CoreLock is a Mac security app built around a six-check scan: running apps, network, app permissions, login and background items, AI agents, and the Downloads folder. The checks add up to a 0 to 100 Security Score, and a check that can't run is shown as not checked. Scans run every 15 minutes by default. CoreLock also has screens for privacy permissions, app signatures, network connections, processes and files, Shields for the macOS firewall, and hidden decoy files that notify you if a program changes them. Scanning runs on your Mac. Optional AI explanations, off by default, send a summary to our servers, never your files. It is free with unlimited scans and 3 AI scan reviews a day, with Pro available for $9.99/month (or $50/year).
CoreLock checks running apps, network, app permissions, login items, AI agents and your Downloads folder. Then it shows what it found on a few simple screens.
Last scan: 2 min ago · 6 checks
Security Score
Risky command line: reverse shell
bash connecting out to port 4444
Unsigned item in LaunchAgents
Six checks: running apps, network, app permissions, login and background items, AI agents, and your Downloads folder. Together they make a 0 to 100 Security Score. A check that can't run shows as not checked, never as passed.
On by default. The local checks need no account.
What macOS has granted
Camera
4 apps
Microphone
2 apps
Contacts
1 app
Files and Folders
3 apps
With Full Disk Access, CoreLock lists the permissions macOS has granted, such as camera, microphone, Screen Recording, Accessibility, Full Disk Access, Input Monitoring, contacts and photos. It shows what macOS allowed, not what an app actually used. Revoke opens the right page of System Settings, where you turn access off.
Needs Full Disk Access. Revoke opens the right page of System Settings.
update.pkg from Downloads matched a known-malware hash
Known crypto miner running: xmrig
PID 1847
Unsigned item in ~/Library/LaunchAgents
Every finding goes to the Issues list. Some offer Quit or Quarantine after you confirm. Most open the right page of System Settings or Finder, so you make the change yourself.
Not every fix can be undone.
23 apps checked: 18 notarized, 4 signed, 1 unsigned
18
Notarized
4
Signed
1
Unsigned
0
Broken
/Applications
/Applications
/Applications
~/Applications
When you choose Re-verify, CoreLock checks the code signature and Gatekeeper status of the apps in /Applications and ~/Applications. It flags unsigned apps and broken or expired signatures.
Runs when you choose Re-verify. Apps inside vendor subfolders aren't checked yet.
Open connections, refreshed every 5 seconds
Connections
23
open
Apps
9
connected
Listening
1
beyond this Mac
The scan flags services listening beyond this Mac, though listening doesn't prove anyone can reach them. The Network screen lists your apps' open connections by IP address and port. Shields can turn on the macOS firewall and Stealth mode.
The Network screen refreshes every 5 seconds while it's open. Public Wi-Fi mode needs macOS 26.
Plain-English answers about your findings
What does this open door finding mean?
An app is accepting connections from your network. That doesn't prove anyone can reach it. If you don't need it, turn on the firewall in Shields.
Asked about: Open door
App: node, port 3000
Where do I find Shields?
Ask a question in plain English, in general or about a finding you pick. It can't look at your Mac by itself.
Off by default. Needs a free account. Free plan: 5 questions a day.
100 busiest, sorted by CPU
Busiest processes
Chrome
18% CPU
1.2 GB
VS Code
12% CPU
890 MB
Slack
4% CPU
340 MB
Stop: available for processes you own.
Your 100 busiest processes, sorted by CPU, with friendly names for common ones and each one's CPU and memory use. You can stop processes you own.
Shows CPU and memory for each process. No battery data.
Quick scan: Downloads, Desktop, LaunchAgents
12,847
Files Scanned
2
Flagged
1:34
Duration
Matches a known-malware hash
~/Downloads/suspicious_binary.dmg
Script downloads and runs code (simple heuristic)
~/Desktop/install.sh
Every scan checks your Downloads folder against a built-in list of known-malware hashes and CoreLock's malware-signature (YARA) rules. A signature match is worth a look, not proof. Quick scan adds your Desktop and LaunchAgents. It doesn't look inside Mac app bundles.
Pro's Full scan adds Documents, the launch folders and /Applications. External drives aren't scanned.
Press Scan Now and CoreLock runs all six checks. After that it scans again every 15 minutes by default.
Download CoreLock FreeFree forever. No credit card required.
Now available · Apple Notarized
Your Mac may have forgotten permissions, unsigned apps, and login items you never added. Find yours.