NEW MacCrab Rave is live — the signed plugin catalog for MacCrab. Browse plugins →
v1.21.4 Alpha

Exoskeleton
for your Mac.

On-device macOS threat detection + forensics — catches malware, credential theft, and rogue AI agents, then helps you investigate.

  • 483 Sigma-compatible detection rules
  • AI coding-tool guardrails + Agent Traces
  • One-click forensics workspace

Iterating fast — expect false positives and frequent updates. Changelog · Report an issue

Install with Homebrew View on GitHub 
$ brew install --cask peterhanily/maccrab/maccrab
MacCrab dashboard Overview workspace — a green banner reads 'Protected — system is secure · Live data flowing, 16 collectors active' above KPI tiles showing Security Grade A−, 9 Open Alerts, 0 Active Campaigns, Event Rate, AI Guard and Threat Intel status. Below: a 7-day alert volume bar chart, a Recent activity list, and a Quick actions panel with Search events, Open TraceBundle, Create rule, Intel feeds, System health, and Integrations. Left sidebar workspaces: Overview, Alerts, Events, Investigation, Forensics, Detection, Prevention, Intelligence, System, Docs.
Detection

See what's happening, as it happens.

MacCrab listens to Apple's Endpoint Security feed — the same kernel-level events macOS gives to security tools. It turns that firehose into readable alerts, on your machine.

⚙︎

AI coding tool guardrails

Claude Code, Codex, Cursor, and Copilot are powerful — and sometimes they wander. MacCrab watches for credential reads, project-boundary escapes, prompt injection, and rogue MCP servers.

ai_guardagent_tracesagent_lineagemcp_serverprompt_injection
⌖

Agent Traces

See every file your AI agent touched, every command it ran, every network call it made — tied back to the exact prompt that caused it. OpenTelemetry over a local loopback, encrypted at rest, with vendor secrets scrubbed at the wire.

w3c_traceparentopentelemetryotlp_receiveraes_gcm
⌬

Supply-chain worms

Shai-Hulud-class npm worms steal a maintainer's npm token, then publish themselves into every package that maintainer owns. MacCrab fires when a credential read and a registry publish happen in the same process tree within a minute. Plus typosquat scoring, attestation checks, and canary CLAUDE.md / .claude/skills/ decoys that AI agents will read but humans won't.

shai_huludsigstoretyposquathoney_promptsbayesian_intent
⏿

Persistence & malware

LaunchAgents, dylib hijacks, quarantine-stripped payloads, kernel extensions, TCC bypasses, quick-look plugins, folder actions — 483 detection rules (Sigma-compatible core) across 17 tactic categories.

sigmamitre_att&ck483rules
❋

Credential theft

Keychain dumps, browser password-store reads, SSH-key exfiltration, AWS credential access. Honeyfile tripwires drop at the usual credential paths to catch what rules miss.

keychainhoneyfilesbrowser_ext
⌘

Attack campaigns

Multi-step attacks stitched together by process lineage and time. When a browser spawns a shell that strips quarantine and installs a LaunchAgent, you see one campaign — not four loose alerts to piece together by hand.

kill_chainuebalineage_dag
Dashboard

Native Mac. Keyboard first.

A SwiftUI menubar app organised into ten workspaces — Overview, Alerts, Events, Investigation (Agent Traces, visual TraceGraph), Forensics, Detection, Prevention, Intelligence, System, and Docs. Or skip the GUI entirely and drive it from the CLI.

