macOS Executable Directory Reference — every bin, sbin and libexec

The full inventory

this machine

Every directory on this system that holds executables, with its population and its job. Counts are from macOS 26.6.2; they drift by a few dozen between releases and grow with third-party installs. The 26.5.2 → 26.6.2 update moved none of the system counts below.

Path	#	What it holds
/bin	37	The irreducible minimum: shells and the handful of commands needed to bring the system up or repair it when nothing else is mounted.
/sbin	74	Boot-critical system binaries — `launchd`, filesystem mount/check/create helpers, networking basics. Historically "root-only," now mostly just "system-essential."
/usr/bin	924	The main event. BSD userland + GNU imports + Apple's own command-line tools + whole bundled runtimes (Perl, Ruby, Python 3 stub, Tcl, Java stubs, CUPS, OpenLDAP, net-snmp, Postfix front-ends).
/usr/sbin	228	Administrative commands and a few daemons that are meant to be typed by a human with `sudo`: `diskutil`, `networksetup`, `softwareupdate`, `spctl`, `system_profiler`.
/usr/libexec	429	The daemon zoo. Not on anybody's PATH. Programs here are launched by other programs — almost always `launchd` — and most will refuse to do anything useful if you run them by hand.
/usr/local/bin	2	Reserved for you. Empty on a clean install; SIP does not protect it, which is exactly the point.
/opt/homebrew/{bin,sbin}	1396	Homebrew on Apple silicon. (Intel Macs use `/usr/local`.) Not part of macOS at all.
/Library/Apple/usr/bin	1	An Apple-owned annex outside the sealed system volume, used for pieces that ship separately: here, `rvictl` and the Rosetta helpers in the sibling `libexec`.
/System/Cryptexes/App/usr/{bin,libexec}	10	Safari and WebKit, shipped as a cryptographically sealed "cryptex" disk image that can be updated independently of the OS.
/Applications/Xcode.app/…/usr/bin	230	Two directories: the Xcode developer tools and the toolchain (clang, swift, linkers). Reached through `xcrun`, not the PATH.
/Library/Developer/CommandLineTools	137	The same toolchain without the IDE, in `usr/bin`. Installed by `xcode-select --install`.
/usr/libexec/{cups,postfix,apache2,…}	—	Sub-hierarchies belonging to a single bundled service — its filters, backends, plugin `.so` files and private helpers.

Why the filesystem lies to you

Four macOS-specific mechanisms make these directories behave unlike any other Unix.

1 · The Signed System Volume

Since Big Sur, /System, /usr, /bin and /sbin live on a separate read-only APFS volume whose entire directory tree is hashed into a single seal verified at boot. The system you're browsing is grafted together at runtime by firmlinks — /usr/local and /Users are on the writable Data volume and stitched into the same namespace. You cannot add a file to /usr/bin. Not as root, not with SIP disabled, not with chmod. Breaking the seal requires bputil and a reboot into recovery.

2 · System Integrity Protection

Independently of the seal, SIP restricts what even root may do to system paths and to other processes (no task_for_pid against Apple binaries, no attaching a debugger, no loading unsigned kexts). csrutil status reports it. Most "permission denied as root" surprises in this reference trace back here.

3 · The dyld shared cache

Nearly every system library was removed from disk and pre-linked into one enormous cache file. ls /usr/lib/libSystem.dylib shows nothing, yet everything links against it — dyld resolves it from the cache. The same trick does not apply to executables: the files in these bin directories are real. But it explains why otool -L names dylibs you can't find, and why update_dyld_shared_cache exists.

4 · Cryptexes

A cryptex ("cryptographically sealed extension") is a signed disk image mounted at boot and grafted into the system paths. Safari/WebKit ship this way in /System/Cryptexes/App; Rapid Security Responses arrive as cryptexes too. It lets Apple replace parts of a sealed, immutable system volume without re-sealing the whole thing.

