macos-mscp-scan v0.4.0

This release refines the default personal baseline after an end-to-end review on a personally administered Mac. It reduces organization-specific noise, checks more effective local state, and fixes result-contract mismatches that could misclassify a passing check as a finding.

Highlights

• Excludes traditional auditd, forensic logging, global CIS password-policy, fixed organization time-server, and selected privacy-choice controls from the default personal scope.
• Uses effective local state for App Store updates, Terminal Secure Keyboard Entry, Bluetooth Sharing, password hints, Remote Apple Events, and SMB.
• Accepts Firewall Block All as enabled and checks screen locking in the active user's context.
• Accepts a sudo credential-cache timeout from zero through two minutes.
• Validates mSCP numeric result contracts to prevent false findings.

The personal profile remains a security-posture audit, not a CIS Benchmark assessment. Excluded rules are outside scope, not passes.

Validation

Shell syntax, interface tests, full preparation smoke testing, signed archive verification, and an authorized read-only macOS 26 Apple Silicon audit passed. The audit completed with 48 applicable checks passed, zero findings, and one architecture-appropriate N/A for Power Nap.

See the complete release and verification notes.

macos-mscp-scan v0.3.0

macos-mscp-scan v0.3.0

This release adds a security-posture baseline for personally administered Macs
and a strict AI/user trust boundary around the privileged audit phase.

Included

• personal, the new default baseline for Macs not enrolled in organizational
  MDM;
• effective local-state checks for FileVault, Gatekeeper, Firewall, screen
  locking, Internet Sharing, network time, and other selected controls;
• explicit removal of policy-only rules that cannot produce meaningful results
  outside organizational device management;
• unchanged opt-in cis_lvl1 and cis_lvl2 baselines;
• a non-privileged preparation phase and an explicit user-only interactive
  audit phase;
• reusable dependency caches and isolated per-run reports under $TMPDIR;
• stable pointers to prepared and completed reports; and
• profile definitions, custom rules, provenance, and SHA-256 evidence recorded
  with each personal report.

The personal profile is derived from the CIS Level 1 rule selection, but it is
not a CIS Benchmark assessment and does not claim CIS compliance. The scanner
does not enumerate listening ports, test external reachability, inventory
vulnerabilities, or remediate settings.

Compatibility

macOS 14 Sonoma, 15 Sequoia, and 26 Tahoe are supported on Apple Silicon and
Intel. Personal-profile generation and generated-script validation were run for
all three versions. The full privileged audit was run on macOS 26 Apple Silicon.

Safety contract

The generated mSCP audit is invoked only with --check; the wrapper never uses
--fix or --cfc. An AI agent may prepare a run but must stop before the
interactive audit. Only the user reviews the prompt and authorizes macOS
administrator authentication in their normal Terminal.

Download and verify

The release-signing key fingerprint is:

SHA256:Rt9xlHKnOMVeREiwG041268qY0kxu72vYVt+CntuF+4

Download the four release assets, verify the SHA-256 manifest and its detached
SSH signature, then extract the source archive:

set -e
release_dir="$(mktemp -d /private/tmp/macos-mscp-scan-v0.3.0.XXXXXX)"
cd "$release_dir"

curl -fLO https://github.com/r4kh1m/macos-mscp-scan/releases/download/v0.3.0/macos-mscp-scan-v0.3.0.tar.gz
curl -fLO https://github.com/r4kh1m/macos-mscp-scan/releases/download/v0.3.0/SHA256SUMS
curl -fLO https://github.com/r4kh1m/macos-mscp-scan/releases/download/v0.3.0/SHA256SUMS.sig
curl -fLO https://github.com/r4kh1m/macos-mscp-scan/releases/download/v0.3.0/r4kh1m-release-signing-key.pub

shasum -a 256 -c SHA256SUMS
{
  printf 'r4kh1m-release namespaces="file" '
  cat r4kh1m-release-signing-key.pub
} > allowed_signers
ssh-keygen -Y verify \
  -f allowed_signers \
  -I r4kh1m-release \
  -n file \
  -s SHA256SUMS.sig < SHA256SUMS

tar -xzf macos-mscp-scan-v0.3.0.tar.gz
cd macos-mscp-scan-v0.3.0

To use an AI agent, give it the extracted directory and ask it to follow
AGENTS.md. To prepare the scan yourself:

zsh ./scan_cis.zsh

In either workflow, the script stops after preparation and prints the one
--run-prepared command that the user must run in a normal interactive
Terminal.

Feedback

Use Discussions for questions and compatibility experience, Issues for
reproducible bugs, and GitHub private vulnerability reporting for security
findings. Never post an unredacted audit report.

v0.1.0 — read-only CIS audit

macos-cis-scan v0.1.0

Initial public release of a read-only NIST mSCP CIS audit wrapper.

Included

• scan_cis.zsh — CIS Level 1 or Level 2 audit wrapper.
• SHA256SUMS and SHA256SUMS.sig — integrity manifest and detached SSH
  signature.
• r4kh1m-release-signing-key.pub — public key for manifest verification.

The release-signing key fingerprint is:

SHA256:Rt9xlHKnOMVeREiwG041268qY0kxu72vYVt+CntuF+4

Compatibility

macOS 14, 15, and 26 are accepted. The release was end-to-end tested on macOS
26 Apple Silicon. See Compatibility before using it on a
different target.

Safety contract

The generated mSCP audit is invoked only with --check. This release does not
run remediation commands.

Feedback

Use Discussions for questions and compatibility experience, Issues for
reproducible bugs, and GitHub private vulnerability reporting for security
findings. Never post an unredacted audit report.