MacCrab Forensics workspace, Run a scan tab — a list of one-click forensic investigations, each with a Run button and badges: Comms Forensics (encrypted deep extract of personal communications — Messages, threads, URLs, FaceTime call history), IR Quickstart (incident response — captures persistence baselines, primary grants, recent quarantined downloads, and browser activity for the first 60 minutes of an incident), Browser Activity, Supply-Chain Audit (inventories installed binaries and code-signing posture, walks Mach-O headers, builds a code-signing graph), Mac Data Overview, AI Agent Posture (what AI coding tools are running, what they can touch, and what they have accessed), and Phishing Triage. Tabs across the top: Run a scan, Past scans, Findings, Catalog.
Forensics One-click investigations — IR Quickstart, Supply-Chain Audit, AI Agent Posture, comms and phishing triage. Run a scan, read the findings, nothing to configure.
MacCrab Events workspace — a live stream of Endpoint Security events in a table with Time, Action (File Written, Permission, Ownership, File Created, Process), Category, Process, Detail, and Signer columns, with a time filter (Last Hour, Last 24 Hours, Last 7 Days, All Time), a category filter, and Auto-refresh and Pause controls. A right-hand detail pane for a File Deleted event shows the process name, pid, path, signer, team, user, and parent, plus event metadata. A small bar chart shows event volume over time.
Events The raw Endpoint Security stream, live — every process, file, and network event with its signer and lineage, filterable by time and category.
MacCrab Alerts workspace — a severity counter strip (0 critical, 0 high, 4 medium, 0 low, 4 info) over a triage table with multi-select, Bulk suppress, and Export actions. Tabs read Open, Campaigns, History, Suppressions. Alerts include a Cross-Process Attack Chain across Google Chrome and helper processes, Direct Keychain Database File Access, a login keychain opened by a non-Apple process, and forecast and counterfactual likely-next-tactic entries with MITRE technique tags.
Alerts Multi-select triage, rule-fingerprint clustering, suppressions viewer, and a detail pane with ATT&CK chips and one-click pivot into Events.
MacCrab Detection workspace, Rules tab — a built-in rule browser with New-rule and Reload actions and counters for rules loaded, custom rules, and rules fired. The table lists detections including AI Coding Tool Modifies Global Git Configuration, Cloud Provider CLI Used to Upload Data from Sensitive Paths, Manual DNS-over-HTTPS Query to Bypass Local DNS, Untrusted Process Reads macOS Local Directory Service Data, System Proxy Configuration Modified, and Package Manager Download Followed by Execution — each with category, severity, and MITRE tag. A right pane shows the selected rule's logic, YAML, and actions. Tabs: Rules, AI Guard, Browser, MCP.
Detection Browse every built-in rule, write your own, and tab through Rules, AI Guard, Browser, and MCP detection layers.
MacCrab Intelligence workspace, Threat Intel tab — an "Add custom feeds & IOCs" panel describes built-in abuse.ch feeds (URLhaus, MalwareBazaar, Feodo Tracker) fetched every 4 hours keyless, with an Import-IOCs-from-file button. A Managed feeds row shows badges for abuse.ch URLhaus, MalwareBazaar, and Feodo Tracker, plus GreyNoise and AlienVault OTX. An LLM provider API keys panel notes abuse.ch is keyless. Stat tiles read 3 feeds, 39K total IOCs, last pull 1 hour ago, and 3 stale feeds. A feeds table lists Feodo, MalwareBazaar, and URLhaus with kind, entry counts, last-fetch timestamps, and status.
Intelligence abuse.ch feeds keyless out of the box; drop your own hashes, IPs, or domains in threat_intel/, or bring GreyNoise / OTX keys for managed feeds.
MacCrab System workspace, Health tab — a KPI strip shows the daemon running with 1 hour 42 minute uptime, 16 collectors all healthy, an event rate of 3.7 per second, 70,500 events lifetime, 4 alerts, and resident memory. The Collectors table lists BrowserExtensionMonitor, ClipboardMonitor, DNSCollector, EDRMonitor, ESCollector, EventTapMonitor, FSEventsCollector, MCPMonitor, NetworkCollector, RootkitDetector, SystemPolicyMonitor, TCCMonitor, TEMPESTMonitor, and USBMonitor — all reporting HEALTHY with event counts and last-tick times.
System health Daemon uptime, event rate, and every active collector — Endpoint Security, Network, TCC, Rootkit, USB, Ultrasonic, and the rest — surfaced live.
Or from the CLI
Current release

What ships in v1.21.4.

483
Detection rules
41
Sequence rules
6
Graph rules
17
Tactic categories
5
LLM backends
2709
Tests passing
Privacy

Your data. Your device.

