Muzzle

Changelog

Muzzle updates itself.

0.3.2

  • Allow one key for one site from its row in Activity. Remove it any time in Settings.
  • Change the email on your Pro key in Settings → Plan.
  • Settings shows when your agent's scripts go through your own proxy and aren't checked.

0.3.1

  • Agents can no longer read your SSH keys, cloud credentials, browser passwords, keychain or .env files from other projects. Allow one from Activity if you need it.
  • Packages an agent installs are checked first: known malware is blocked, and brand-new or unknown packages show a warning.

0.3.0

  • Code now rescans when it only has results saved by an older version, instead of showing them.

0.2.9

  • Pro now means a paid key, or the Threat Feed turned on with a confirmed email. The first-week observation period no longer includes Pro.

0.2.8

  • Pro through the Threat Feed needs a confirmed email. Settings and setup have an email field; Muzzle sends a link and waits for you to press Confirm.
  • One inbox can confirm up to 3 Macs.
  • Macs that joined the Threat Feed before this version keep Pro until 30 November 2026 without confirming.

0.2.7

  • The Threat Feed no longer sends or stores your Mac’s computer name.

0.2.6

  • Fixed: the request-method flag in HTTP tools (-X) was refused as an attempt to route around Muzzle.
  • Fixed: an OpenAI or Anthropic base URL in an app’s .env, compose file or dev-server command was blocked as a settings change.
  • A secret or protected value sent only to localhost, such as tests against a dev server, no longer counts as a leak.
  • Rotating the contact address works with your active key, and a “Pro required” reply from the server now shows the Get Pro screen.
  • A failed update check retries after 10 minutes.
  • Removed the Cursor row from setup.

0.2.5

  • Activity lists every agent command Muzzle refused.
  • OpenRouter and its keys are trusted by default. Existing installs are offered this once.
  • A downloaded update installs when you close the last window.

0.2.4

  • Agents can no longer pause, uninstall, kill or route around Muzzle.
  • The settings lock also catches changes made through cd, heredocs, hard links, ~user and $USER paths, plutil and defaults, and the login item.
  • The device id is tied to your Mac’s hardware.
  • The first-week observation period can run for at most 7 days from first setup.
  • The proxy no longer drops events when the database is busy, and it handles HTTP/2.
  • The updater ignores any proxy.
  • The Threat Feed never includes local hostnames such as .local or .lan.

0.2.2

  • Muzzle updates itself: it checks at launch and every 6 hours and downloads in the background. Choose Restart to update when it is ready.
  • Restart to update quits Muzzle fully before it reopens.

0.2.1

  • Fixed a crash in the proxy on request bodies larger than 1 MB.
  • When a host cannot be reached, Muzzle now answers “Muzzle couldn’t reach <host>” instead of resetting the connection.
  • “Share anonymous signals” is now “Contribute to the Threat Feed”.

0.2.0

  • Settings lock (Free, on by default): agents can no longer edit their own settings files, MCP configuration, Muzzle’s data folder or LaunchAgents, or point Claude Code and Codex at a non-official API host.
  • Startup checks (Pro): when a session starts, Muzzle scans project instruction files such as CLAUDE.md and AGENTS.md for injected instructions and warns about sessions opened in Downloads, Desktop or your home folder.
  • Muzzle watches your agents’ settings and tells you about new MCP servers, base URL changes and removed Muzzle hooks, with an Undo.

Still stuck? support@usemuzzle.com