iKnow Shows What Your Mac Knows About You. Your AI Agent Can Read It Too.

A tiny open-source viewer, an agent manual that refuses to read until you say yes, and what both mean before you give an AI agent Full Disk Access

Every recent Mac runs a background process whose manual page barely says anything. Its description amounts to a sentence or two, and the key one says the process "analyzes the content on this device to help build a knowledge graph representing the device and the user."

That sentence hides a lot. The graph it describes holds who you know, how often you write to them, whose faces keep showing up in your photos, and scored guesses about which of those people are your family. Apple gives users no screen to review any of it. Yet any AI coding agent running in a terminal with Full Disk Access can open it with one query.

A small open-source project called iKnow now opens that graph on your own machine so you can look. It is worth a try for that reason alone. But the most interesting file in the repo is not the viewer. It is a manual written for AI coding agents, and its first instruction is to stop and ask you a question before reading a single row.

That design choice says something important about Claude Code, Codex and every other agent you run in a terminal with broad file access. Here is what the graph holds, how iKnow reads it safely, and what to change in your own setup.

What the Mac is keeping

The research comes from a write-up by Dario Pasquini on 8rank.ai, dated October 28, 2026. It reached the Hacker News front page on November 7 under the title "Every Mac comes with an (undocumented) family member classifier."

Two background services (macOS calls them daemons), knowledgeconstructiond and intelligenceplatformd, build the graph on the device by cross-referencing your Contacts, Calendar, Photos, Messages, Mail, location and more. The write-up lists the feature as affecting macOS 13 and later, on Intel and Apple silicon, and the author's data comes from macOS 26.6.2.

Where it lives is the part builders should care about. The author found "fifty-one databases" in ~/Library/IntelligencePlatform, all ordinary SQLite files, "stored in plaintext but located in a zone protected by TCC Full Disk Access." TCC is the macOS privacy system behind the permission prompts you click through. In plain terms: no encryption on the files themselves, and one permission switch standing between them and any program that has it.

The main graph is a triple store, a database of simple facts shaped like "person A, works at, company B." It uses 181 types of things and 278 kinds of relationships. Some facts are copied straight from your apps, such as a contact's name or a calendar event's start time. Others are inferred, such as a relationship word ("sister," "coworker") or a suggested relationship to the Mac's owner.

The family guesses come from two small machine-learning models (XGBoost classifiers, a common type of decision-tree model) that take 144 signals per person, grouped into identity, communication and photo features. Their output lands in a table with one row per person and seventeen relationship columns, from family to mother to coworker, which the author says is "recomputed every day." The author is careful here too: only two of those seventeen columns have a shipped model behind them, and what fills the rest "we could not trace."

How iKnow reads it without making things worse

iKnow is a small Python web app with no dependencies beyond the standard library: an entry point, server.py, plus a few modules under api/ and static files. No npm, no Flask, no build step. It is Apache-2.0 licensed. You run it, open the link it prints, and get a browsable view of your own graph: people, employers, group chats, what was recorded and what was inferred.

The safety choices are the kind more local tools should copy, and they are visible in the code:

• It only answers on your own machine. The server binds to 127.0.0.1, the loopback address other computers cannot reach, and the README says there is no flag to change that.
• It needs a fresh password-like token every start. Each launch generates a random token with Python's secrets module and prints a link carrying it. Without the token, every page and endpoint refuses. The code also checks the request's Host header, which blocks a trick where a malicious web page points its own domain at your loopback address (DNS rebinding).
• It cannot write. Every database handle opens with mode=ro, SQLite's read-only flag.
• It keeps nothing. Values travel from the databases to your browser tab and are never saved or logged, and a Content-Security-Policy header (a rule telling the browser where a page may load from and send data to) stops the page from talking to anything off the machine.

Nothing about this is exotic. It is careful, boring engineering, and it means the viewer adds very little risk on top of the permission you already have to grant.

The manual that makes agents ask first

The repo also ships MANUAL_FOR_YOUR_AGENT.md, written for an AI agent with a shell on your Mac. It covers where every store is, how to open each one read-only, what the cryptic codes mean, and how to join out to Contacts, Photos and Messages. You hand it to Claude Code or Codex and ask in plain language: who does my Mac think my family is, and why?

