Your microphone.
Your camera.
Your visibility.

Open a new terminal after a PATH change. On portable Windows, use .\mcw.exe from the extracted folder. On Unix, try "$HOME/.local/bin/mcw" --version if you kept the default prefix. The installer cannot change its parent terminal’s environment.

If Defender quarantined the executable, PATH is not the problem: keep the Protection history details and follow the precautions below without restoring the detected bytes.

Camera activity may remain without an attributed PID when the native report provides no usable timestamp, even if Windows supplies a raw PID. Since version 0.17.2, the tray retains observed access and marks this partial coverage with an orange exclamation mark. Details identify the collector, its reason, and captures; genuine unavailability or a protection error still takes priority. Older versions may display a gray cross and a generic “telemetry degraded” summary.

Check Status details…, mcw status --lang en, mcw status --json, and mcw doctor to distinguish activity, attribution, and collector health. Unknown attribution means neither “no access” nor “camera blocked”: no client identity or authority to stop a process should be inferred from its name alone or a raw PID. The screenshots on this page remain explicitly historical, from 0.17.1.

Observation: run MCW in your user session without general elevation. System restrictions can make some identities or collectors unavailable; additional privileges do not guarantee attribution.

Windows: camera device changes require separate UAC authorization. Linux: USB camera controls first require the separate administrator component of the same version, then explicit Polkit authorization; the user installer does not deploy it. macOS: installing and removing the camera profile remain manual operations in System Settings, and notifications depend on system permission. MCW does not bypass TCC, Gatekeeper, or SIP; a profile’s presence does not prove capture is denied.

Run MCW in your desktop user session, not through sudo. Check pw-dump, PipeWire/SPA libraries, XDG_RUNTIME_DIR, the user socket, and PIPEWIRE_REMOTE if customized. An inaccessible or restarting socket is an error, not “no access”.

The tray requires a StatusNotifierItem host. Notifications need the session service and notify-send; sound needs canberra-gtk-play, a theme, and a session backend. An accepted call does not certify that a notification was seen or a sound heard. Direct camera access outside PipeWire may remain unattributed or degrade observation.

The public CoreMediaIO API reports the device’s running state, not the identity of the client using it. MCW therefore displays an unknown PID and degraded camera health rather than inventing attribution. AVFoundation availability and running state do not prove images were captured. Pending profile approval does not count as blocking.

No: do not disable protections or add an exclusion. The public 0.17.2 release is unsigned on Windows; no Apple Developer ID signature or notarization is announced. Warnings may therefore appear. A GitHub attestation describes a build, not its safety.

If Defender detects something, record the name, path, version, available hash, and Protection history details. Do not restore the quarantined file or automatically reinstall the detected bytes. The repository documents the incident and manual submission to Microsoft; no false-positive verdict is claimed. Signing, provenance, and safe handling ↗.

Not necessarily. On Windows, manual protection belongs to a native background broker and remains requested after closing the tray or top, until mcw unmute or mcw camera allow. This does not promise persistence across a restart. Linux and macOS retain their limited, one-shot controls: they do not inherit this Windows mechanism.

Check the actual status. A stopped Windows camera guard remains a warning: a “Block” intent alone does not prove protection of future connections. Explicitly restore before replacement or uninstallation, and resolve any pending state.

An active executable, requested protection, pending restoration, missing/modified receipt, or unsafe path can prevent an operation. Stop your watchers, complete privileged operations, and check control status. The script rejects root, modified/unowned targets, and unsafe links; it does not stop processes for you.

An older tray may require a normal manual exit: do not force it to quit during a camera operation. Do not delete ownership records to bypass rejection. Use the appropriate installation owner and the documented procedure.

mcw doctor --json and mcw status --json help with diagnostics, but paths, users, PIDs, devices, and application names may be personal information. Review and redact this data before attaching an excerpt to an issue. MCW does not automatically collect your reports; sharing remains voluntary. Technical evidence details stay in English to keep diagnostics stable.