PATH and `path_helper`

macOS does not set PATH in a shell rc file. /usr/libexec/path_helper, invoked from /etc/zprofile, builds it by reading /etc/paths and every file in /etc/paths.d/, then appending whatever the shell already had. /etc/paths alone gives:

/usr/local/bin:/System/Cryptexes/App/usr/bin:/usr/bin:/bin:/usr/sbin:/sbin

/etc/paths.d/ then appends. Apple ships three fragments there — 10-cryptex (three /var/run/com.apple.security.cryptexd/…/bootstrap directories), 10-pmk-global (/pkg/env/global/bin) and 100-rvictl (/Library/Apple/usr/bin) — so the real PATH on a stock install is five entries longer than the list above, and installers such as MacTeX drop in more.

Two consequences worth knowing. Order matters: /usr/local/bin and Homebrew come first, so a brewed python3 or curl shadows Apple's. path_helper deduplicates and re-orders: it can move a directory you carefully put first back to the end, which is why the usual advice is to prepend in .zshrc (run after .zprofile) rather than in .zprofile.

Note that /usr/libexec is deliberately absent. So is Xcode's toolchain — that is what xcrun is for.

Reading an unfamiliar binary

You will meet programs on this page with no man page and no --help. In roughly this order:

man 8 foosection 8 is where daemons hideman -k foowhatis search, catches renamed pagesfile $(which foo)Mach-O? script? universal?strings -a foo | grep -i usageflags never documented elsewhereotool -L foolinked frameworks ⇒ what it touchescodesign -dvvv --entitlements - fooentitlements are the real capability listlaunchctl print system/com.apple.foohow launchd runs it, and whylaunchctl list | grep -i foois it running right now?sudo fs_usage -w -f filesys foowhat it actually openslog stream --predicate 'process=="foo"'most Apple daemons narrate to unified logging

The entitlements trick is the best one. A daemon's entitlements plist tells you what it is allowed to do — read the keychain, install kexts, talk to the Secure Enclave, bypass sandbox — which is usually a sharper description of its purpose than any prose. Try it on /usr/libexec/amfid or /usr/libexec/trustd.

Also: grep -rl foo /System/Library/LaunchDaemons /System/Library/LaunchAgents finds the plist that starts it, which names the launch conditions — on demand, at boot, on a network change, on a schedule.

Naming conventions

Apple's naming is more regular than it first appears, and the pattern usually tells you the category before you look anything up.

Pattern	Meaning
food	A daemon. `trustd`, `secd`, `locationd`, `logd`. Nearly all of `/usr/libexec`.
fooctl	A control client for a daemon or subsystem. `launchctl`, `kmutil`'s cousins, `otctl`, `ckksctl`, `tmutil`.
fooutil	A user-facing utility. `hdiutil`, `diskutil`, `tmutil`, `mdutil`, `plutil`, `kextutil`.
foodiagnose	A one-shot collector that bundles logs into a tarball for a bug report. There are a dozen: `sysdiagnose`, `smbdiagnose`, `tbtdiagnose`, `usbdiagnose`, `mddiagnose`…
mount_xxx	Filesystem-specific mount helper. `mount` execs these; you rarely call them directly.
fsck_ / newfs_ / fstyp_	The same per-filesystem pattern for check, create and identify.
foo.d	A DTrace script, not a compiled binary. Twenty-five ship in `/usr/bin`, mostly Brendan Gregg's DTraceToolkit.
foo5.34	Version-suffixed duplicate of a bundled Perl script. Identical to the unsuffixed one; exists so a future Perl bump doesn't break scripts.
cvfoo	Xsan / StorNext clustered filesystem. Fifteen commands nobody outside a video shop has ever run.
uarpfoo	Apple's Update And Restore Protocol — firmware delivery to accessories (AirPods, keyboards, cables).

How to read the entries

Each program is tagged with a coloured dot for provenance:

● Apple-original — written by Apple, exists nowhere else. This is the interesting stuff.
● BSD / POSIX classic — inherited from FreeBSD/NetBSD or mandated by POSIX. Behaves as you expect, though usually the BSD variant, not GNU: sed -i wants an argument, ls has no --color.
● Bundled open source — a third-party project Apple ships and patches: Perl, Ruby, CUPS, OpenLDAP, Apache, Postfix, net-snmp, OpenSSH, curl, git, vim.
● Developer tool — part of the compiler/debugger/Mach-O toolchain, present even without Xcode.
● Legacy / deprecated — vestigial, Carbon-era, or explicitly marked deprecated in its own man page. Kept for compatibility; do not build on it.

