macOS Post-Incident Scanner

Example Use Cases

• 1

  Perform automated post-incident security analysis on macOS systems.

• 2

  Monitor and flag suspicious running processes and network connections.

• 3

  Integrate macOS process and network inspection into MCP-compatible workflows.

Description

Scanner is a post-incident investigation tool designed for macOS that analyzes every running process by checking executable paths, code signing status, and network connections. It flags suspicious indicators such as unsigned binaries, invalid signatures, hidden executables, and unusual network activity, providing severity-ranked explanations. The tool can be used as a standalone CLI or as an MCP server compatible with Claude Code, enabling automated security analysis and process management. It supports allowlisting known binaries to reduce false positives and offers JSON output for scripting and integration.