.app bundle (or a .dmg) onto it and
it produces a forensic report: what the binary is entitled to, which analytics
SDKs it ships, which domains are hard-coded in it, what it registered to launch
at login — and, if you let it, what it reaches for while it runs.
Everything runs locally. The inspected app’s contents never leave your
machine, and no report is ever uploaded. privacycommand does make a handful of
outbound calls — reverse DNS, App Store privacy labels, its own update feed,
and, only if you ask it to fetch a pending update, that vendor’s feed and
download or a
brew fetch of the incoming cask. All five are enumerated in
Security.The two halves
Static analysis happens without running anything. It’s safe on a bundle you don’t trust, it’s fast, and it’s the bulk of the report — entitlements, code-signing and notarization, URL schemes, embedded helpers, SDK fingerprints, hard-coded hosts, Apple’s Privacy Manifest checked against what the binary actually links. Start at Static analysis. Dynamic analysis means launching the app under observation and watching what it does: file events, network destinations, child processes, pasteboard and camera and microphone access. That needs the privileged helper, and for anything you genuinely don’t trust, it should happen inside VM mode.What it won’t do
privacycommand reports. It doesn’t remediate, quarantine, or score apps against a compliance framework, and it makes no claim to detect malware — a determined adversary can hide from static analysis, and dynamic analysis only sees the code paths you happen to exercise. A clean report means “nothing in the signals we extract looked noteworthy”. It does not mean the app is safe.Where to start
Install it
Homebrew, a signed DMG, or from source.
Run your first audit
Drop a bundle in and read what comes back.
Audit a whole fleet
Triage every app in
/Applications at once.Script it
auditctl, the CLI over the same analyzer.