Detection data is a full picture of what's happening on your machine — it should stay there. MacCrab keeps events in a local SQLite database, runs analysis on-device by default, and ships no telemetry unless you turn it on.

✓
On-device by defaultFleet telemetry, threat-intel feeds, and cloud LLM backends are opt-in switches, not defaults.
✓
No account requiredNo signup or license server. Install, approve the system extension, done.
✓
Local LLM firstOllama is the recommended backend for AI analysis. If you choose a cloud backend, the sanitiser strips usernames, private IPv4 and IPv6 ranges, Mac ComputerName strings, Bearer tokens, and every known API-key shape (Anthropic, OpenAI, Google, AWS, GitHub, Slack, Stripe, Twilio, Postman, Cloudflare, DigitalOcean, Heroku, Vercel, npm, JWT, and 8 more) plus a Shannon-entropy fallback for unknown-vendor secrets, before anything leaves your Mac.
✓
Audit the sourceMacCrabCore's code is Apache 2.0; the detection rules are DRL 1.1. Every collector, rule, and sanitiser is on GitHub for you to read.
Install

Up and running in a few minutes.

macOS 13 Ventura or later. On first launch you'll approve the system extension in System Settings → Login Items & Extensions, and grant Full Disk Access for complete event coverage.

Homebrew Recommended

One command, via the official tap. Installs the signed, notarized app to /Applications and the CLIs to your PATH, then auto-updates from then on.

brew install --cask peterhanily/maccrab/maccrab

Direct DMG

Grab the signed DMG from GitHub Releases. Drag MacCrab.app to /Applications, then approve the system extension on first launch.

open https://github.com/\
  peterhanily/maccrab/releases/latest

From source

Swift 5.9 + Xcode 26. Builds the eight SPM targets (core, agent kit, sysext, legacy daemon, forensics, CLI, MCP server, app) with ad-hoc signing for development.

git clone https://github.com/peterhanily/\
  maccrab.git && cd maccrab
make dev
Frequently asked

Common questions.

Short answers to what people ask most. For the long-form versions, see the README, privacy policy, and security policy.

What is MacCrab?
MacCrab is a local-first macOS threat detection engine. It uses Apple's Endpoint Security framework, 483 detection rules (Sigma-compatible core), behavioural scoring, campaign correlation, and Agent Traces (W3C TRACEPARENT correlation between AI-agent activity and kernel events) to surface suspicious activity on your Mac — entirely on-device, with no cloud console or account.
Does MacCrab replace my antivirus?
No. MacCrab complements macOS's built-in defences (Gatekeeper, XProtect, MRT) and existing antivirus products. It focuses on behavioural detection and Sigma-rule threat hunting rather than signature-based scanning, so the two are additive.
Is any of my data sent to a cloud service?
Not by default. MacCrab stores events in a local SQLite database and runs analysis on-device. Fleet telemetry, threat-intelligence feeds, and cloud LLM backends are opt-in. When a cloud backend is enabled, usernames, private IPs, hostnames, tokens, and known API-key shapes are automatically redacted before any request leaves your Mac.
Which macOS versions does MacCrab support?
macOS 13.0 Ventura or later. On first launch you approve the System Extension in System Settings → General → Login Items & Extensions → Endpoint Security Extensions, then grant Full Disk Access for complete event coverage.
How does MacCrab compare to Santa or osquery?
They solve different problems. Google's Santa is a binary allow/deny authorisation policy engine. osquery is a scheduled SQL query engine with a large ecosystem. MacCrab is real-time, Sigma-rule-based threat detection with behavioural scoring and campaign correlation. All three can run alongside each other.
Is MacCrab open source?
Yes. MacCrabCore's code is Apache 2.0 and the detection ruleset is licensed under the Detection Rule License (DRL) 1.1 — both hosted at github.com/peterhanily/maccrab. Every collector, rule, sanitiser, and the daemon entry-point is readable.
How do I report a security vulnerability?
Email maccrab@peterhanily.com rather than opening a public GitHub issue. MacCrab follows responsible-disclosure practices documented in SECURITY.md.