Little Snitch

Little Snitch is the app you install when you want to know why a design tool contacts three analytics domains on launch. macOS ships an inbound firewall; this is the other direction. Every time a process opens a new outgoing connection you get a dialog naming the process and the destination, and your answer becomes a rule — for this domain, for any domain, for this session, forever.

The first day is noisy. That is the honest cost of the design: you are teaching it your machine, and by the end of a week the dialogs mostly stop. What you get in exchange is a network monitor that lists live connections by process, a map of where traffic is going, and rules precise enough to let an app check for updates while blocking its telemetry endpoint.

Objective Development sells it as a one-time licence and has never attached a subscription to it. The boundary is the major version: buy now and you own 6, and a version 7 will likely be a paid upgrade at a discount, as 5 to 6 was.

If you only want to stop a handful of known apps from connecting, Radio Silence is a tenth of the price and never prompts, and LuLu does the prompting for free.