MacPersistenceChecker addresses the challenge of understanding and managing automatic processes on macOS. It provides deep visibility into persistence mechanisms, aiding users in detecting malware, hidden startup items, and system behavior. The tool is designed for macOS users seeking to secure and comprehend their systems, offering local analysis with optional AI-powered insights for faster triage and decision-making.

How It Works

The core of MacPersistenceChecker is a local knowledge graph built from over 22 macOS persistence mechanisms. Deterministic extractors populate this graph, which is then optionally enhanced by Anthropic's Claude AI. This AI integration enables concept clustering, automated risk scoring, and learning of user-defined trust levels, allowing verdicts to propagate across related items. The system prioritizes local processing, with AI features requiring a user-provided API key, ensuring privacy and control.

Quick Start & Requirements

• Install: Download the v2.0.0 DMG and run the application directly; no installer is required.
• Requirements: macOS 13.0+; Xcode 15+ or Swift 5.9+ for building from source.
• Permissions: Full Disk Access is recommended for comprehensive scanning of system configuration files and databases.
• Dependencies: GRDB.swift (SQLite).
• AI Integration: Requires an Anthropic API key for AI-powered analysis features.
• Links: Download v2.0.0 (DMG).

Highlighted Details

• Comprehensive scanning of over 22 macOS persistence mechanisms, including LaunchAgents, Kernel Extensions, and TCC databases.
• AI-powered analysis (Anthropic Claude) for automated triage, threat hunting, and natural language querying.
• Knowledge graph representation of persistence items, enabling concept clustering and intelligent verdict propagation.
• Detailed risk assessment incorporating signature verification, behavioral analysis, MITRE ATT&CK mapping, and timestamp anomaly detection.
• Local-only analysis with opt-in AI features, ensuring data privacy.
• Containment features for safely disabling or quarantining suspicious persistence items with automatic backups.
• MCP Server integration for querying persistence data with Claude Code and other compatible clients.

Maintenance & Community

The project is authored by pinperepette, with the README noting inspiration from Mark Russinovich's Autoruns for Windows in 2025. Specific community channels (e.g., Discord, Slack) or detailed maintenance roadmaps are not explicitly provided in the README.

Licensing & Compatibility

The project is released under the MIT License, which permits commercial use and modification with attribution.

Limitations & Caveats

Requires macOS 13.0 or later. Full Disk Access is necessary for complete visibility; without it, certain persistence items may not be detected. AI features are opt-in and incur costs based on Anthropic API usage, managed by the user.