The filter box at the top matches names and descriptions across the whole document — type keychain, firmware or DTrace to slice it by topic instead of by directory.

Shells

macOS ships five distinct shells plus two symlink-ish variants. Since Catalina the default login shell is zsh; bash is frozen at 3.2 (2007) because Apple will not ship GPLv3.

shPOSIX shell. On macOS this is a separate, stripped-down build of bash 3.2 running in POSIX mode — /bin/sh --version says so outright. Scripts with #!/bin/sh therefore get bash quirks, not dash quirks, which is a portability trap in the opposite direction from Linux.

bashGNU Bourne-Again Shell, version 3.2.57. Deliberately ancient: 3.2 was the last GPLv2 release. No associative arrays, no ** globbing, no ${var^^}. Homebrew's bash 5 is a different program.

zshThe Z shell, and the default interactive login shell since macOS 10.15. Reads /etc/zprofile (which runs path_helper), then /etc/zshrc, then your dotfiles.

dashDebian Almquist shell — a tiny, fast, strictly-POSIX shell. Present mostly so that #!/bin/dash scripts and speed-sensitive install scripts have somewhere to go. Not the system sh.

cshThe C shell. On macOS this is literally the same binary as tcsh. Kept for the small population of ancient scripts and for people who learned Unix in 1985.

tcshThe enhanced C shell — csh with command-line editing, filename completion and history substitution. Was the macOS default until 10.3.

kshThe KornShell (ksh93). Full-featured Bourne-family shell with arithmetic, floating point and co-processes. Present for compatibility with commercial Unix scripts.

Files & directories

The BSD versions, not GNU. Long options are largely absent; -h means "human-readable" on some and "no-dereference" on others; check the man page before scripting.

lsList directory contents. Apple additions: -@ shows extended attributes, -e shows ACLs, -O shows BSD file flags (hidden, uchg, restricted), -G is colour (there is no --color).

cpCopy files. -c requests an APFS clone — an instant, zero-byte copy-on-write copy. -p preserves mode/times; -X strips extended attributes and resource forks, which cp otherwise carries.

mvMove or rename. Within one APFS volume it is a rename (instant); across volumes it degrades to copy-then-delete.

rmRemove files and directories. No --one-file-system, no undo, and no trash — for that see trash(8) in /usr/bin. rm -P overwrites before unlinking, which is meaningless on SSDs.

mkdirCreate directories. -p makes parents, -m sets the mode atomically.

rmdirRemove empty directories only. Fails loudly rather than recursing — which is the point.

lnCreate hard or symbolic links. macOS hard-links directories internally for Time Machine on HFS+, but ln won't let you.

linkA thin wrapper that calls link(2) exactly once with no safety checks. Exists so scripts can create a hard link without ln's argument parsing getting clever.

unlinkThe counterpart: one raw unlink(2) call. Removes a single directory entry, no prompts, no recursion.

chmodChange permission bits. macOS extends it heavily for ACLs: chmod +a "user:bob allow read" edits the POSIX-draft ACL, and -N strips it.

dfReport free space per filesystem. On APFS the numbers are odd on purpose: volumes in a container share one free-space pool, so several volumes each honestly report the same available bytes.

pwdPrint the working directory. The shell builtin usually shadows it; the binary exists so execing programs and find -exec have one.

realpathResolve a path to its canonical absolute form, following every symlink and firmlink. Handy for discovering that /var is really /private/var.

Text & output

catConcatenate files to stdout. BSD cat; -v shows non-printing characters, -n numbers lines.

echoPrint arguments. The /bin/echo binary does not interpret \n by default; every shell has its own builtin that behaves differently. A perennial portability trap — use printf.

edThe original Unix line editor, 1969. Present because POSIX requires it and because it is the only editor guaranteed to work on a broken system with no terminal database.

exprEvaluate an arithmetic or string expression as a separate process. Predates shell arithmetic; still used in sh scripts that must run anywhere.

testEvaluate a conditional expression — file tests, string and numeric comparison. Shadowed by the shell builtin in practice.

