ClearanceKit for MAC
Free, open-source Mac app that guards sensitive files: it blocks any process without an allow rule from protected folders, using Endpoint Security.
ClearanceKit Overview
ClearanceKit is a free, open-source tool that controls which programs on your Mac may touch your sensitive files. It uses Apple's Endpoint Security framework to watch file-system events such as opens, renames, deletions, copies and directory reads, and blocks any process that accesses a protected path without an explicit allow rule. It is aimed at developer machines, where an unsandboxed npm, pip or brew install script runs with your full permissions and could otherwise read folders such as ~/.ssh, cloud credentials or browser cookies.
Rules identify programs by their code signature, the Team ID and Signing ID checked by macOS, instead of by path or file hash, so they keep working after updates. Jail rules confine a process, and its child processes, to a set of allowed folders, and ancestry rules can require that access comes from a trusted parent. Denied events appear in a native SwiftUI window where you can review them and build your policy, and the policy can also be delivered by MDM configuration profiles. ClearanceKit is made by Craig J. Bass and released under the MIT license; it makes no network calls, sends no telemetry and has no automatic updates, so new versions are downloaded from its GitHub releases page. On first launch you must activate its system extension and give it Full Disk Access, both required for Endpoint Security. Version 5.0.14 closes a security issue that let protected files be read through Apple's WebKit services. The developer does not list a minimum macOS version.
Key Features
ClearanceKit puts a gate in front of your private folders.
- Protected paths: deny access unless a process has an allow rule.
- Signature rules: match programs by Team ID and Signing ID.
- Jail rules: confine a process and its children to chosen folders.
- Ancestry rules: allow access only on behalf of a trusted parent.
- Glob patterns: protect folders with *, ** and ? wildcards.
- Event review: see denied access in a native SwiftUI window.
- MDM support: deploy policies with configuration profiles.
- Private: no network calls, no telemetry, no third-party code.
What’s New in Version 5.0.14
ClearanceKit 5.0.14 is a security update.
- Fixed a flaw that let any local process read protected files through Apple's WebKit networking service
- New responsible-process checks: accesses by WebKit services are checked as the app they work for, such as Safari or Mail
- Risk confirmation extended to allowing WebKit services and other responsible-process entries
- Fixed: the Endpoint Security cache is now cleared after allowlist changes
- Safari preset entries updated
ClearanceKit FAQ
Is ClearanceKit free?
Yes. ClearanceKit is free and open source under the MIT license.
What does ClearanceKit protect against?
It is designed to limit what untrusted code can read, for example a malicious npm postinstall script reading ~/.ssh, cloud credentials or browser cookies. Any process without an allow rule is blocked from protected paths.
How does ClearanceKit recognise trusted apps?
Rules match the Team ID and Signing ID in a program's code signature, not its path or file hash, so a rule keeps working after the program is updated while a tampered or unsigned binary is denied.
What are jail rules?
A jail rule confines a specific process to a set of allowed folders; any file access outside them is denied, and child processes inherit the jail.
What does ClearanceKit need to work?
On first launch you activate its system extension, which macOS asks you to approve in System Settings, and give it Full Disk Access. Both are required for Endpoint Security.
Does ClearanceKit connect to the internet?
No. According to its developer it makes no network calls, sends no telemetry and has no third-party dependencies.
How do I update ClearanceKit?
There is no automatic update. Check the GitHub releases page for new versions.
Can companies deploy ClearanceKit policies?
Yes. Policies can be delivered through Apple configuration profiles from an MDM system.
What changed in ClearanceKit 5.0.14?
It fixes a flaw that let protected files be read through Apple's WebKit networking service, and adds responsible-process checks so WebKit accesses are judged as the app they work for.
Where does the ClearanceKit download on clearancekit.FULLMAC.app come from?
The download button leads to the official ClearanceKit releases page on GitHub at https://github.com/craigjbass/clearancekit/releases/latest. clearancekit.FULLMAC.app does not change or repackage the app.
Similar Apps
MakLockMakLock is a lightweight menu bar app that protects your macOS applications with Touch ID, Apple Watch proximity or a backup password. When someone tries to open or switch to a protected app, MakLock blocks access with a full-screen blur overlay on all your monitors and asks for authentication. It watches for app switches as well as launches, so returning to an app that is already running also needs unlocking.Security
KnockKnockKnockKnock is a free, open-source Mac security tool that shows what is persistently installed on your computer. Malware usually installs itself so that it runs again each time the Mac restarts, and KnockKnock uncovers software that has done this, whatever its name. Press Start Scan and it goes through the known places where such software can hide, then lists what it found by category, with the number of items in each.Security
ExifCleanerExifCleaner removes hidden metadata from images, media files and PDFs, such as the GPS location, camera details and dates that photos often carry. Drag and drop files or whole folders onto the window and it cleans them in a fast batch, using ExifTool behind the scenes. You can expand any processed file to see exactly what was removed, before and after.Security
Pareto SecurityPareto Security helps you keep up basic security on your Mac. It lives in the menu bar and regularly checks common settings that are easy to forget: whether FileVault disk encryption is on, the firewall is enabled, automatic login is off, Gatekeeper is active, the screen locks automatically and your apps are kept up to date. When something is off, it gently reminds you to fix it. The idea behind the name is the Pareto principle: take care of the 20% of security tasks that prevent 80% of problems.Security
LuLuLuLu is a free, open-source firewall for Mac. Almost every app connects to the internet, and so does malware; LuLu watches outgoing network connections and asks you whenever a program it doesn't know tries to connect, so you can allow it or block it. Your decisions become rules, and LuLu applies them from then on. LuLu is made by Objective-See, a non-profit foundation for Mac security tools, and is released under the GPL-3.0 license.Security- Little SnitchLittle Snitch shows you where your Mac connects to on the internet and lets you decide what is allowed. Whenever an app wants to connect, a connection alert asks you to allow or deny it, so no data leaves your Mac without your consent. Its Network Monitor shows all connections in real time, on a world map and in a traffic chart, grouped by app, domain or country. Little Snitch is made by Objective Development and has been protecting Macs for more than 20 years.Security
FULLMAC.app does not host this app. Download buttons lead to the developer’s own pages.