Modes and coverage
You pick how Emu treats each app. Three modes, set per app in Settings. Observe is the default for most apps. Guardian is the default for AI code editors like Cursor. Off means Emu does not intercept at all.
Three modes, you pick per app
Three modes, you pick per app
Set per app in Settings. Observe keeps the log and the Ask Emu pane without ever stopping anything.
The mode is a per-app setting. You can run Cursor in guardian mode, ChatGPT in observe, and a trusted internal tool off, all at the same time. The protection chip at the bottom of the sidebar always shows the live state: "On watch over N AI tools and apps."
What Emu watches
Emu already knows the roughly 47 AI hosts on its list. You do not have to teach it where your AI apps live. The list is grouped into three tiers:
| Tier | Examples |
|---|---|
| Web chats and APIs | ChatGPT, Claude, Gemini, Grok, Perplexity, Mistral, DeepSeek, Cohere, Character.AI, Poe, HuggingFace, You.com, Phind |
| AI code editors | Cursor, GitHub Copilot, Windsurf and Codeium, Tabnine, Sourcegraph Cody, Continue, Replit, Amazon Q |
| App builders and content tools | v0, Bolt, Lovable, Devin, Sudowrite, Jasper, Copy.ai, Writesonic, Notion AI, Gamma, Tome, Otter, Fireflies, ElevenLabs, Suno, Descript, Runway |
The machine-readable list lives in two places that stay in sync: the proxy and the UI. Adding a new AI host means updating both in one change.
MCP interception
Model Context Protocol servers are how AI code editors reach external tools. Emu intercepts the stdio JSON-RPC between the IDE and the MCP server through a shim. Per-IDE toggles in Settings let you turn this on or off for each editor.
The sync gate holds tools/call for the destructive risk classes: run,
exec, commit, and similar. Benign calls like read and edit pass instantly and
classify in the background. This is the second place Emu is allowed to be
stricter than no guardian at all, because the alternative is a destructive
tool running without your yes.
CLI setup
If you use AI from the terminal, Emu covers new terminals automatically. For a terminal that is already open, paste the export line Emu shows you in the onboarding beat and the new shell is covered. Claude Code, Cursor's agent mode, and any CLI tool that respects the standard proxy environment variables are covered the moment the export is in place.
The browser companion
A companion browser extension is the second capture rail. The first is the MITM proxy. The extension catches what the proxy misses, especially on configurations where a VPN is primary and the system proxy is ignored. You can turn it on or off from Settings.
Where Emu stays out of your way
Emu only intercepts traffic to hosts on its AI allowlist. Everything else flows normally. Your bank, your email, your social media, your shopping, your everything-else: untouched. Auth flows, even on AI sites, are skipped. Binary downloads like Cursor's installer are excluded. WebSocket-over-TLS tunnels and HTTP/3 (QUIC) are not intercepted in v1. The native per-app proxy on macOS and Windows fills the gap when a VPN is primary.
This is the privacy posture: Emu watches the AI surface and leaves the rest alone. Read Privacy for the full picture, including the per-device key and the one thing that leaves your computer.
Where to go next
- What Emu does for the five jobs in depth.
- Privacy for what stays on your computer and what leaves.
- Get started for the five-beat install.