FAQ

No. It is not antivirus and cannot prove an app is safe or malicious. It shows verifiable macOS trust signals so you can decide what deserves trust, context, or caution.

App Trust Preview can inspect .app bundles, .pkg installer packages, .dmg disk images, binary executables, and executable scripts.

Use the main app with drag and drop or Choose, select a supported file in Finder and press Space for Quick Look, or export JSON and text reports from Terminal with the command line interface.

No. App Trust Preview reads local metadata but does not open, run, modify, grant permissions to, revoke permissions from, or upload the inspected software.

Run '/Applications/App Trust Preview.app/Contents/MacOS/App Trust Preview' --help from Terminal to see the current options. Use this main app binary for CLI access, not AppTrustPreviewInspect. The help output describes supported targets, report formats, scan filtering, test discovery, and the current commands. See the CLI guide for examples.

Yes. First open Settings in App Trust Preview and add the folders the app may read. /Applications already has read-only access. You can add folders such as ~/Downloads and ~/Applications for files you want an AI agent to inspect. Then tell the agent to run '/Applications/App Trust Preview.app/Contents/MacOS/App Trust Preview' --help, read stdout, avoid the --json argument, inspect the target files, read report output from stdout, and summarize the findings for you. Add an output folder with read and write access only when you want saved report files.

A small read-only helper you install intentionally. It enables a live notarization check and, with Full Disk Access, lets App Trust Preview read saved macOS privacy decisions. It does not launch apps, modify bundles, change permissions, or upload anything.

Only to read saved privacy decisions from macOS privacy databases. Without it, App Trust Preview still shows what the app can request, but not whether you previously allowed or denied that request.

macOS stores Location authorization outside the privacy database App Trust Preview can read. The app can show that software declares Location access, but the saved Location decision is Unknown by design.

A sandboxed app is limited by macOS and cannot freely access files, devices, other apps, or the network unless it has specific permissions or entitlements.

It depends. Some apps use unsandboxed helpers for legitimate work, such as updating themselves outside the Mac App Store. It is still worth reviewing because anything the main app hands to an unsandboxed helper can run outside the sandbox limits.

Many apps include helper tools, app extensions, XPC services, login items, frameworks, dynamic libraries, or plug-in bundles. App Trust Preview checks each bundled or runnable component for signature and sandbox status.

Yes. App Trust Preview can display hashes for executable files and provide clickable VirusTotal links so you can view matching public reports by hash. It does not upload the inspected file.

This section lists domains and URLs found through static analysis of the target app. It does not record live network traffic and does not prove that the app connects to every result. To focus the list on destinations the developer could use to send data or provide user links, App Trust Preview filters out routine Apple infrastructure domains and URLs found in standard file format headers or certificate chains when they are unrelated to those uses.

Yes. JulyIghor/AppTrustPreview contains AppTrustPreviewInspect, the internal inspection helper used by the app for Gatekeeper assessment, strict bundle seal verification, package and disk image inspection support, and saved privacy decision lookup. It is not a user-facing CLI tool and is not meant to be run directly from Terminal. For CLI access, use '/Applications/App Trust Preview.app/Contents/MacOS/App Trust Preview' --help. It is published under the MIT license.

The report identifies common app stacks such as Electron, Chromium, CEF, Firefox, Gecko, ToDesktop, Tauri, Wry, WebKit, Qt WebEngine, SwiftUI, React Native, Flutter, Unity, Unreal Engine, Godot, Wine, CrossOver, Java, .NET, Python, Node.js, Mac Catalyst, and iOS apps running on Mac when they can be confirmed.

The app can export PDF, PNG image, JSON, or plain text reports. The command line interface exports JSON or text for automation and AI analysis.

Yes. The main scan is local and sends no network requests of its own. Certificate revocation uses macOS own trust service. If the system cannot answer, that field can read Could not check while the rest of the report still works.