MacMon keeps watch over your Mac's security settings, what starts at login, who can read your files, and what your AI coding agents do. When something changes, it tells you what, when, and why it matters.
A security checklist tells you how your Mac is set up today. MacMon runs its checks every 15 minutes, keeps the results, and records every change, so you can see when a setting was turned off and what else happened around then.
Over 60 checks cover FileVault, SIP, Gatekeeper, the firewall, automatic updates, screen lock, sharing, admin accounts and credential files. Each failing check explains why it matters and how to fix it. MacMon never changes a setting itself.
The first run records what's on your Mac. After that, every new launch agent, login item, privileged helper, configuration profile, trusted certificate, admin or sudoers change shows up as an event, with when it happened.
Every Claude Code and Codex tool call is logged and checked for risky patterns: download-and-run, reverse shells, keychain access, an agent editing its own hooks, or deleting its transcripts. Alerts show the command, what the agent said it was doing and the prompt before it.
See every hook, MCP server, plugin, skill and permission your agents load, with flags for bypass-permissions mode, unpinned npx servers, API redirection and disabled hooks. Mark items you've reviewed as trusted, and MacMon flags them again if they change.
Every Full Disk Access, Accessibility, Screen Recording and Input Monitoring grant, with when it appeared. Terminals, editors and agent apps holding them are flagged, because an agent running inside them inherits the access.
Apps and command-line tools traced to where they came from, with offline risk signals. Listening ports, proxies, DNS resolvers and browser extensions in Safari, Chrome, Firefox and others.
Screen unlocks and failed attempts, sudo, SSH sessions, package installs and downloads, kept as a history you can search. See when something was turned off and what else changed around then.
The menu bar shield takes the color of the worst open alert. Medium and high alerts post a notification, and every alert says why it can matter, what to look at and its common harmless causes.
A shield in the menu bar shows the worst open alert. Open the window to explore checks, alerts, inventory and history, and act on them: acknowledge an alert, accept a change, or jump to the right System Settings pane.
MacMon adds a background item you can see and switch off in System Settings › General › Login Items & Extensions. It runs every 15 minutes, even while the app is closed.
The first run records what's on your Mac today. After that, MacMon tells you about additions, removals and changes instead of everything that already exists.
Install the logging hook for Claude Code or Codex to record every tool call as it happens. It never blocks a call and adds about 5 ms.
Each alert explains why it matters and what to look at. Acknowledge it, accept the change, or follow the fix. MacMon never changes a setting for you.
A security monitor sees a lot: your settings, your login history, the commands your AI agents run. That's exactly why none of it ever leaves your Mac. MacMon has no servers, and we never receive your data.
MacMon is an audit tool. It shows you what changed so you can decide what to do. It works best alongside the protections built into macOS, not instead of them.
MacMon runs entirely on your Mac, with no account and nothing to sign in to.
