Support

It shows the most serious open alert. A plain shield means there are no open medium or high-severity alerts. A colored shield means there's something to look at. Open MacMon to see what it is. The shield is also tinted if background checks have stopped running.

No. MacMon only audits. Each failing check explains why it matters and shows how to fix it, often with a button that opens the right System Settings pane, but you make the change. A monitor that changed settings on its own would be one more thing to audit.

No. MacMon is a tripwire, not a lock. It records and alerts. It never blocks a command, an install, or a sign-in. Keep the protections built into macOS turned on, such as Gatekeeper, XProtect, and the firewall. MacMon checks that they're on.

MacMon alerts on change, not on intent. A new login item or a new privacy permission looks the same whether you added it or something else did. If you recognize it, choose Accept to add it to your allowlist, or Acknowledge to dismiss the alert. Each alert lists the common harmless causes to help you decide.

No. The first run sets the baseline: it records what's on your Mac without alerting on each item. After that, you're told about additions, removals, and changes. Keep in mind that the baseline trusts whatever is already there, so it's worth a quick look through Inventory after setup.

Only to read the macOS databases that record which apps have privacy permissions, such as Full Disk Access, Accessibility, and Screen Recording. Everything else works without it, and the two privacy permission checks show "not checked" until you grant it. Grant it to MacMon's collector in System Settings › Privacy & Security › Full Disk Access. MacMon's Settings › Permissions has a button that shows you which file to add.

An AI agent running inside your terminal or editor inherits that app's permissions. If your terminal has Full Disk Access, so does every agent and script you run in it. If you need the access, accept the alert to add it to your allowlist.

Claude Code and Codex. MacMon reads their configuration and session transcripts, and can install a logging hook for each. For Codex, approve the hook in Codex afterwards with the /hooks command.

No. The hook records each tool call and adds about 5 ms. It never blocks a call, never prints anything, and always reports success to the agent, even if something goes wrong inside MacMon.

AI tool call rules match patterns in commands, so some harmless commands will match. Each alert shows the exact part of the command that matched, what the agent said it was doing, and the prompt before it. If it's harmless, acknowledge it. If you've reviewed a configuration item such as a hook or MCP server, choose Trust. MacMon flags it again only if it changes.

macOS sometimes stops starting MacMon's background item after the app is updated or moved. Click Restart Background Monitoring in Overview, the menu bar window, or Settings › General. If it keeps happening, check that MacMon is in your Applications folder, then email us.

Yes. Choose Pause in the menu bar window, or Pause monitoring in the main window or Settings › General. Scheduled checks stop until you resume. You can also turn background checks off entirely in Settings › General or System Settings › General › Login Items & Extensions.

No. MacMon makes no network connections, and its scans run with network requests refused. There are no accounts, analytics, or servers. The only exception is an optional command-line feature, macmon vulns --online, which you have to run by hand. See the privacy policy.

Yes. MacMon includes the macmon command-line tool. In Settings › General, add the command, which links it to ~/.local/bin/macmon. Then try macmon status, macmon alerts, macmon ai, or macmon report --open for an HTML report. The app and the command line share the same history and settings.

1. In MacMon's Settings › General, turn off background checks.
2. In Settings › Agent Hooks, remove the Claude Code and Codex hooks if you installed them. If you turned on Protect the hook, choose Remove Protection too.
3. Quit MacMon and move it from Applications to the Trash.
4. To delete MacMon's history and settings, delete ~/Library/Application Support/macmon/ and ~/.config/macmon/.
5. If you granted Full Disk Access, remove MacMon's collector from System Settings › Privacy & Security › Full Disk Access.

macOS 15 Sequoia or later, on a Mac with Apple silicon and Intel. MacMon is written and tested for macOS 26 Tahoe on Apple silicon.