[The same program under its other name. Yes, [ is a real file in /bin. It requires a closing ] as its final argument, which is why the space in [ -f x ] is mandatory.

Process, system & boot

The reason /bin and /sbin are not symlinks into /usr on macOS: these must run before /usr is guaranteed usable.

launchctlThe single most important command on macOS. The client for launchd — start, stop, load, unload, inspect and reconfigure every service on the system. Modern syntax is launchctl print system/com.apple.foo, bootstrap, bootout, kickstart -k; the old load/unload verbs are deprecated but everywhere. Lives in /bin because launchd is PID 1 and its client must be available at the very start of boot.

psProcess status. BSD flavour: ps aux, not ps -ef (though both work). -o selects columns; macOS adds wq and other Mach-aware fields.

killSend a signal. Note that on macOS many processes are restarted instantly by launchd after you kill them — that is a feature, and the reason launchctl kickstart -k exists.

sleepDelay for N seconds. Accepts fractions on macOS (sleep 0.25), unlike strict POSIX.

datePrint or set the system date. BSD syntax for arithmetic: date -v-1d for yesterday, date -j -f to parse without setting.

hostnamePrint or set the kernel hostname. On macOS this is only one of three names — see scutil --get ComputerName / LocalHostName / HostName, which is what the GUI actually edits.

sttyQuery and change terminal line settings — echo, canonical mode, control characters, window size.

syncFlush the buffer cache to disk. Largely ceremonial on modern APFS but harmless.

ddConvert and copy blocks. The classic raw-device tool: writing disk images, reading a partition, benchmarking. macOS supports status=progress-style output only via SIGINFO (Ctrl-T).

paxPOSIX archive interchange — reads and writes tar and cpio formats and can copy directory trees preserving everything. Apple's installers use it internally; ditto is the friendlier Apple equivalent.

wait4pathBlocks until a given path appears in the filesystem namespace, then exits. A tiny Apple-only primitive used by launchd jobs and boot scripts that must not start until a volume is mounted: wait4path /Volumes/Data && ….

Boot, init & power

launchdPID 1. Apple's replacement for init, cron, inetd, rc scripts and SysV run levels all at once. It starts every daemon and agent on the system, restarts them when they die, launches them lazily when a socket or file path is touched, and owns the XPC service namespace. You never run it — you talk to it with launchctl. Job definitions live in /System/Library/LaunchDaemons (system, as root), /System/Library/LaunchAgents (per login session), and the /Library equivalents for third parties.

shutdownBring the system down at a given time, with warnings to logged-in users. -h halt, -r reboot, -s sleep (an Apple addition).

rebootRestart immediately, skipping the orderly shutdown that shutdown -r performs. Sends SIGTERM then SIGKILL. -q skips even that.

haltStop the processor without powering off. Same binary as reboot, different behaviour by argv[0].

nologinPolitely refuse a login and exit non-zero. Set as a user's shell to disable interactive access without deleting the account. Most macOS service accounts use /usr/bin/false instead.

dynamic_pagerHistorically managed swap file creation and deletion in /private/var/vm. Now vestigial — the kernel handles compressed memory and swap itself. Kept so old references don't break.

dmesgPrint the kernel message buffer. Requires root on modern macOS, and gives far less than it used to: most kernel logging moved to the unified log, so log stream --predicate 'senderImagePath contains "kernel"' is now the real tool.

Mount helpers

mount does not know how to mount anything. It parses arguments, then execs mount_<fstype>. Each helper below speaks exactly one filesystem, and each accepts -o options the generic mount man page doesn't list — read the specific man page.

mountMount a filesystem, or with no arguments list what is currently mounted. Dispatches to the helpers below.

umountUnmount. -f forces; on macOS diskutil unmount is usually better because it coordinates with diskarbitrationd and the Finder instead of fighting them.

mount_apfsMount an APFS volume. The interesting options are Apple-specific: -s mounts a snapshot read-only (this is how Time Machine browses backups), -o nobrowse hides the volume from the Finder.

mount_hfsMount HFS+. Options for journal replay, ownership enforcement (-o noowners, the classic fix for "you don't have permission" on an external drive), and case sensitivity.

