Why it exists

Mac owners are told "Macs don't get viruses" while adware, InfoStealers and persistence implants on macOS keep setting records. Apple's built-in protections (XProtect, Gatekeeper) are opaque, and commercial security suites cost subscriptions and phone home. Objective-See fills the gap with focused, auditable, free tools — each doing one job well: show what persists, watch the network, catch ransomware behavior — maintained by one of the most respected Apple security researchers and backed by a 501(c)(3) non-profit.

Main features

• LuLu — the free, open-source macOS firewall: per-application network rules, finally a Little Snitch alternative at $0.
• KnockKnock — surfaces everything persistently installed on your Mac (login items, launch agents, extensions…) to generically reveal malware.
• BlockBlock — monitors persistence locations in real time and alerts when anything new tries to install itself.
• TaskExplorer — inspect every running process: code-signing status, VirusTotal results, loaded dylibs, open files, network connections — with a built-in AI assistant (on-device via Apple Intelligence or your own API key).
• ReiKey, Netiquette, RansomWhere?, OverSight, DoNotDisturb — keyboard "event tap" detection, a socket monitor, ransomware heuristics, mic/webcam alerts, and evil-maid attack detection.
• Education — the Objective-See blog and the "Objective by the Sea" conference (the world's only macOS-security-only conference) plus books on macOS malware analysis.

Who it's for

• Mac users who want to see what their machine is doing instead of trusting marketing.
• Security researchers and IT admins triaging suspicious Macs.
• Anyone who wants a serious firewall without a subscription.

How it compares

• Little Snitch — the polished commercial firewall; LuLu is the free, open-source counterpart, simpler but honest.
• Malwarebytes / commercial AV — signature-heavy suites; Objective-See tools are lightweight, transparent and behavior-focused.
• Activity Monitor — Apple's built-in view shows processes, but not code-signing, VirusTotal hits or network sockets per process.

Notes

• Every tool is open source (per-tool licenses on the respective GitHub repos) and free — supported by donations and corporate "friends".
• Tools are macOS-only and updated regularly (TaskExplorer v3.0.0, DoNotDisturb v2.1.0 are recent releases).
• Each tool now has its own entry in this library — see LuLu, BlockBlock, KnockKnock, TaskExplorer, ReiKey, Netiquette, RansomWhere?, OverSight, DoNotDisturb, KextViewr, Dylib Hijack Scanner, What's Your Sign, and the CLI utilities ProcessMonitor, FileMonitor and DNSMonitor.
• Legacy tools Lockdown and Ostiarius (El Capitan era) have been retired — they appear only in HTML comments on the tools page and are not distributed anymore.
• Patrick Wardle's blog doubles as a free masterclass in macOS malware analysis.

Useful links

• Website & tools: https://objective-see.org/tools.html
• GitHub: https://github.com/objective-see
• Blog: https://objective-see.org/blog
• Conference: https://objectivebythesea.org/