How to vet a Mac utility before installing it

You found a Mac utility that looks useful. Maybe it tidies your windows, renames files in bulk, or sits in the menu bar doing one job. Before you move it to Applications, spend a few minutes working out what you are letting onto the machine. A utility runs with the reach of your account. It can read your files, and depending on what it requests, it can watch your keystrokes or capture your screen. Most apps are honest. Vetting is how you tell the honest ones from the ones that ask for more than they need.

Here is a practical way to vet a Mac app before installing it, without reading a line of source code.

Start with who made it and where it lives

Before anything technical, look at the source. Is there a real website with a company or a person’s name on it, a support address, and a changelog that goes back more than a week. Does the download come straight from that site or the Mac App Store, rather than a random file locker. A developer who stands behind an app tends to leave a trail: a history of releases, answers to bug reports, a privacy page that says plainly what the app does and does not collect.

Be wary of an app that is all screenshots and no author, or one whose download link hops through several redirects. That is not proof of anything bad, but it is a reason to slow down and read more before you install.

Check the signature and notarization

macOS has two built-in checks worth understanding. A signature ties the app to a developer identity that Apple issued, so the code cannot be swapped out without breaking the signature. Notarization means the developer submitted the app to Apple, which scanned it for known malware and stapled a ticket to it. Neither one guarantees the app is good, but together they tell you it comes from an identifiable developer and passed an automated scan.

You can check this yourself. Right-click the downloaded app, choose Open, and read the dialog: it will name the developer if the app is signed, or warn loudly if it is not. From a terminal you can run codesign -dv and spctl -a -v against the app to see the signing identity and whether the system accepts it. An app that refuses to open unless you disable security settings deserves real suspicion.

Read the permissions it asks for, and when

This is the part that tells you the most. When you first run the app, watch what it requests. macOS asks separately for Accessibility, Screen Recording, Full Disk Access, the microphone, the camera, your contacts, and more. Each prompt is a question about reach. A utility that renames files has no business asking for the microphone. A menu bar tool that never mentions your screen should not be requesting Screen Recording.

Timing matters as much as the list. A well-built app asks for a permission at the moment it first needs it, and explains why. An app that demands Accessibility and Full Disk Access the instant it launches, before you have done anything, is asking you to hand over the keys on faith. As an example of the pattern to look for, Ledge asks for Accessibility only the first time you tell it to paste a file path into a terminal, never at launch, and its global keyboard shortcut needs no special permission at all. That is the shape of a request tied to a feature you actually used.

Watch what it does on the network

A lot of utilities have no reason to touch the internet. If an app that works entirely with local files is chatting with a server in the background, that is worth understanding before you trust it with anything private. You do not need special software to get a first look. macOS ships with tools like nettop and Activity Monitor’s Network tab, which show you which processes are sending and receiving data. Firewalls that prompt on each outbound connection go further, letting you see and block what an app tries to reach.

The strongest version of this promise is an app that cannot go online by design, not just one that chooses not to. That is rare and hard to verify from the outside, so when a developer states it plainly and explains how they enforce it, weigh that in the app’s favour.

A short checklist before you double-click

You can turn all of this into a quick pass that takes a few minutes:

• Is there a named developer, a real site, and a version history you can read.
• Is the app signed and notarized, and does it open without you disabling protections.
• Do the permissions it asks for match what it claims to do, and does it ask at the moment of need rather than all at once on launch.
• Does it stay off the network when the task is local, or explain clearly why it does not.

None of these steps require you to be a security expert. They are the same questions you would ask about anyone you were about to hand a key to your house. Most Mac utilities pass easily, and the few that do not usually reveal it in the first minute, in what they ask for and when. Spending that minute before you install is the cheapest protection you have.