mount_msdosMount FAT12/16/32. -u/-g/-m assign owner, group and mode, since FAT has no permissions of its own.

mount_exfatMount exFAT — the format most large SD cards and cross-platform external drives use.

mount_cd9660Mount an ISO-9660 disc or image, with Rock Ridge and Joliet extension handling.

mount_cddafsMount an audio CD as a filesystem full of AIFF files. A charming piece of classic Mac OS behaviour that still works: insert a CD, get /Volumes/Audio CD/1 Audio Track.aiff.

mount_udfMount UDF — the DVD-Video and Blu-ray filesystem, and the format of rewritable optical media.

mount_nfsMount an NFS export. macOS supports NFSv2/3/4 and has Apple-specific options for locking behaviour and for the nfs.conf defaults.

mount_smbfsMount an SMB/CIFS share — Windows and NAS file sharing, and what the Finder's "Connect to Server" uses. Syntax: mount_smbfs //user@host/share /mnt.

mount_afpMount an AppleShare (AFP) volume. AFP is deprecated in favour of SMB and removed from the server side, but the client persists for old NAS boxes and Time Capsules.

mount_webdavMount a WebDAV URL as a volume. This is the mechanism behind iCloud Drive's web sharing, Box/ownCloud mounts and old-style iDisk.

mount_ftpMount an FTP site read-only as a filesystem. Deprecated, unencrypted and slow; still occasionally the fastest way to grab a tree.

mount_devfsMount the device filesystem at /dev. Auto-populated by the kernel as drivers attach; you never mount it by hand outside of a chroot.

mount_fdescMount the file-descriptor filesystem, giving you /dev/fd/N so that process substitution (<(cmd)) works.

mount_tmpfsMount a RAM-backed temporary filesystem. Contents vanish on unmount. Used for scratch space where disk writes would be wasteful.

mount_virtiofsMount a directory shared from a virtualization host into a guest. This is how folder sharing works in Apple's Virtualization.framework — UTM, VMware Fusion and Parallels guests running macOS or Linux on Apple silicon.

mount_9pMount a Plan 9 filesystem share. The other VM guest-sharing transport, used by some virtualization stacks in preference to virtiofs.

mount_acfsMount an Xsan (StorNext) clustered SAN volume. Part of the Quantum-derived Xsan stack that Apple still bundles — see the cv* commands in /usr/sbin.

Consistency check & repair

Same dispatch pattern as mount. Run these on an unmounted volume; on a live one they can only verify. Disk Utility's "First Aid" is a GUI over exactly these binaries.

fsckThe front-end. Reads /etc/fstab, works out each filesystem's type and execs the right checker. In single-user mode the traditional incantation is /sbin/fsck -fy.

fsck_apfsCheck and repair APFS. Verifies the container's object map, checkpoint chain, snapshots, encryption metadata and every volume in the container. -n to check without repairing, -y to answer yes. Very chatty; the output is genuinely useful when a container is misbehaving.

fsck_hfsCheck HFS+ and HFS Standard: catalog B-tree, extents overflow, attributes file, journal. Still needed for old external drives and Time Machine backups on HFS+.

fsck_csVerify and repair a CoreStorage logical volume group. CoreStorage was the pre-APFS layer that made FileVault 2 and Fusion Drive possible; still present for legacy volumes.

fsck_exfatCheck exFAT — allocation bitmap, upcase table, directory entry checksums.

fsck_msdosCheck FAT12/16/32: the two FAT copies, cluster chains, lost clusters, directory structure.

fsck_udfCheck a UDF volume.

fsck_fskitThe new one. FSKit is Apple's framework (introduced in macOS 15) for writing filesystems as userspace extensions rather than kexts; this dispatches a check into whichever FSKit module claims the volume. Its presence marks the beginning of the end for filesystem kexts.

quotacheckWalk a filesystem and rebuild the disk-quota usage database, correcting drift between the quota file and reality.

