live Red alerts for Security and for Secrets & personal data, a basic daily digest and 7 days of history. Pro is planned to add rule editing, Always allow, live alerts in all five areas, the full daily digest, full history and export. Pricing isn't set yet.
Where will Thunzi live on my Mac?+
In the menu bar. On a MacBook with a notch, a full menu bar can hide the icon. Thunzi will tell you the first time this happens, and you can open it with Command-Shift-T or from the Dock.
What does the name mean?+
Isithunzi is isiZulu for shadow, and also for dignity: the standing and respect a person carries. Umthunzi is shade, the cover of a tree. Thunzi is your shadow on every agent, holding it to your values while staying out of your way.
How do I say it?+
TOON-zee. The th is a soft t, as in “top.”
When can I use it?+
Not yet. We're building the Mac proof of concept now. Join the waitlist and we'll email you when early access opens.
How do I monitor what my Claude Code agent does?+
Claude Code keeps a log of each session on your Mac, including the commands it ran and the files it touched. You can read those logs yourself, but they get long fast. Thunzi will read them for you and flag the actions to check, such as a printed token, a public repo or an email you didn't ask for.
Can AI agents leak secrets or API keys?+
Yes. An agent can print a token into its session log, paste a key into a file it shares, or send private data in a message. In our own testing an agent printed a live GitHub token into a log. Thunzi's Secrets & personal data rules are built to catch this, and each alert will tell you how to fix it, for example by rotating the token.
Is there a tool to audit AI agent actions on a Mac?+
Thunzi is being built for exactly this. It will read the logs your agents already keep on your Mac and flag the actions that cross a line, including ones you didn't ask for. It will run locally and never block anything. It's not available yet; you can join the waitlist.
Does it watch Claude Desktop scheduled tasks?+
Yes. Scheduled tasks run as Claude Desktop sessions, and Thunzi will read those logs like any other session. Each finding will show the task's name, so you can see which routine did what.
How is Thunzi different from the permission prompts in Claude Code?+
Permission prompts ask before each step, inside one agent. Thunzi will look back afterwards, across the agents it reads, and ask whether you actually wanted what happened. Many people approve prompts quickly, so a second look catches what slipped through.