Personal Mac Security: Run a Practical Local CheckSkip to article

TL;DR — If you want to check the security configuration of a Mac you<br>administer yourself, use the personal profile in<br>macos-mscp-scan. It builds a<br>read-only audit from the NIST macOS Security Compliance Project (mSCP), never<br>applies fixes or uploads the report, and can be run manually or prepared by<br>an AI agent. Reports stay under your macOS temporary directory. The default<br>command is zsh ./scan_cis.zsh; it prepares the scan, then stops and gives<br>you one separate command to authorize in your normal Terminal.

I wanted to answer a practical question: how can I check whether my own Mac is<br>configured securely?

macOS exposes individual controls such as FileVault, Gatekeeper, the firewall,<br>screen locking and sharing services, but it does not provide one useful report<br>that checks them together and explains failed settings. A malware scan does not<br>answer this question either. I needed a security-configuration audit: a<br>repeatable way to inspect protective settings without changing them.

That search led me to the macOS Security Compliance Project<br>(mSCP). mSCP provides machine-readable<br>security rules, baselines, generated guidance and audit scripts for macOS. It<br>also supports<br>tailoring a baseline<br>and<br>customizing individual rules.

The existing baselines are valuable, but a raw CIS result can assume that an<br>organization manages the Mac through MDM. I therefore created a personal<br>profile for a self-administered Mac. First, here is how to use it. The design<br>and implementation decisions come after the practical workflow.

What this personal Mac security audit checks

The personal profile asks whether selected protections are effective on the<br>Mac at scan time. It covers areas such as:

FileVault disk encryption and Gatekeeper;

macOS and App Store update settings;

the Application Firewall and stealth mode;

automatic login, the guest account and short sudo credential reuse;

screen locking and display-sleep timing;

Internet Sharing, Bluetooth Sharing, Remote Apple Events and SMB; and

privacy-relevant settings such as password hints and diagnostic submission.

It is a configuration audit, not a complete verdict that a Mac is “secure.” It<br>does not scan for malware, inventory vulnerable applications, test external<br>network reachability, enumerate every open port or verify that backups can be<br>restored.

Use the default personal profile for a Mac you administer yourself and that<br>is not controlled through organizational MDM. Use the unchanged cis_lvl1 or<br>cis_lvl2 baseline when you specifically need a CIS compliance view or need<br>to verify centrally enforced policy.

No tracking and no report upload

The macos-mscp-scan wrapper contains no analytics, telemetry or tracking<br>code. It does not send the audit result to a server. The generated report,<br>dependency cache and per-run files remain on the Mac under:

${TMPDIR%/}/macos-mscp-scan/

That location is private to the current user but intentionally temporary.<br>macOS may purge it after a restart, during maintenance or under storage<br>pressure. Copy a report to a permanent private directory only when you need to<br>retain it.

Preparation still makes normal HTTPS requests to GitHub, PyPI and RubyGems to<br>download pinned source and dependencies. Those services can observe ordinary<br>download requests, but the wrapper does not send them the security findings.

A local AI agent can read the local report after you complete the audit. An<br>external chat cannot do that unless you upload or paste the data yourself. Do<br>not send an unredacted report to an external AI service: it can contain user<br>names, host names, paths, installed software and security configuration.

The safe workflow in one minute

The scanner deliberately separates preparation from the privileged audit:

Preparation downloads pinned dependencies, generates the selected audit<br>and hashes its inputs. It runs without sudo and does not inspect security<br>settings.

The script prints PREPARATION COMPLETE — USER ACTION REQUIRED and one<br>exact --run-prepared command.

You run that command in a normal interactive Terminal, review the<br>confirmation and allow macOS to request the administrator password.

The generated mSCP script runs only in documented<br>--check mode.<br>The wrapper never invokes --fix or --cfc.

You read the text, structured plist and generated HTML/PDF report before<br>deciding whether to change anything.

This same boundary works for both manual and AI-assisted use. An agent may<br>prepare the audit and later interpret its output, but only the user starts the<br>privileged phase and enters the password.

Download and verify macos-mscp-scan

The following commands are for macOS and run as the current user; they do not<br>use sudo. They download four assets for the signed v0.4.0 release, verify<br>the checksum manifest and its detached SSH signature, and extract the source<br>under /private/tmp. They require HTTPS access and write only to the newly<br>created temporary...