Section 0 is titled "Stop and ask first," and it is marked mandatory. The reasoning is stated plainly: "Everything you read from these stores goes into your context, and your context goes to whoever runs your model." Before reading anything, the agent must tell you which model and provider it runs on, explain that what it reads gets sent there, and ask, word for word: "Are you running a trusted LLM provider that you are sure will not abuse the knowledge of your local knowledge graph? (yes / no)"

The rules after the question are strict. Ask even if the request already sounds like consent. Read nothing, not even a test query, until an explicit yes. On a no, stop and point the owner to the browser viewer instead, which shows the same data and sends nothing off the machine.

Here is the insight worth taking away. The viewer and the agent read exactly the same files with exactly the same permission. The only difference is where the data goes next. The viewer keeps it on your machine. An agent running on a hosted model ships what it reads to that model's provider, because that is how it thinks. Pointing such an agent at a private local store turns it into a remote one. (The manual's own escape hatch is a model running locally, which keeps the data on the machine.)

The permission you already granted

This is where the repo stops being a curiosity and becomes a checklist.

To run iKnow, you give Full Disk Access to the app you launch it from: Terminal, iTerm or your editor. The README says so directly, and the agent manual says the agent needs the same access. macOS generally attributes that permission to the terminal app, so programs started inside that terminal inherit it.

Many developers already gave their main terminal Full Disk Access months ago, to make some tool stop complaining. If you run Claude Code or Codex in that same terminal, your agent can open these 51 databases today, no iKnow required. Whether it ever would depends on what you ask it, what a prompt injection in a web page or README asks it, and whether anything in your setup says no.

iKnow's manual is a good-faith gate. But it is a prompt, and it only works on an agent that reads it. An agent that never opens the manual never asks the question.

Put this into practice

Look at your own graph (10 minutes). If you are on one of the tested versions (macOS 26.6.2, 26.7.1 or 27.0.1), run:

git clone https://github.com/8rank/iKnow.git
cd iKnow
python3 server.py

Open the link it prints. If a store shows DENY at startup, the terminal lacks Full Disk Access. iKnow prints the fix: System Settings, Privacy & Security, Full Disk Access, add the app, then quit and reopen it completely.

Use a separate terminal for the permission. Rather than granting Full Disk Access to the terminal where your agents live, grant it to a second terminal app you use only for jobs like this, and remove it when you are done. That keeps the permission out of your agents' reach by default.

Audit who already has it (2 minutes). Open System Settings, Privacy & Security, Full Disk Access, and read the list. Every app there can read these databases, along with your Mail and Messages stores. Turn off anything you do not recognize or no longer need.

If you do ask an agent, answer the question on purpose. Give it the manual and let it ask. Think about your provider's data terms before typing yes. If you are unsure, say no and use the browser viewer, or point the agent at a locally running model.

Steal the pattern for your own tools. If you build anything that reads sensitive local data, ship two paths: a local viewer that keeps data on the machine, and an agent manual that makes the agent disclose where data will go and ask before reading. It costs a page of markdown.

Honest limitations

iKnow is early and small: under 30 stars on November 7 (GitHub and the shields badge disagreed), no releases, nothing to pin but a commit, and a README that calls it "fully LLM-generated" and says it "may not be 100% accurate." The safety properties above come from reading the README and checking the relevant lines in server.py, not from a security audit. The README is also candid that the token is not a sandbox: a program already running as you, with access to your terminal or browser history, could find it.

The write-up is one researcher's reading of undocumented internals on one machine. The author flags uncertainty throughout, including classes that may be declared and never filled. Apple has not commented in anything we found, and the write-up names no switch to turn the graph off. Apple also changes these stores between releases, so on other macOS versions some iKnow pages may come out incomplete, as the README warns.

The "ask first" gate is a convention, not an enforcement mechanism. It protects you from a well-behaved agent making an honest mistake. It does nothing against an agent that skips the manual or a prompt injection that never mentions it. The real control is still the Full Disk Access list.

The shift

Most talk about agent memory is about what agents remember. This repo is a reminder that the richest memory on a developer's machine was built by the operating system, sits in plaintext behind one permission, and is one SQL query from leaving the machine once an agent can read it.

Run iKnow once. Then open the Full Disk Access list and decide which of those apps you would trust to read your family tree out loud to a model provider.

Sources: 8rank/iKnow README, MANUAL_FOR_YOUR_AGENT.md and server.py at main; Dario Pasquini, "Apple Intelligence personal knowledge graph," 8rank.ai (October 28, 2026); Hacker News thread, November 7, 2026. All read November 7, 2026.