Mac Security Posture Pro

What it does

A read-only security-posture collector AND machine inventory. It grades the Mac's hardening controls and enumerates everything on it that matters for a forensic timeline — so even a hardened Mac produces a rich, cross-referenceable corpus rather than a row of green checkmarks.

GRADE (score 0–100 + letter): • SIP, FileVault, Gatekeeper — the critical controls • Application Firewall (+ stealth mode) • XProtect malware-definition freshness • Download quarantine (LSQuarantine active?) • Launchd persistence integrity — resolves each LaunchDaemon/LaunchAgent program and code-signs it; flags unsigned / ad-hoc / unverifiable entries • Privacy-permission exposure (TCC)

INVENTORY (one artifact per item): • Every launchd persistence item — path, resolved program, signing verdict + Team ID • Non-Apple TCC privacy grants — service + bundle-id, high-risk flagged (never the grant bodies) • Login / background items (BTM) — identifier, developer, type, enabled/allowed • System extensions (NetworkExtension / Endpoint Security / DriverKit) + third-party kernel extensions • Configuration profiles (MDM / manual) — identifier, org, scope • Recent download-quarantine events — agent + timestamp + type ONLY (never the download URL)

COLLECTION (v0.3.0): code-signing (SecStaticCode), TCC + quarantine (SQLite), and SIP (IOKit NVRAM) run IN-PROCESS — no subprocess. FileVault / Gatekeeper / firewall / extensions / login items / profiles remain declared subprocess probes that degrade gracefully when the sandbox denies them.

Emits verdicts, counts, paths and bundle-ids only — no file contents, no secrets, no download URLs, no message/mail data.

What it reads

The exact files and databases this plugin accesses. Operator sees this list before install.

• SIP / FileVault / Gatekeeper / firewall state (system tools)
• XProtect bundle Info.plist
• LaunchDaemons / LaunchAgents plists + codesign verdicts
• TCC.db (non-Apple client ids + services only)
• System extensions (systemextensionsctl) + third-party kernel extensions (kmutil)
• Login / background items — Background Task Management (sfltool dumpbtm)
• Configuration profiles (profiles)
• Download-quarantine events — agent + timestamp + type only, never URLs (LSQuarantine)

Permissions it asks for

macOS privacy services this plugin needs. MacCrab's installer shows you the exact list — and refuses anything not declared here.

• TCC Services
  • kTCCServiceSystemPolicyAllFiles
• Privacy class Metadata only — safe in plaintext scan
• Runtime App Sandbox + XPC service
• Network No outbound connectivity

What it emits

Structured record types this plugin produces. Each row in your case database is one of these.

• posture.report
• posture.factor
• posture.persistence_item
• posture.tcc_grant
• posture.quarantine_event
• posture.login_item
• posture.extension
• posture.config_profile

Sample output

Real-shape examples of what this plugin produces. One per content type. The platform stores each emit as a row in your case database.

{"kind":"artifact","artifact":{"contentType":"posture.report","summary":"Security posture: grade B (82/100) — 2 item(s) flagged","privacyClass":"metadata","confidence":"derived","data":{"schemaVersion":2,"generatedAt":"2026-07-01T00:00:00Z","score":82,"grade":"B","flaggedCount":2,"categoryCounts":{"persistence":10,"tcc":0,"quarantine":171,"login_items":0,"extensions":29,"config_profiles":0}}}}

{"kind":"artifact","artifact":{"contentType":"posture.factor","summary":"Launchd persistence integrity: fail","privacyClass":"metadata","confidence":"observed","data":{"key":"persistence","title":"Launchd persistence integrity","status":"fail","weight":12,"detail":"Scanned 10 launchd item(s); 1 unsigned / ad-hoc / script / unverifiable.","remediation":"Investigate the flagged launchd entries — unsigned persistence is a common malware foothold.","evidence":["system-daemon: /Library/Application Support/Sketchy/helper [unsigned]"]}}}

{"kind":"artifact","artifact":{"contentType":"posture.persistence_item","summary":"system-daemon: /Library/PrivilegedHelperTools/com.docker.socket [unknown]","privacyClass":"metadata","confidence":"observed","data":{"domain":"system-daemon","label":"com.docker.socket","program":"/Library/PrivilegedHelperTools/com.docker.socket","signing":"unknown","flagged":true}}}

{"kind":"artifact","artifact":{"contentType":"posture.extension","summary":"system/endpoint_security: Vendor Endpoint Security Extension [active]","privacyClass":"metadata","confidence":"observed","data":{"class":"system","category":"endpoint_security","identifier":"com.vendor.agent","name":"Vendor Endpoint Security Extension","teamID":"AB12CD34EF","version":"1.4.2","enabled":true,"active":true,"appleSigned":false}}}

{"kind":"artifact","artifact":{"contentType":"posture.quarantine_event","summary":"Google Chrome — 2026-06-28T18:50:20Z","privacyClass":"metadata","confidence":"observed","data":{"timestamp":"2026-06-28T18:50:20Z","timestampUnix":1782672620,"agent":"Google Chrome","typeNumber":0}}}

Community screenshots

Submitted by operators — moderated, and never catalog-authoritative (the signed catalog + sample output are the source of truth).

Versions