M Modore
v0.3 · Mac Edition / Windows Edition

A local audit of what your AI agents left behind.

On a Mac where Claude Code, Codex, Gemini, or an AI IDE has been working, Modore answers the questions no other tool asks: which sessions touched which projects, which transcripts quietly expire in days, and which worktrees hold the only copy of unpushed work — deterministically, with no LLM in the judgment path. The same evidence-first approach also covers the PC that feels busy for no reason.

Run from source → Read the source
Free · MIT open source · No install · Readable source
AI SESSIONS · MAC EDITION

A deterministic map of what agents left behind.

scree joins Claude Code, Codex, Gemini CLI, and VS Code-fork session stores by workspace and repository — metadata-only, no LLM anywhere in the judgment path. Every verdict is preview-grade evidence with an explicit revalidation duty.

Cross-tool join

Which tools touched which workspace/repository, when — across Claude Code, Codex, Gemini CLI, and VS Code-fork stores.

Retention forecast

Per-store rolling windows estimated from file ages, with D-day flags for sessions about to expire inside still-active projects.

Sole-copy judgment

Agent worktrees and primary checkouts stranded off main: protected (dirty or unpushed) versus rebuildable, from read-only git evidence.

Orphans & lineage

Sessions pointing at vanished workspaces, and every remembered work path classified alive+git / alive+plain / vanished.

No-content-leak contract

Leading JSONL lines are decoded in memory but message content is never retained or emitted; nested transcripts are attributed by stat() without being opened — pinned by tests.

scree — session & residue audit scripts/scree.py · GitHub 
$ python3 scripts/scree.py
Modore scree — a map of what agents left behind (metadata-only · deterministic join)
stores: claude-code 148 · codex 2807 · gemini-cli 103 · vscode-fork 30
12 groups — cross-tool 5 · orphan 3 · unresolved sessions 0
work paths 422: alive+git 118 · alive+plain 189 · vanished 115

  expiring soon (within D-7) 4 — alive workspaces 3 · orphaned 1
    D-0 ~/IdeaProjects/starter-series (claude-code, 222MB)

worktree anchor judgment (git registry · push state, read-only)
  total 34 — protected (sole-copy) 14 · rebuildable 19 · stray checkouts 11
Recognized software
IPinside nProtect INISAFE MagicLine4NP WIZVERA Veraport XecureWeb TouchEn nxKey AhnLab V3 Alyac (알약) KakaoTalk Naver Whale Hancom Office HOffice Realtek Audio NVIDIA GeForce Docker Desktop Python · Node.js Chrome · Edge · Firefox
PROBLEM

Why is my PC this busy?

A slow PC, spinning fans, high CPU/GPU, and unknown startup entries create real anxiety. A Korean PC also carries banking, government, and e-commerce security plugins that often look suspicious. Modore gathers evidence before you ignore everything or delete the wrong thing.

⚠Generic scanner

"30 suspicious items detected."

  • SUSPECTI3GProc.exeUnsigned net hook
  • SUSPECTnosstarter.exePort listener
  • SUSPECTMagicLine4NP.exeKernel driver
  • SUSPECTWIZVERA.exeBrowser hook
  • SUSPECTINISAFEWeb.exeAlways-on
  • + 25 more...

🩺Modore

"29 are banking software. 1 needs review."

  • NORMALI3GProc.exeIPinside, normal
  • NORMALnosstarter.exeINISAFE, normal
  • NORMALMagicLine4NP.exeDreamSecurity
  • NORMALWIZVERA.exeE-signature tool
  • NORMALINISAFEWeb.exeBanking security
  • CHECKMPSch.exeUnknown → VT check
HOW IT WORKS

8 diagnostics → 1 HTML report.

No tracking installer. OS-specific scripts collect system state, then Windows assembles an HTML report while Mac uses a system-component SwiftUI utility plus HTML export.

01 · COLLECT

Collect

Processes, network, ports, autoruns, security posture. Sysinternals + launchd + VirusTotal hash lookup.

scanner.ps1 · scanner.sh
→
02 · NORMALIZE

Normalize

Match against Korean software whitelist, assign traffic-light verdict. OS-agnostic schema.

scan_result.json
→
03 · RENDER

Render

Windows gets a single HTML report. Mac gets a native SwiftUI utility plus HTML export. No tracking installer or report upload.

scan-result.html
PRIVACY · AUDITABLE

Don't take "we're safe" on faith — read the code.

Every network call is in the source. VirusTotal lookups send only the SHA-256 hash; file contents never leave your machine. Here's the actual call site.

Hash only, no file upload

Get-FileHash computes SHA-256 locally. The GET request carries just the hash. If the hash is unknown, we return "unknown" — we never upload the file.

Zero telemetry

No usage stats, no error reports, nothing sent to us. Diagnostic runtime outbound calls are limited to opt-in VirusTotal lookups and optional Sysinternals downloads.

Local cache only

VT responses cache in %LOCALAPPDATA% (Windows) or ~/Library/Caches (macOS) for 48h. No cloud account, no sync.

Source you can read

Readable PowerShell · Bash · JXA source. Release zips do not bundle prebuilt diagnostic binaries. grep -R "Invoke-RestMethod\|Invoke-WebRequest\|curl\|virustotal.com/api" scripts/ finds outbound calls.

scripts/vt-lookup.ps1 L142-L160 · GitHub 
# Compute SHA-256 hash - local only
$hash = (Get-FileHash -Path $FilePath -Algorithm SHA256).Hash.ToLower()

# VirusTotal API v3 lookup - hash only, no file upload
$url     = "https://www.virustotal.com/api/v3/files/$hash"
$headers = @{
    'x-apikey' = $apiKey
    'accept'   = 'application/json'
}

try {
    $resp = Invoke-RestMethod -Uri $url -Headers $headers -Method Get
    return $resp.data.attributes.last_analysis_stats
} catch {
    if ($_.Exception.Response.StatusCode -eq 404) {
        return 'unknown'   # unknown hash - no upload
    }
}
SOURCE PREVIEW

Review and build the source.

No public installer is available yet. Run the reviewed source, or wait for a release with signing, notarization, Gatekeeper, and SHA-256 metadata.

MAC

Mac Edition

macOS 13+ SwiftUI app via run-mac-app.command; script mode via scan.command → Open. The AI-agent session audit (scree) and System Data/Developer storage decoding are Mac Edition features.

View Mac source → WIN

Windows Edition

Windows 10 / 11 · PowerShell 5.1. Review the source, then run scan.bat.

View Windows source →

Clone or fork: github.com/heznpc/modore. Inspect the readable source yourself.

No sign-up, no email, no upload — verify it yourself.

Read the source →