A native macOS menubar app that shows every TCP listening port on your machine, which process owns it, and lets you kill it with one click. Alerts on unknown or suspicious ports.
- Live list of TCP listening ports with process name, PID, address, and command path
- One-click kill (SIGTERM, escalates to SIGKILL after 3 s)
- Alert engine with whitelist/blocklist rules (port, port range, process name)
- macOS notifications for unknown ports and process changes on existing ports
- Adaptive polling — slows down when nothing changes
- Zero external runtime dependencies
- Hidden from Dock (menubar-only)
- macOS 14 (Sonoma) or newer
- Apple Silicon or Intel
- Swift 6 toolchain (Xcode 16+) for building from source
git clone https://github.com/YOUR_USER/PortSheriff.git
cd PortSheriff
swift run PortSheriff./scripts/build-app.sh
open build/PortSheriff.appDrag build/PortSheriff.app into /Applications.
- Launch — shield icon appears in the menubar.
- Click the icon to open the popover.
- Ports tab lists active listeners. Click a row to expand details. Click Kill to terminate.
- Alerts tab shows recent open/close/change events.
- Rules tab manages whitelist and blocklist entries.
- Gear icon opens Settings — poll interval, sound, security mode, launch at login.
Port Sheriff polls lsof -iTCP -sTCP:LISTEN -nP -F pcnu on a hybrid timer (default 5 s, doubles after 10 unchanged scans). Output is parsed in-process, diffed against the previous snapshot, and changes flow through the alert engine.
No kernel extensions, no network capture, no elevated privileges. Just lsof and POSIX signals.
- Port Sheriff never sends network traffic.
- It does not require root.
- Killing a process owned by another user will fail with
EPERM— by design. - See SECURITY.md for vulnerability disclosure.
- TCP only (UDP listeners are not enumerated).
- Process metadata reflects what
lsofsees at scan time; very short-lived processes may be missed between scans. - Not sandboxed — required to shell out to
/usr/sbin/lsofand send signals. Will not run as a Mac App Store build.
swift build # compile
swift test # 33 tests
swift run PortSheriffOpen in Xcode: open Package.swift.
Architecture: single-process SwiftUI MenuBarExtra app. Services layer (PortScanner, AlertEngine, ProcessManager, SettingsStore) coordinated by AppState, observed by SwiftUI views via @Observable.
See CONTRIBUTING.md for code style and PR workflow.