# Infra Sentinel

A macOS desktop monitor for network traffic, local AI-client usage, host resources, remote hosts, and service status.

## Metadata

- HTML: https://glenzli.com/en/projects/infra-sentinel/
- Markdown: https://glenzli.com/en/projects/infra-sentinel.md
- Collection: Projects
- Language: en
- Published: 2026-08-16
- Updated: 2026-08-30
- Status: active
- Tags: macOS, observability, ai-usage, network, local-system

## Content

Infra Sentinel is a macOS desktop monitor for network traffic, local AI-client usage, host resources, remote hosts, and service status. Each source keeps its own units and accounting method.

  ![Infra Sentinel overview](/images/projects/infra-sentinel-overview-en.webp)
  The screenshot uses anonymous demonstration data and contains no real hosts, addresses, accounts, paths, or project content.

## Supported sources

    **Network**
    Connections, domains, and proxy routes from a Mihomo or Clash Meta-compatible core, plus optional Linux interface counters through an SSH Host alias.

    **AI usage**
    Codex, OpenCode, Antigravity, and connected Infer Runtime instances. Each source retains its own accounting boundary.

    **Host resources**
    CPU, memory pressure, swap, disk throughput, IOPS, capacity, thermal pressure, and best-effort per-app disk I/O attribution.

    **Service status**
    Public status feeds for selected AI services and local PCP, Infer Runtime, Dev Mesh Observer, and other compatible services discovered through Infra Protocol.

## AI usage accounting

Codex usage comes from per-request increments in local rollout JSONL, with fork replay and duplicate records removed. The persistent ledger stores aggregate usage, parser state, and deduplication markers, but no task content.

Charts show raw Tokens observed on this machine, not Codex account quota or billing. API reference value is calculated from model-specific input, cached-input, cache-write, and output prices.

  ![Infra Sentinel AI usage view](/images/projects/infra-sentinel-ai-usage-en.webp)
  Hourly Token buckets and local API reference value using anonymous demonstration data.

## Data and boundaries

Collection is read-only. Infra Sentinel does not capture packets or retain prompts, responses, project files, or credentials, and it does not change proxy or remote-service configuration. Remote hosts are identified by existing SSH aliases; keys, passwords, and `HostName` values are not copied.

The current desktop package supports macOS 13+, uses ad-hoc signing, and is not notarized by Apple. Collection, storage, and analysis stay local by default. Stored state may include aggregate domains, model names, Xray client labels, and user-defined display names.