Towlby enfour.digital (opens in a new tab)

Towl staging preview

A macOS digital forensics companion for the AI era.

The one who looks for changes, startup entries, background helpers, extensions, commands, agent instructions and source evidence.

See how your Mac evolves as you install and use software. Follow startup entries and AI-agent instructions to their source, and see what changed between scans.

Get TowlExplore app
Towl inspecting launch agents, with the selected entry’s source and launch configuration alongside the findings.

Follow the evidence.

For security professionals, independent researchers, and anyone taking a closer look at their Mac.

See what changed between scans

Compare saved scans for added, removed and modified findings. Scan manually or at chosen intervals while Towl is running.

Changes
Before11 Sep 2026 at 3:38
After6 Oct 2026 at 1:56
Changed only
Substantive changes
Captured examples
NameMechanismEvidence
10 matching changes

Checksums

SHA-256 checksum
−e3cb7fd1f780f4b9a1afaace1407020a119d90e93bfa503e8ba94c734e81976f
+071292aaba65a17f0d64bcb9453d3ad213a8bae53d369ae795b1f6b488fcfe76

Commands and configuration

backgroundTask.generation
−1
+2

Other recorded changes

artifact.fileSize
−180944
+79376
artifact.machO.architectures.0.rpaths.1
−/usr/lib/swift
+Not recorded

Identity

NameIcon Composer
MechanismBackground Task
Identifiercom.apple.IconComposer

Persistence

Source/var/db/com.apple.backgroundtaskmanagement/BackgroundItems-v16.btm
Target/Applications/Icon Composer.app
Finding History

What starts with your Mac

Inspect startup entries, background helpers and scheduled jobs, with the configuration behind them.

Findings
NameEvidence
Launch configuration
Program/usr/bin/ssh-agent
MechanismLaunch Agent
Select an entry to inspect it

Instructions behind your AI agents

Read your agents’ skills and instruction files, with their captured source.

AI Agents
SkillsPersonal
NameAgentsOriginEvidence
Source Changes1 / 1
+ ---
+ name: summarize-technical-meetings
+ ---
+
+ # Summarize Technical Meetings
+
+ Produce shared minutes from an existing transcript. Preserve technical substance and rationale while removing repetition. Use only the transcript and context supplied for the meeting.

Find an entry by name or path

Search a name, path or identifier to find the entry you want to inspect.

All Findings
Name

Select a finding to inspect its identity.

4 sample findings

Extensions, beyond the browser

Explore the additions to your browser, Finder, previews, search and system.

Extensions
Browser Extensions

Identity

NameuBlock Origin Lite Extension
MechanismBrowser Extension
Identifiernet.raymondhill.uBlock-Origin-Lite.Extension

Persistence

Source
/Applications/uBlock Origin Lite.app/Contents/PlugIns/uBlock Origin Lite Extension.appex/Contents/Info.plist

Security settings worth a closer look

Inspect authentication configuration and access-related evidence, with the relevant source in view.

/etc/pam.d/sudo
Source/etc/pam.d/sudo
1# sudo: auth account password session
2auth include sudo_local
4auth required pam_opendirectory.so
PAM module
AuthorityEffectiveControlRequired
Function classPassword
Function classPassword

This chain participates in password-management functions.

Module: pam_deny.so

Service: sudo

/etc/pam.d/sudo:6:1

Captured at scan time. The current file on disk may differ.

Commands behind your tools

Follow shell startup, PATH, Git, SSH and terminal automation to the commands they can invoke.

Git Configuration
[credential "https://github.com"]
helper = !/opt/homebrew/bin/gh auth git-credential
Git credential helper
InvocationShell
InvocationShell

Git passes this configured value through its documented shell command path.

TriggerCredential Operation
TriggerCredential Operation

Git can invoke this helper when it needs to retrieve, store or erase credentials.

ScopeGlobal
ScopeGlobal

This value is captured from the user’s global Git configuration.

Setting: credential.helper

Credential context: https://github.com

Select a label to understand the command

Follow it to the source

Inspect captured configuration and understand the commands behind a finding.

Captured source
Source~/.gitconfig
1[credential "https://github.com"]
2 helper =
3 helper = !/opt/homebrew/bin/gh auth git-credential
Git credential helper
AuthorityConditional
AuthorityConditional

This configured helper applies when Git resolves the matching credential context.

InvocationShell
InvocationShell

Git passes this configured value through its documented shell command path.

Setting: credential.helper

Credential context: https://github.com

~/.gitconfig:3
Captured at scan time. The file on disk may differ.

Your Mac could be
targeted tomorrow.

AI can make technically demanding attacks accessible to less experienced actors. Knowing what’s configured on your Mac gives you a starting point for investigation.

Capture a baseline with Towl. Compare later scans, trace changes to their source, and decide what deserves a closer look.

Research: NCSC’s AI threat assessment (opens in a new tab)Anthropic’s observed misuse research (opens in a new tab)

A reason to take a closer look.

Installed something new?

Compare scans and inspect newly recorded startup entries, helpers and configuration.

Changed your AI setup?

Review your agents’ skills and instruction files, and follow them to their captured source.

Something looks unfamiliar?

Follow a name or path back to its captured source, and decide what deserves investigation.

Your evidence stays on your Mac.

Read-only inspection. Local scan history. No forensic uploads.

How privacy works

Apple Silicon · macOS 26 or later
Full Disk Access required

Join early.
Keep your rate.

Keep both early-bird rates, even if you cancel and return.

One subscription. Every feature.
Up to three Macs.

See everything included

Early-bird pricing

€7.99 / month

or €55.99 / year

Prices include VAT where applicable.

Checkout is not open yet. Product availability will be announced here.

Future standard pricing: €15.98/month or €111.98/year.

A closer look.

What does Towl inspect?

Towl inspects startup entries, background helpers, scheduled jobs, extensions, shell and developer-tool commands, and supported authentication configuration. It also captures AI-agent skills and instruction files. Search findings, follow their source and compare saved scans. Configuration does not, by itself, prove that something has run.

Does Towl monitor my Mac continuously?

You choose when to scan. Run scans manually or enable interval scans while Towl is running, even with its windows closed. Automatic scans are at least an hour apart. Saved snapshots let you review changes between scans; Towl does not continuously monitor or record every change across macOS.

Will Towl remove or disable software?

No. Towl is read-only. It helps you inspect and understand the evidence without deleting, disabling, or quarantining the software it finds. It does not assign a threat score or label software safe or malicious.

What do I need to run Towl?

An Apple Silicon Mac with macOS 26 or later. Full Disk Access is required to start a scan. The subscription supports up to three installations.

Can I use Towl offline?

Activation and license refresh need an internet connection. A valid license allows new scans for up to seven days offline. Scan findings, captured source, and history stay on your Mac; they are not sent with licensing requests.

What happens if I cancel?

New scans require a valid license. Your saved findings, history, and exports remain accessible after your license expires. Subscription management is provided through Link.

How does early-bird pricing work?

Early customers keep access to €7.99/month and €55.99/year, including when switching billing intervals or cancelling and returning. This preserves your price, not access without a subscription. We will announce the closing date in advance. Future standard pricing: €15.98/month or €111.98/year.