Plugsight watches your USB devices think out loud

Field notes

Plugsight uses one local daemon to collect device events, score suspicious behavior, and scan mounted storage, while its menu-bar interface and MCP server consume the same timeline. The site shows an example involving 1,204 files and a device that began typing 0.4 seconds after insertion. Its scoring combines latency, keystroke timing, redundant-keyboard detection, and device-class comparison, while explicitly acknowledging that behavioral detection is probabilistic.