Inspects macOS processes, network connections, and code signing status to identify and flag suspicious activity with severity-ranked explanations.
Scanner is a powerful post-incident investigation tool for macOS designed to thoroughly examine every running process. It meticulously checks executable paths, verifies code signing statuses, and analyzes network connections, then flags any suspicious indicators with detailed, severity-ranked explanations. Available as both a standalone command-line interface and an MCP server for seamless integration with Claude Code, it empowers users to quickly identify potential security threats.
Key Features
01Comprehensive macOS process investigation
02Code signing verification and tampering detection
03Network connection analysis with external IP highlighting
04Flags suspicious activity with severity ranking (HIGH/MEDIUM/LOW)
05Allowlist management to suppress known false positives
060 GitHub stars
Use Cases
01Automating macOS security checks via an MCP client like Claude Code
02Performing security audits of running processes and network activity
03Conducting post-incident security investigations on macOS
