keepmum 0.1.0 alpha 2

The second alpha of keepmum adds two optional checks that run on your Mac, a switch for personal data, and updates: from this version on, the app updates itself.

Alpha. keepmum works end to end, but it has not been audited and things will change. Treat it as a safety layer, not a guarantee, and see Limitations.

Install

1. Download Keepmum-0.1.0a2.dmg below, open it, and drag Keepmum into Applications.
2. Open Keepmum and follow Settings › Setup.

From 0.1.0a1: quit Keepmum, then drag the new version into Applications to replace it. That is needed once: 0.1.0a1 cannot update itself, and this version can.

Needs a Mac with Apple silicon and macOS 14 or later. The app is signed and notarized by Apple.

To check the download: shasum -a 256 -c Keepmum-0.1.0a2.dmg.sha256

What's new

• Updates. On its first launch the app asks whether to check for updates once a day. A check downloads keepmum's update list from github.com, so GitHub sees your IP address and keepmum's version; nothing else is sent. Updates are signed by keepmum and notarized by Apple, and both are checked before one is installed. Settings › Updates has "Check now", and can download and install updates automatically.
• A prompt-injection check (optional, off by default). It looks at what tools return (web pages, files, MCP replies) for instructions planted for your agent. Warn logs a hit and sends the request; Block refuses it. It uses Horizon Labs' Prompt Injection Guard Small (Apache-2.0), a 164 MB download that runs locally on the GPU.
• A harm check (optional, off by default). It looks at what you type for requests a company policy may not allow, and names their categories. Three model sizes are available: Small (164 MB, the default), Qwen3Guard 0.6B, and Qwen3Guard 4B (the most accurate).
• Settings › Checks sets both checks up. What they flag shows on the Logs and Activity pages, and keepmum guard does the same on the command line.
• Personal data has its own switch in the app and keepmum pii on|off. Every setting that used to need config.toml now has a place in the app.

Known limitations

• The checks are an early warning on top of masking, not a replacement for it. The injection check flags about 9% of security writing that quotes attacks, so warn suits security work better than block.
• Shell commands still receive real values (so git push works). The host check stops the common case, but a command built to hide where it sends things gets past it. Use a sandbox with a network allowlist alongside keepmum.
• Your agent's local transcripts hold real values: keepmum protects what leaves your Mac, not what is stored on it.

Feedback and bug reports are welcome in Issues.