Know what's really
running on your Mac.
macWatchdog audits your Mac in about ten seconds: hidden persistence, remote access, privacy grants, open ports, disabled protections. You get a score, findings in plain English, and a fix for each one.
SYSTEM HARDENING [ OK ] FileVault — encrypted [ OK ] System Integrity Protection — enabled [HIGH] Firewall — disabled → Turn on the firewall and stealth mode in System Settings › Network. [LOW ] Guest Account — enabled PERSISTENCE [MED ] Launch Agents — 2 unsigned • com.update-helper.plist ~/Library/LaunchAgents (unsigned, runs at login) • com.adobe.GC.Invoker /Library/LaunchAgents (unsigned) → Quarantine from macWatchdog › Persistence › Manage. NETWORK [MED ] Network Listeners — 1 exposed to all interfaces • node :3000 0.0.0.0 (pid 4821) SCORE 62 / 100 — AT RISK (capped: HIGH finding present)
How it works
Scan. Understand. Fix.
Run a scan
One click. 33 checks across 9 categories finish in seconds. Nothing is installed system-wide and nothing leaves your Mac.
Read the findings
Each one says what it is, why it matters, and what to do, written for people, not SOC analysts. Severity bands and a 0-100 score show what to care about first.
Fix it with a backup
Quarantine a launch agent, remove a login item, close a port, disable a kext. Every action is backed up and reversible from inside the app.
What it checks
33 checks. The ones that actually matter.
These are the places malware, stalkerware, and sloppy software hide, and the protections that silently get switched off.
Persistence
Launch agents and daemons, login items, cron and periodic scripts, SSH authorized_keys. Unsigned items are flagged.
Remote access
SSH remote login, screen sharing, remote Apple Events, and who is in the local admin group.
Device management
MDM and DEP enrollment, installed configuration profiles. Is someone else managing this Mac?
Privacy grants
Which apps hold camera, microphone, screen recording, accessibility, and Full Disk Access, plus what capabilities each app declares.
Network
Every listening port, grouped by process, with exposed-to-the-world separated from localhost-only. Active interfaces.
Hardware
Connected USB devices with BadUSB heuristics, third-party kernel and system extensions with signature state.
System hardening
SIP, Gatekeeper, XProtect, firewall and stealth mode, FileVault, automatic updates, guest account, Bluetooth, firmware password.
AI agents
Installed AI coding agents, configured MCP servers with supply-chain and embedded-credential flags, permission modes that skip command approval, API keys in shell profiles, and local model servers exposed to the network.
Filesystem
World-writable files in sensitive locations and downloaded installers missing the quarantine flag (a known Gatekeeper bypass).
Privacy
A security tool that doesn't phone home.
Scan results never leave your Mac. They live in ~/Library/Application Support/macwatchdog and you can delete them whenever you like.
Update checks against this site (switchable off in Settings) and a one-time license activation if you buy Pro. That is the complete list.
Every check is the MIT-licensed macwatchdog CLI. Read it, run it yourself, or pipe its JSON into your own tooling.
Every release publishes its SHA-256 checksum next to the download. Apple notarization is coming; until then macOS asks you to confirm the first launch. Root access is requested only through the standard macOS dialog.
Pricing
Scanning is free. Fixing is nine dollars, once.
Everyone gets the full audit. Pro pays for the next version. No subscription, no upsell, all updates included.
- All 33 checks, unlimited scans
- Security score and plain-English findings
- Privacy-grant and network-listener detail
- Last five scans in history
- Remediation managers
- Elevated scan of root-only checks
- Full scan history and comparisons
- Everything in Free
- Fix what the scan finds: quarantine agents, remove login items, close ports, manage kexts, all with backups
- Elevated scan: sudoers, SSH keys, MDM, cron, profiles
- Full scan history and scan-to-scan diffs
- One key, one Mac at a time, move it whenever you like
- All future updates included
Download
Get macWatchdog
macWatchdog for macOS
Open the disk image, drag to Applications, run your first scan. Updates arrive inside the app.
Size 16MB · SHA-256 verify
Note Not yet notarized: on first launch, allow the app under System Settings → Privacy & Security
Command line
The same engine, free and open source. Ideal for scripting, fleets, and SIEM export.
# with pipx pipx install git+https://github.com/ianheil/macwatchdog-cli.git macwatchdog scan # JSON for pipelines macwatchdog scan --format json
FAQ
Questions
Why does macOS ask me about Automation or Full Disk Access?
The login-items check reads System Events through Automation; the privacy check reads the TCC database, which needs Full Disk Access. Both are optional. Decline and those checks are marked skipped, everything else runs. You can revoke either any time in System Settings › Privacy & Security.
Why does Elevated Scan want my password?
Sudoers, root's SSH keys, MDM state, system cron, and configuration profiles are only readable as root. Elevated Scan runs just those seven checks through the standard macOS administrator dialog, then drops back to your user. It never installs a helper or keeps privileges.
Is it an antivirus?
No. It doesn't scan files for signatures or run in the background. It audits configuration and persistence, the things that tell you whether something has already taken hold or whether your Mac is left open. It complements XProtect rather than replacing it.
Does 100/100 mean my Mac is clean?
It means the checks found nothing to fix in what they cover: configuration, permissions, and persistence. That's a strong signal, not a guarantee — no tool can promise a machine is free of malware, and anyone who says otherwise is selling something. The score tells you how much attack surface you've closed and whether anything has changed since last scan.
Will it break anything?
Scanning changes nothing. Remediation actions are explicit, one at a time, and each one writes a backup you can restore from inside the app. Kext changes are reversible too.
Intel Macs?
The app currently ships for Apple Silicon. The CLI runs on Intel and Apple Silicon, macOS 12 and later.
Refunds?
Email support@macwatchdog.com within 14 days and you'll get one, no questions.