Create & identify filesystems

newfs_apfsCreate an APFS container and volumes. Exposes things Disk Utility hides: volume roles (-o Data, System, Preboot, Recovery), reserve and quota sizes, case sensitivity, encryption. diskutil apfs is the friendlier front end.

newfs_hfsCreate an HFS Plus filesystem. -J enables journaling, -s makes it case-sensitive (HFSX), -b sets block size.

newfs_msdosCreate a FAT filesystem. Note -F 32 for FAT32 and -v for the volume label.

newfs_exfatCreate an exFAT filesystem, with control over cluster size — worth tuning for large media cards.

newfs_udfCreate a UDF filesystem, for optical media or cross-platform large-file exchange.

newfs_fskitFormat a volume using a userspace FSKit filesystem extension. The counterpart to fsck_fskit.

fstypIdentify what filesystem is on a device without mounting it. Runs each fstyp_* prober in turn and prints the first match.

fstyp_hfsProbe: is this an HFS/HFS+ volume?

fstyp_msdosProbe: is this a FAT volume?

fstyp_ntfsProbe: is this NTFS? Note that macOS can identify and read NTFS but has no bundled writer — the write support in the kernel is disabled.

fstyp_udfProbe: is this UDF?

disklabelManipulate and query an Apple Label partition — the small metadata partition Apple uses on some disk layouts. Rarely touched by hand.

APFS & storage hardware

apfs_hfs_convertConvert an existing HFS+ filesystem to APFS in place. This is the machinery that ran during the High Sierra upgrade on every Mac with an SSD. Still shipped; still works; extremely one-way.

apfs_unlockfvUnlock a FileVault-encrypted APFS data volume from the command line, given a password or recovery key. The tool you reach for in Recovery mode when you need the Data volume mounted before the GUI will cooperate.

mknodCreate a block or character device node by major/minor number. Nearly useless on macOS because devfs owns /dev and repopulates it at boot.

fibreconfigConfigure Fibre Channel host bus adapters — targets, ports, LUN masking. Survives from the Xserve and Xsan era for the video-production installs that still run fibre SANs.

mpioutilConfigure multipath I/O: when a storage LUN is reachable over several fibre or iSCSI paths, this sets the policy for which path to use and how to fail over.

Networking

The low-level BSD tools. On macOS they will happily show you state that configd immediately overwrites — for durable changes use networksetup or scutil in /usr/sbin.

ifconfigConfigure and inspect network interfaces. macOS-specific reading: en0/en1 are Ethernet and Wi-Fi, utun* are VPN and iCloud Private Relay tunnels, awdl0 is Apple Wireless Direct Link (AirDrop/AirPlay), llw0 is low-latency WLAN, bridge0 is Internet Sharing, anpi* are the internal Apple Silicon management NICs.

routeManually manipulate the routing table. route -n get default is the quickest way to see which interface traffic is actually leaving by.

pingICMP echo. On macOS, unprivileged users can ping because the binary is setuid; -S selects a source address, useful when several interfaces are up.

ping6The IPv6 counterpart. Worth having separately because IPv6 neighbour discovery fails in different ways than ARP.

pfctlControl pf, the OpenBSD packet filter — macOS's actual firewall at the packet level (the GUI "Firewall" is a different, application-level thing run by socketfilterfw). Rules live in /etc/pf.conf and Apple's own anchors. pfctl -s rules, pfctl -e to enable.

nfsdThe NFS server daemon. macOS can still export filesystems over NFS; configured in /etc/exports and started via launchd.

nfsiodLocal NFS asynchronous I/O daemon — kernel-side helper threads for the NFS client.

Kernel extensions

Both are now shims. On Apple silicon, kext loading is governed by boot policy and handled by kmutil and kernelmanagerd; these commands forward the request and often just tell you to go use kmutil.

kextloadLoad a kernel extension. On modern macOS this triggers user approval, a boot-policy check and usually a reboot into an updated boot kernel collection. Superseded by kmutil load.

kextunloadTerminate a driver's IOKit instances and unload the kext. Frequently fails on Apple silicon because kexts live in the immutable boot collection.

