machscope — macOS XPC, Mach services, launchd, and trust relationship explorer (zero-dependency, terminal-native)
Source Reddit Cybersecurity
Discussion
machscope is a macOS terminal-native tool designed to explore and correlate macOS internals such as processes, launchd jobs, Mach services, XPC services, code signatures, entitlements, and trust relationships. It consolidates information from various native macOS tools into a single, readable graph to aid in security triage, malware hunting, and debugging. The tool is dependency-free, written in Python, and leverages macOS native utilities. It surfaces trust and anomaly findings but does not itself represent a vulnerability or exploit. It is intended as a forensic and investigative utility rather than a security threat.
r/cybersecurity (opens in a new tab)u/Outrageous-Talk95790 points0 comments
- This post was deleted. Content shown was captured before removal.
Built this during a long macOS internals investigation. It connects processes → launchd jobs → Mach services → XPC services → code signatures → entitlements → trust signals into one readable view.
Zero dependencies. Pure Python + macOS native tools (codesign, launchctl, otool, plutil).
Some things it answers: - What Mach services does this process expose, and who actually backs them? - Which launchd label owns this daemon, and is it signed by Apple or some random third party? - Are there suspicious mismatches between a binary's signature and the entitlements it demands? - What XPC services are embedded in this app bundle?
Repo: https://github.com/m10ust/machscope
Would love feedback from other macOS CLI nerds.