Persistence & Intrusion Hunting
The auto-run vectors and live-access checks a malware scan alone doesn't cover.
13 tools — 13 read-only.
Read-only tools never modify anything; anything that changes your Mac pauses on an Approve card first.
scan_persistence Read-onlyHunt for the persistence mechanisms the malware scanner's login-item focus doesn't cover: cron jobs, login/logout hooks, emond rules, and launchd items that inject code into other apps (DYLD_INSERT_LIBRARIES). Read-only.
check_shell_startup_files Read-onlyInspect the shell startup files (.zshrc, .zprofile, .bash_profile, .bashrc, .profile, .zshenv) for risky commands that auto-run every time a terminal opens — remote pipe-to-shell (curl | sh), base64/eval blobs, or execution from temp folders. Read-only.
list_ssh_keys Read-onlyInventory this Mac's SSH keys and config (read-only, no key material shown): private keys, public keys, the number of authorized_keys entries (which let OTHERS log into this Mac), known-hosts count, and whether an SSH config exists.
audit_ssh_config Read-onlyAudit the SSH server (sshd) configuration for weak settings — root login allowed, password authentication on — and report the posture. Read-only. Only matters when Remote Login (SSH) is actually on (check_remote_management shows that).
list_recent_installs Read-onlyList the most recently installed software and updates on this Mac, newest first, with dates (from the system install history). Read-only. Use to see 'what changed' before a problem started, or when the user asks what was recently installed.
check_kernel_panics Read-onlyList recent kernel panic reports — full system crashes that forced a restart — with dates. Read-only.)
check_camera_mic_in_use Read-onlyCheck whether the MICROPHONE is being used right now (authoritative, via the audio system) and explain how to read the camera indicator. Read-only.
list_listening_ports Read-onlyList every process LISTENING for incoming TCP connections, with the process, port, and whether it's reachable from the network vs bound to loopback only (safe). Read-only. Fuller than get_access_snapshot (which only counts).
list_recent_logins Read-onlyList recent sign-ins to this Mac (user, terminal, and whether local or from a remote host). Read-only.)
check_time_sync Read-onlyReport the Mac's current clock, time zone, whether automatic network time is on (best-effort), and the configured time server. Read-only.
find_exposed_secrets Read-onlyScan the usual home-folder locations for credential files that store secrets in the clear — AWS/SSH/Git/Docker/Kubernetes/npm/GnuPG credentials, .netrc, .env files — and report which exist and whether their permissions are too loose. Reports only presence and permissions; never reads or returns the secret contents.
scan_shell_history_for_secrets Read-onlyScan this Mac's shell and REPL history files for lines that look like typed secrets (AWS keys, tokens, inline passwords, pasted private keys). Reports the file, line number, and reason only — never the actual line.
list_cameras_and_mics Read-onlyEnumerate the camera and microphone hardware attached to this Mac (built-in and external). This is what could capture — use check_camera_mic_in_use for whether the mic is on right now, and check_app_permissions for which apps hold camera/mic permission.