FAQ

No. It is not antivirus and cannot prove an app is safe or malicious. It shows verifiable macOS trust signals so you can decide what deserves trust, context, or caution.

App Trust Preview can inspect .app bundles, .pkg installer packages, .dmg disk images, binary executables, and executable scripts.

Use the main app with drag and drop or Choose, select a supported file in Finder and press Space for Quick Look, or export JSON and text reports from Terminal with the command line interface.

No. App Trust Preview reads local metadata but does not open, run, modify, grant permissions to, revoke permissions from, or upload the inspected software.

App Trust Preview intentionally leaves the com.apple.quarantine attribute in place when it installs an app from a DMG. It is designed not to modify inspected apps or change their attributes, including when copying an app to the Applications folder. If you prefer a one-click DMG installation workflow that can remove quarantine after its own macOS security preflight, install the third-party EasyDMG utility and add it to the Open with other apps report section. App Trust Preview passes the analyzed DMG to EasyDMG, which handles installation according to its own settings and security checks.

Run '/Applications/App Trust Preview.app/Contents/MacOS/App Trust Preview' --help from Terminal to see the current options. Use this main app binary for CLI access, not AppTrustPreviewInspect. The help output describes supported targets, report formats, scan filtering, test discovery, and the current commands. See the CLI guide for examples.

A small read-only helper you install intentionally. It enables a live notarization check and, with Full Disk Access, lets App Trust Preview read saved macOS privacy decisions. It does not launch apps, modify bundles, change permissions, or upload anything.

Only to let the optional helper read saved privacy decisions from protected macOS privacy databases. The main app does not need Full Disk Access for normal inspection. Without it, App Trust Preview still shows what an app can request, but not whether you previously allowed or denied that request.

App Trust Preview is a sandboxed Mac App Store app, so it cannot install the optional helper outside its own container by itself. The local installation script provides an explicit, opt-in setup and configures the location and permissions required by macOS. It installs the helper that performs the live notarization test using Apple's local macOS tools and, after you separately grant Full Disk Access, reads saved privacy decisions. You can review the script before running it. The script cannot grant Full Disk Access, which you must still enable explicitly in System Settings.

No. The installation script is included in the signed App Trust Preview app bundle. The app's Apple sandbox entitlements do not include outgoing network access, so the app itself cannot download the script from the internet or upload inspected files. macOS system services may independently perform their own checks, such as certificate revocation.

Yes. First open Settings in App Trust Preview and add the folders the app may read. /Applications already has read-only access. You can add folders such as ~/Downloads and ~/Applications for files you want an AI agent to inspect. Then tell the agent to run '/Applications/App Trust Preview.app/Contents/MacOS/App Trust Preview' --help, read stdout, avoid the --json argument, inspect the target files, read report output from stdout, and summarize the findings for you. Add an output folder with read and write access only when you want saved report files.

macOS stores Location authorization outside the privacy database App Trust Preview can read. The app can show that software declares Location access, but the saved Location decision is Unknown by design.

A sandboxed app is limited by macOS and cannot freely access files, devices, other apps, or the network unless it has specific permissions or entitlements.

It depends. Some apps use unsandboxed helpers for legitimate work, such as updating themselves outside the Mac App Store. It is still worth reviewing because anything the main app hands to an unsandboxed helper can run outside the sandbox limits.

Many apps include helper tools, app extensions, XPC services, login items, frameworks, dynamic libraries, or plug-in bundles. App Trust Preview checks each bundled or runnable component for signature and sandbox status.

Yes. App Trust Preview can display hashes for executable files and provide clickable VirusTotal links so you can view matching public reports by hash. It does not upload the inspected file.

This section lists domains and URLs found through static analysis of the target app. It does not record live network traffic and does not prove that the app connects to every result. To focus the list on destinations the developer could use to send data or provide user links, App Trust Preview filters out routine Apple infrastructure domains and URLs found in standard file format headers or certificate chains when they are unrelated to those uses.

Yes. JulyIghor/AppTrustPreview contains AppTrustPreviewInspect, the internal inspection helper used by the app for Gatekeeper assessment, strict bundle seal verification, package and disk image inspection support, and saved privacy decision lookup. It is not a user-facing CLI tool and is not meant to be run directly from Terminal. For CLI access, use '/Applications/App Trust Preview.app/Contents/MacOS/App Trust Preview' --help. It is published under the MIT license.

The report identifies common app stacks and update frameworks such as Sparkle, Electron, Chromium, CEF, Firefox, Gecko, ToDesktop, Tauri, Wry, WebKit, Qt WebEngine, SwiftUI, React Native, Flutter, Unity, Unreal Engine, Godot, Wine, CrossOver, Java, .NET, Python, Node.js, Mac Catalyst, and iOS apps running on Mac when they can be confirmed.

The app can export PDF, PNG image, JSON, or plain text reports. JSON, text, and CLI reports include security findings, update delivery checks, compatibility details, download history, and file metadata. Save Files can copy an analyzed app bundle, create a ZIP archive or DMG disk image, or install the app in Applications only when you explicitly choose Install.

Yes. The main scan is local and sends no network requests of its own. Certificate revocation uses macOS own trust service. If the system cannot answer, that field can read Could not check while the rest of the report still works.