Your apps are connecting to Anthropic, OpenAI, Google, and more — right now, in the background. Nocturn shows you exactly which processes, where they're sending data, and lets you block anything that shouldn't be there.
Installs in under a minute. Lives in your system tray. No telemetry, and update checks can be switched off.
A quick walkthrough of Nocturn catching an unrecognised AI connection and shutting it down — no script, no staged demo.
Every AI process and LLM connection on the machine, live — the same table shown in the app card above.
A process nobody recognises starts talking to an LLM endpoint. Nocturn flags it in amber the moment it appears.
Block cuts its network access; Kill ends the process outright. No digging through Task Manager.
Trusted tools stay silent in the background. Nocturn only interrupts you for what's actually new.
Nocturn runs quietly in your tray and only speaks up when something needs your attention.
A live process table showing every AI tool, agent, and script running on your machine — and every outbound LLM connection it's making. Trust what you know; flag everything else. Inspect any agent to see the files it has open and who it's connected to, right now.
One click cuts a process's network access or terminates it entirely. An optional auto-kill mode (off by default) can handle unauthorised processes for you — with a safety guard that stops it fighting a respawn loop. Some actions ask for Windows administrator approval.
Clipboard-hijacking malware swaps sensitive copied data between copy and paste without you noticing — most commonly a crypto wallet address. Nocturn detects the swap the moment it happens and offers to restore what you actually copied. Covers BTC, ETH/EVM, XRP, LTC, TRX and DOGE addresses.
Off by default. Switch it on in Settings for quick, full and targeted scans using a known-bad hash list, file heuristics and Windows signature checks. Suspicious files go into an encrypted quarantine vault — locked away but recoverable if it turns out to be a false positive. It's a light second look alongside Windows Defender, not a replacement for it.
Every installed utility and Windows control-panel applet — Task Manager, Disk Management, Device Manager and the rest — in one searchable, categorised grid. One click to launch, no digging through Start Menu mid-investigation.
Take any non-system drive offline with one click, enforced by Windows itself, which stops ordinary programs reading or writing it. Your system and boot disks can't be toggled by accident. Useful for isolating backups or personal data before you run something you don't fully trust yet. Needs Windows administrator approval.
Two small status dots show whether your camera or microphone is in use right now, read from Windows' own usage log. Green: idle. Orange: a recognised app is using it. Red: a script, an AI tool or an unsigned program is — and Nocturn warns you. It reads what Windows records, so it can't see anything that bypasses Windows itself.
Get a warning when a script (PowerShell, Python, Node and the like) is started by something other than you — an AI tool, a service, a scheduled task, or something Nocturn can't trace back to you. Switch the pop-up off during heavy AI work; every flagged script is still logged.
A sensible way to combine AI Watch with the Drives tab before testing anything you don't fully trust yet — a new agent, an untrusted script, a model you just downloaded. See more scenarios on the Use Cases page.
Open the Drives tab and take your backup or personal-data drive offline — one click, enforced by Windows itself. Windows treats an offline drive as unavailable, so ordinary programs can't read or write it until you bring it back online. (A process running with administrator rights could still switch it back on, so treat it as a strong extra barrier, not an absolute one.)
AI Watch flags any unrecognised AI process or LLM connection the moment it appears. Kill it on the spot — and the drive holding your real files was already out of ordinary reach.
AI Watch is the early warning. Drive Control is an extra barrier behind it.
Run the installer (Windows asks for administrator approval, because it installs to Program Files), paste your licence key from your purchase email, and click Activate. Nocturn lives in your tray, and the installer lets you choose whether it starts with Windows.
Open AI Watch. You'll see every AI process and connection on your machine. Anything you recognise — allowlist it, or trust the whole publisher.
Once your known tools are trusted, anything new stands out immediately. Block with one click. Get on with your day.
Full details, requirements recap, and checkout on the buy page. Windows 10 & 11 · 64-bit only.
It's built to be light. Every few seconds Nocturn reads the process and connection lists Windows already maintains, rather than scanning your files all the time, and the file scanner is off unless you turn it on. Expect around 100 MB of memory; CPU use is modest, and a little higher while its window is open.
Yes — Nocturn is a complement to Windows Defender (or your existing antivirus), not a replacement. It adds AI-awareness, clipboard-swap detection and camera and microphone status that Defender doesn't give you.
No. Nocturn monitors which processes are running and which network connections they make — the same information Windows Task Manager shows you. It does not intercept, decrypt, or log the content of any traffic.