New version, updated Oct 27, 2026. If you downloaded the kit earlier, please download it again and rerun it. The new version fixes a check that could fail, and the one-line prompt now picks your newest download.
Mac Agentic Security Sweep is a kit that lets Claude check your Mac for the things that quietly go wrong: programs that start themselves, browser extensions you did not choose, apps holding powerful permissions, traffic being redirected, remote-access back doors, and secrets lying around in config files. It looks, explains what it found in plain language, and only changes something if you say yes, one item at a time, with an undo.
You do not need to be a security person. You paste one line into Terminal and answer questions.
Who it is for
Anyone who wants a calm second opinion on their Mac. It is especially useful if you are an agentic engineer: someone who installs new CLIs, MCP servers, skills, hooks, npm and pip packages, and curl | sh installers every week, and lets AI agents run commands on a machine that holds API keys.
Each of those experiments can leave something behind that outlives the experiment: a launch agent, a helper tool, a root certificate, a token in a dotfile, an extension, a permission you clicked through. A sweep every few months, and after anything you were unsure about, is cheap insurance.
What it checks
Every finding is labelled Confirmed, Likely or Unknown, with the exact evidence line. Before calling anything harmless or malicious, Claude is told to look for evidence that would prove it wrong: dates, signer, whether it is running right now. Findings are split into compromise indicators (these raise an alert) and hardening gaps such as FileVault being off or macOS being out of date (these go in the report, without scaring you).
How it works
- Scan. Read-only. The scripts collect facts. Claude (in Claude Code) reads them, digs into anything odd, and stops to alert you right away if it finds something serious.
- Report. A short plain-language report: verdict, alerts, things worth fixing, what looked fine, what could not be checked, and the one most important next step.
- Clean up (optional). One item at a time. For each: what it is, the evidence, the exact action, what could break, how to undo. Nothing happens without your yes. Items are moved into a
quarantine/ folder with an undo script. Nothing is deleted.
- Protect (optional). Claude can walk you through two free tools from Objective-See, LuLu and BlockBlock, which alert you to new outgoing connections and new startup items from then on.
Why it is safe to run
You should not take that on trust, so each claim here is something you can check in a minute.
| Claim | How you can verify it |
|---|
| The scripts are plain text you can read | sudo-checks.sh, collect-checks.sh and quarantine.sh are short bash. Open them. |
| The scan only reads | It writes only into the results/ folder next to the kit. Run grep -nE '\b(rm|mv|chmod|chown|kill|defaults write)\b' collect-checks.sh sudo-checks.sh. You should see only: kill (stops the script's own timeout timer), mv (renames an earlier results folder to -prev) and chown (hands results/ back to you). Nothing touches the rest of your Mac. |
| The scripts never upload anything | Run grep -nE '(^|[;&|(] *)(curl|wget|nc|scp|sftp|rsync|ssh)( |$)' collect-checks.sh sudo-checks.sh. It matches one line, a search pattern the script uses to spot curl in your launch agents, not a command it runs. |
| The one script that needs your password is read-only | You run sudo bash sudo-checks.sh yourself and can read it first. Claude is told never to run sudo itself and never to edit these scripts. |
| Secrets are masked | API keys, tokens, JWTs and private keys are redacted in the output, and the credential check lists file names only, never contents. |
| Cleanup cannot wreck your Mac | quarantine.sh only moves items inside an allow-list (your launch agents, third-party launch daemons and helpers, apps, native-messaging hosts, AI-tool skill folders). It refuses system files, sudoers, pam.d, login plugins, your Documents and everything else. Genuine Apple-signed apps are refused. |
| Every cleanup is reversible | Moves are recorded in quarantine/UNDO.sh (or UNDO-system.sh for system items). The undo skips anything already back in place. |
| Claude asks before it acts | Claude Code asks you to approve commands. The kit tells you to approve only plain read commands in bulk, never rm, sudo, launchctl, kill or installs. |
| Nothing in the kit phones home | There is no telemetry, analytics or auto-update. The scripts send none of your data anywhere. |
What leaves your Mac, honestly
The scripts send none of your data anywhere. Two checks ask Apple's servers about software updates and app approval, which is normal macOS behaviour. But the point of the kit is that Claude reads the results, so what Claude reads goes to Anthropic as part of your conversation, like anything else you give Claude. That is why the scripts redact secrets and why the kit tells you to skim the results before you share them. Only run it in your own Claude account, and delete results/ when you are done.
What it is not
It is not antivirus and it cannot prove a Mac is clean. Some modern Mac malware runs once, takes passwords and cookies, and leaves almost nothing behind. A good result reads "no indicators found", not "clean". The kit also cannot defend against an already-compromised Claude Code setup; if you suspect that, run Path B from a chat on claude.ai on another device. If a High finding is confirmed as malicious, it will tell you plainly when erasing and reinstalling macOS is the safer move.
This is the beginning of the README. Read the rest at the original. Read the full README ↗
