Defendingo documentation

Getting started

Defendingo is one program with three jobs: the app window, the background guard that records every connection, and the defendingo command line. Setting it up takes about a minute and needs no account.

Windows 11 and 10

1. Download Defendingo.exe from the download page and double-click it. Windows shows a blue "Windows protected your PC" screen for apps it hasn't seen often yet. Click More info, then Run anyway. You can verify the download's fingerprint first.
2. Say Yes once. Defendingo copies itself to C:\Program Files\Defendingo, adds a Start menu entry and starts with your computer. The guard then runs with full recording: Windows reports every connection to it the moment it opens, even ones that last a split second.
3. Done. Delete the downloaded file if you like, and open Defendingo from the Start menu any time.

Linux

1. Ubuntu, Debian, Mint, Pop!_OS: open the .deb with your software installer, or run sudo apt install ./defendingo-latest_amd64.deb. The package installs WebKitGTK for the window and sets up the system service.
2. Fedora, Arch and every other 64-bit Linux with systemd: extract the .tar.gz, open defendingo-app and enter your password once. It copies itself to /opt/defendingo, adds the defendingo command, an apps-menu entry and the file-manager menus.
3. Servers without a desktop: run sudo defendingo install from the extracted folder. The guard runs as a locked-down systemd service, and the command line answers your questions.

System requirements, fingerprints and every download are on the download page. Defendingo for Mac is in early access: join here.

The dashboard

The app window opens a dashboard that only your own computer can reach. Closing the window never stops the guard. These are its pages:

Overview

"Am I safe?" at a glance: live activity the moment a connection opens, with NEW the first time a program ever talks to a place, and the things worth a look today.

Connections

Search and filter everything recorded in the last 90 days: by app, website, address, company, category, direction or risk, over the last day, week, month or all of it. Click a row for the full details and the warnings in plain words.

Apps

Every program that used the network, with its real icon, who signed it, how many places it talks to and its worst warning. Press Watch live on any running app.

Insights

Activity per hour, categories, the chattiest apps and the top destinations.

Watching

One program and everything it starts, live, with a summary when it closes. See Run with Defendingo.

Packets

Every packet, live, matched to the program that sent it. Developer mode turns it into a packet analyzer. See Packets and Developer mode.

Status and settings

The status card at the bottom left: how the guard records, automatic updates, anonymous statistics, community protection and Remove Defendingo.

Warnings and categories

A warning means "have a look", not "you are hacked". Each one says what was noticed and why it matters. There are four levels: HIGH (a broken signature, an unsigned program in Downloads or Temp talking to the internet, a tunnel service), WARNING (an unsigned program online, a place malware likes, a port remote-control malware is known for), NOTICE (a bare numeric address, an untrusted signature, a "what is my address" site) and NEW (the first time a program talked to a place).

Every destination lands in a category: your system, gaming and launchers, browsers, content networks, cloud hosting, known services, your local network, or unknown. The full list of warnings with their meaning is on the features page, and defendingo explain prints the same glossary in the terminal.

Run with Defendingo

Not sure about a program? Right-click its file and choose Run with Defendingo. On Windows 11 the entry is under "Show more options"; for a shortcut, choose "Open file location" first. On Linux it's in GNOME Files under Scripts, in KDE Dolphin and in Nemo. The program starts with your normal rights, never as administrator, and the Watching page shows:

• every connection it makes, as it happens: where to, who owns that server, the category and a plain-words verdict,
• every helper program it starts, and the ones they start in turn, followed as they come and go,
• a summary when it closes: how many places it talked to, which ones, and any warnings.

From a terminal the same thing is defendingo run "C:\Games\SomeGame.exe", and an AI assistant can do it through the watch_program tool. Defendingo never stops or changes the program it watches.

Packets and Developer mode

The Packets page shows every packet live, named by the program that sent it, with the server's name read from name lookups and secure connections. One-click filters, a Record button that sums up every server a game or app contacted, and a one-click export for Wireshark. No extra capture driver is needed on Windows or Linux, and capture only runs while the page is open.

Developer mode adds a layered dissection with a hex view, a Wireshark-style display filter language, recording to .pcapng with the program name on every packet, follow stream, conversations, endpoints, protocol hierarchy, IO graph, expert info and TLS decryption for a program you start with Run with TLS keys. Read the full guide to Packets and Developer mode.

Command line

The defendingo command answers the same questions as the dashboard from a terminal, for you and for scripts. Every read command takes --json and answers with one object of stable, documented field names.

defendingo status                     # is the guard running, what is it seeing right now
defendingo check --since yesterday    # anything worth a look? exit code 3 means yes
defendingo apps --since 7d --flagged  # programs with a warning this week
defendingo history --match pastebin --since 30d
defendingo run --seconds 60 "C:\Users\you\Downloads\installer.exe"

Every command, flag, example and JSON sample: command line reference.

AI assistants (MCP)

Defendingo ships a Model Context Protocol server inside the same program: defendingo mcp. Connect it to Claude Desktop, Claude Code, Cursor or VS Code and ask "which program on my PC talks to unknown servers?" or "is anything worth worrying about since yesterday?". The assistant answers from your own guard's records, locally and read-only. defendingo mcp --print-config prints the settings for each client with the real installed path. Setup and the nine tools: Use Defendingo with AI assistants.

Privacy and updates

Your history stays on your computer, in %LOCALAPPDATA%\Defendingo on Windows and /var/lib/defendingo on Linux, and is removed after 90 days. There is no account and no tracking. Anonymous statistics (version, system, which parts of the app were used, rough counts) can be switched off in the status card or with defendingo stats --off. Community protection, which shares what programs do online without any personal details, is off until you say yes. Every field is listed in the privacy policy.

Updates install themselves: the guard checks a minute after start and then every 15 minutes, and installs a new version only after its signature checks out against a key that never touches our server. Turn automatic updates off in the status card or with defendingo update --disable-auto; defendingo update --check only looks. More on the security page.

Uninstall

1. Open Defendingo, click the status card at the bottom left and choose Remove Defendingo. That removes the installed copy, the menu entries and the automatic start.
2. Linux, from a terminal: sudo apt remove defendingo for the .deb, or sudo defendingo uninstall.
3. Your history is kept in case you come back. To delete it too, delete %LOCALAPPDATA%\Defendingo on Windows or /var/lib/defendingo on Linux.

More help

Short answers to common questions are in the questions and answers. Found a bug or have an idea? Report it, or send the team a message.