macdog — macOS Security & Privacy Suite

Run a full security audit:

!macdog audit 2>&1 || echo "macdog not installed — brew install lu-zhengda/tap/macdog"

Analyze the audit results above. Explain the overall security grade and highlight any failing checks. For each issue, explain the risk and offer to fix it with macdog audit --fix or specific commands.

Commands

| Command | Purpose | Example | |---------|---------|---------| | macdog audit | Full security audit with letter grade (A-F) | macdog audit | | macdog audit --fix | Auto-apply recommended hardening for failing checks | macdog audit --fix | | macdog audit --watch | Continuous monitoring, alert on score drop | macdog audit --watch --min-score 70 | | macdog firewall | Show firewall status and rules | macdog firewall | | macdog firewall enable | Enable the firewall | macdog firewall enable | | macdog firewall disable | Disable the firewall | macdog firewall disable | | macdog firewall allow <app> | Allow an app through firewall | macdog firewall allow /Applications/Slack.app | | macdog firewall block <app> | Block an app in firewall | macdog firewall block /Applications/Suspicious.app | | macdog firewall export [file] | Export firewall rules to JSON | macdog firewall export rules.json | | macdog firewall import <file> | Import firewall rules from JSON | macdog firewall import rules.json | | macdog privacy | List TCC privacy permissions | macdog privacy | | macdog privacy revoke <app> <service> | Revoke a permission | macdog privacy revoke com.app.name Camera | | macdog privacy export [file] | Export TCC permissions snapshot | macdog privacy export perms.json | | macdog login | List login items and launch agents | macdog login | | macdog login remove <item> | Remove a login item | macdog login remove "Some App" | | macdog harden | Apply security hardening preset | macdog harden | | macdog harden --dry-run | Preview hardening changes | macdog harden --dry-run | | macdog events | Security events: auth, tcc, gatekeeper, xprotect, firewall | macdog events | | macdog events --last <duration> | Filter events by time window | macdog events --last 1h | | macdog events --type <type> | Filter by event type | macdog events --type tcc | | macdog events --severity <level> | Filter by minimum severity (info, warning, critical) | macdog events --severity warning | | macdog events --json | JSON output for scripting | macdog events --json |

Security Events

View security-related events from the system log:

# Show recent security events
macdog events

# Filter to last hour
macdog events --last 1h

# Filter by event type
macdog events --type auth
macdog events --type tcc
macdog events --type gatekeeper
macdog events --type xprotect
macdog events --type firewall

# Filter by minimum severity
macdog events --severity warning
macdog events --severity critical

# JSON output for scripting
macdog events --json

Event types:

• auth — Login attempts, sudo usage, authentication failures
• tcc — TCC permission grants and denials (camera, microphone, etc.)
• gatekeeper — Gatekeeper checks and notarization events
• xprotect — XProtect malware detection and remediation events
• firewall — Firewall blocks and connection denials

Severity levels: info, warning, critical

Events are automatically deduplicated — consecutive same-type events within 30s are collapsed with a count.

Auto-Fix Workflow

Automatically apply recommended fixes for failing audit checks:

# Preview what audit --fix would change
macdog audit --fix --dry-run

# Apply fixes (enables firewall, Gatekeeper, etc.)
macdog audit --fix

Continuous Monitoring

Watch security posture and alert on score drops:

# Alert when score drops below 70
macdog audit --watch --min-score 70

Combine with lanchr create --template monitor-security for persistent monitoring.

Firewall Rule Portability

Export and import firewall rules for backup or migration:

macdog firewall export rules.json
macdog firewall import rules.json

Security Audit Checks

The audit evaluates: FileVault encryption, firewall status, Gatekeeper, SIP, remote login, screen lock, sharing services, and more. Each check gets a pass/fail with explanation.

Safety Guidelines

• Always --dry-run before --fix: Preview what changes will be applied
• Audit first: Run macdog audit to understand your current posture before changing anything
• Firewall changes require sudo: Enabling/disabling firewall needs admin privileges
• Privacy revocations are immediate: Apps lose access as soon as permissions are revoked
• Export before import: Back up existing rules before importing new ones

TUI Mode

Launch macdog without arguments for an interactive security dashboard.