How FireAI watches your Mac’s connections

A firewall that needs a kernel extension, or a helper running quietly with root access, is a lot to trust. FireAI is built on Apple’s own Network Extension content filter framework instead, the same mechanism apps like a corporate VPN client use, running as an ordinary system extension you approve once in Setup.

What it does for you

Every outbound connection your Mac makes, from Zoom joining a call to a game launcher checking for updates, passes through FireAI first. FireAI identifies the exact app by its code signature, not just its name, so a fake copy of a real app doesn’t inherit that app’s rules.

How it works

• FireAI registers a system extension that macOS asks about every new connection, before it opens: app identity, remote host or IP, port and protocol.
• For apps that resolve names themselves (many browsers and Electron apps), FireAI reads the DNS answer to attach the real hostname to the connection — so a rule for *.microsoft.com still matches even when the app only ever shows an IP.
• Turning off Protect this Mac on the Protection page does not stop FireAI from watching: it keeps reporting every connection, it just stops blocking or asking about them (Autopilot, prompts and rules pause too).
• FireAI also enforces rules on incoming connections to your Mac, not only outgoing ones — but it never prompts you about an incoming connection, and it does not (yet) show a list of which apps are currently listening for them.

Good to know