Message digests

Twelve files, one program. Apple ships the BSD-style tools (md5 file → MD5 (file) = …) and GNU-compatible *sum aliases (md5sum file → … file), because scripts written on Linux expect the latter. They are hard links to the same binary, which checks argv[0].

md5 · md5sumMD5, 128-bit. Cryptographically broken — fine for detecting accidental corruption, useless against an adversary.

sha1 · sha1sumSHA-1, 160-bit. Also broken for collision resistance (SHAttered, 2017). Still what Git uses internally.

sha224 · sha224sumSHA-2 truncated to 224 bits.

sha256 · sha256sumSHA-2, 256-bit. The default choice, and what code signing, notarization and APFS integrity checks use.

sha384 · sha384sumSHA-2, 384-bit. Paired with P-384 ECDSA in some TLS suites.

sha512 · sha512sumSHA-2, 512-bit. Faster than SHA-256 on 64-bit hardware, which surprises people.

Also see shasum (a Perl script in /usr/bin with -c checkfile support), cksum, and openssl dgst. Nothing here does SHA-3 or BLAKE — use openssl.

The built-in stubs

~30

Type which cd and you get /usr/bin/cd. Run it and nothing happens. These files exist so that man cd works and so find -exec doesn't error — each is a tiny script or link whose real purpose is to carry a man page. The shell's own builtin always wins.

alias · unaliasDefine and remove command aliases (builtin).

cdChange directory (builtin — it must be, since a child process can't change its parent's cwd).

bg · fg · jobs · waitJob control: background, foreground, list, and wait for children (builtin).

command · type · hashRun bypassing functions/aliases; report how a name resolves; manage the PATH lookup cache (builtin).

fcFix command — re-edit and re-run history entries (builtin).

getoptsParse positional options in a shell script (builtin). Not to be confused with getopt(1), which is a real binary with different, worse quoting behaviour.

readRead a line into shell variables (builtin).

ulimit · umaskResource limits and default file-creation mask (builtin).

whichReport which file a command name would resolve to. Actually a real binary here, but it doesn't know about builtins or functions — type is more truthful.

true · falseDo nothing, successfully / unsuccessfully. Real binaries, occasionally used as a login shell to disable an account.

envRun a program with a modified environment; with no arguments, print the environment. #!/usr/bin/env python3 is the portable-shebang idiom.

printenvPrint all or one environment variable. Differs from echo $VAR in that it sees only exported variables.

getconfQuery system configuration limits — getconf PATH_MAX /, getconf LONG_BIT, getconf DARWIN_USER_TEMP_DIR (that last one is Apple's per-user temp path).

Search & pattern matching

grepThe BSD/GNU grep. Apple ships the FreeBSD version — it has -r, -E, -P is absent (no PCRE), and colour is --color with GREP_OPTIONS long removed.

egrep · fgrepExtended-regex and fixed-string grep. Both now print a deprecation warning on some builds; use grep -E / grep -F.

bzgrep · zgrep · zegrep · zfgrep · bzegrep · bzfgrep · zipgrepWrappers that decompress on the fly and pipe into grep — for .bz2, .gz and .zip respectively. Trivially useful on rotated logs.

findWalk a file hierarchy. BSD find: -delete, -exec … +, -xattr/-xattrname (Apple additions for extended attributes), -newerBt for HFS birth time. No -printf.

xargsBuild argument lists and execute. BSD version: -0 for NUL separation, -J for a placeholder (macOS's answer to GNU's -I), -P for parallelism.

locateQuery a prebuilt filename database — near-instant, but the database is built by a weekly launchd job and is disabled by default on macOS until you load com.apple.locate. mdfind is the modern alternative.

whereisLocate a program's binary, source and man page by searching a fixed list of standard directories.

lookPrint lines from a sorted file beginning with a prefix, using binary search. With no file it searches /usr/share/dict/words — a two-second spell check.

fuserList the process IDs holding a file or filesystem open. The quick answer to "why won't this unmount?" (lsof gives more detail).

