Mac bandwidth monitor with Kilobat

macOS has no built-in per-app network usage view. Kilobat measures traffic per app, keeps a local history and shows the hosts each process talks to. This skill answers "who is using the connection, how much, and to where".

Setup

Use the Kilobat MCP tools if connected, otherwise the kilobat CLI (brew install seifip/kilobat/kilobat, macOS 14+; ask before installing). Commands here need CLI 0.2 or later (kilobat --version); if one is unknown, suggest brew upgrade kilobat. Everything here only reads, except blocking in step 5, which needs a yes. The kilobat skill lists the rules.

Live traffic works without the Kilobat app. History needs the app running; it records locally and gaps mean it was not running, not that nothing was used.

1. Snapshot live traffic

Run kilobat status --json; it samples for a few seconds. Read:

• downloadBytesPerSecond, uploadBytesPerSecond: the whole Mac.
• apps[]: id (bundle ID, or process:<name> for processes without one), name, per-app downloadBytesPerSecond and uploadBytesPerSecond, sessionBytes (since sampling started), processIDs and allowedRule (the saved rule, not proof of enforcement).
• network, metered, profile.

Sort by total rate and name the top apps with numbers in readable units (KB/s, MB/s). Traffic is bursty: take two or three snapshots 20–30 seconds apart before calling an app the culprit. For continuous watching, suggest the user run kilobat status --watch in their own Terminal (s sorts, / searches, q quits).