🛡️ LuLu AI

The Problem

LuLu is the best open-source macOS firewall. But when it shows an alert like:

Most users have no idea if this is safe or malicious. They either:

• Allow everything (defeating the purpose of a firewall)
• Block everything (breaking legitimate apps)

LuLu AI solves this. It automatically analyzes every connection and tells you what's happening, who owns the destination, the risk level, and whether to allow or block.

Architecture

LuLu AI has two independent components. Each works on its own, no shared dependency:

🤖 Agent Skill: lulu-monitor

A background service that monitors LuLu Firewall alerts and delivers AI-analyzed notifications to Telegram with one-tap action buttons.

Repo: EasonC13-agent/lulu-monitor

Flow

LuLu Alert → Detect (AppleScript) → AI Analyzes → Telegram Notification
                                                            ↓
                                                  User taps Allow/Block
                                                            ↓
                                                  Action executed on LuLu

Features

• Real-time LuLu alert detection via AppleScript
• AI analysis using Claude (via OpenClaw Gateway)
• Telegram notifications with 4 action buttons (Allow/Block, permanent or one-time)
• Auto-execute mode for high-confidence safe connections
• Runs as launchd service (auto-start on boot)

Example: Suspicious Connection 🔴

Example: Safe Connection 🟢

Telegram notifications with one-tap Allow/Block buttons

🖥️ Mac App: LuLu AI Companion

A native macOS menu bar app that provides AI-powered analysis directly on your Mac with an overlay recommendation window.

Repo: EasonC13-agent/LuLuAICompanion

Features

• Native SwiftUI menu bar app
• Monitors LuLu alerts via macOS Accessibility API
• WHOIS + Geo IP enrichment for every connection
• AI recommendation overlay window next to LuLu alert
• Setup wizard for easy first-time configuration
• Uses claude-haiku-4-5 for fast, cost-efficient responses

API Key Options

The app supports two ways to connect to AI:

• Anthropic API key (sk-ant-...) - Direct connection to Anthropic
• 3mate Platform key (sk-3mate-...) - Pay-per-use via Sui Tunnel

LuLu AI Companion (left) showing AI analysis alongside the LuLu Firewall alert (right)

⚡ Sui Integration: 3mate Platform

LuLu AI Companion can optionally use the 3mate Platform for AI API access, powered by Sui Tunnel micropayments. This enables pay-per-use AI without requiring users to have their own Anthropic API key.

The entire 3mate Platform was built through vibe coding with SuiMate AI. Watch the development process: Building Demo ↗

Platform: platform.3mate.io | Repo: EasonC13-agent/platform.3mate.io

How Payment Works

1. Deposit: User opens a Sui Tunnel, deposits USDC on-chain
2. Create Key: Generate API key, authorized on-chain via add_authorized_key()
3. Use: Each AI analysis deducts from tunnel balance (pay-per-use)
4. Claim: Backend claims used funds with Ed25519 signature verification
5. Close: User can close tunnel and get unused funds refunded anytime

Smart Contract

Sui Move Tunnel Payment Protocol on testnet:

State Receipt Signing

Each API call updates cumulative usage. The backend signs a state receipt with Ed25519:

message = tunnel_id_bytes || bcs(cumulative_amount) || bcs(nonce)
signature = ed25519_sign(message, api_key_private_key)

The operator submits this signature on-chain to claim funds. The contract verifies against any authorized key in the Tunnel.

Repositories

Tech Stack