Stream & field processing

awkThe one-true-awk (BWK awk), not gawk or mawk. No gensub, no asort, no true multidimensional arrays. Fine for field extraction; scripts written for gawk will surprise you.

sedBSD stream editor. The famous difference: sed -i requires a backup suffix, so the portable form is sed -i '' 's/a/b/' — the empty string is the argument, not a typo.

cutSelect columns by byte, character or delimited field. No --complement.

pasteMerge corresponding lines of files side by side.

joinRelational join of two sorted files on a common field. Underused; often replaces an entire awk script.

commCompare two sorted files, printing three columns: lines only in the first, only in the second, and in both.

sortSort lines. BSD sort: -V version sort is present, -h human-numeric is not. -u, -k, -t, -R all behave as expected.

uniqCollapse or report adjacent duplicate lines. Requires sorted input, always.

trTranslate or delete characters. BSD tr does not accept multibyte ranges the way GNU tr does; tr -d '[:print:]' works, tr 'а-я' does not.

wcCount lines, words, bytes, and with -m, characters.

head · tailFirst / last N lines or bytes. tail -f follows; tail -F also handles the file being rotated out from under it.

nlNumber lines, with control over which lines count and how the numbers are formatted.

split · csplitBreak a file into pieces — by size/line count, or at lines matching a pattern.

revReverse the characters of every line.

tsortTopological sort of a dependency list. Built for lorder and library ordering, but a perfectly general tool for "what order can I do these in?"

fmtSimple paragraph reflow to a target width.

foldHard-wrap lines at a column, breaking mid-word unless -s.

prPaginate for printing — headers, page numbers, multiple columns.

columnFormat input into aligned columns. column -t -s, makes CSV readable in one keystroke.

colrmDelete a range of columns from every line.

colFilter out reverse line feeds and backspace overstriking. Its real job today is man foo | col -b to get clean text out of nroff output.

expand · unexpandConvert tabs to spaces and back.

rsReshape a data array — transpose, reflow N items per line, matrix-ify a stream. Obscure and genuinely powerful.

lamLaminate: interleave lines from several files with arbitrary separators. Like paste with more control.

jotBSD's sequence generator: numbers, random data, repeated strings, character ranges. More flexible than seq.

seqPrint an arithmetic sequence. Simpler and more portable than jot.

teeCopy stdin to stdout and to files. -a appends; | sudo tee file is the standard workaround for redirecting into a root-owned file.

yesPrint a string forever. Feeds interactive prompts, and makes a decent one-line CPU load generator.

stdbufRun a command with altered stdio buffering — the fix for "my pipeline produces nothing until it finishes."

applyRun a command once per argument, substituting %1. A pre-xargs BSD idea that survives.

topsApple's in-place substitution tool for source code — applies a table of textual replacements across a tree. Used internally for API renames.

tab2spaceExpand tabs and normalise line endings in one pass. Apple's answer to CR/LF/CRLF chaos in mixed-heritage source trees.

Comparing & patching

diffCompare files or directories. Apple ships FreeBSD diff, which supports -u, -r, -N and colour, but not every GNU long option.

diff3Three-way comparison — the merge primitive underneath version control.

sdiffSide-by-side diff with an interactive merge mode.

diffstatSummarise a diff as a histogram of insertions and deletions per file. What git diff --stat reimplements.

cmpByte-for-byte comparison; reports the first differing offset. Much faster than diff for "are these identical?"

patchApply a diff. Handles context, unified and ed-style patches, and fuzzy matching.

opendiffLaunch FileMerge, Xcode's graphical three-way diff/merge tool, from the command line. Works even for non-Xcode users if the developer tools are installed.

bspatchApply a binary delta produced by bsdiff. Apple uses this format for delta software updates — tiny patches against large binaries. Note that bsdiff itself is not shipped, only the applier.

stringdupsFind duplicate strings (or other repeated objects) inside a running process's malloc blocks. A memory-waste hunting tool, paired with heap and leaks.

Editors

macOS ships three editor families and no emacs. vi is a symlink to vim; the r* variants are restricted modes with shell escapes disabled.

vim · viVi IMproved. vi is the same binary in compatibility mode. The shipped build is "huge" minus some interpreters — no Python or Ruby support, which breaks a few plugins.

view · rview · rvimRead-only vim; and the two restricted variants that refuse shell escapes and :!. Used as a safe pager for untrusted contexts.

vimdiffOpen two to eight files in vim with differences highlighted and scroll-bound.

vimtutorThe interactive 30-minute vim tutorial. It's still there. It's still good.

exThe line-oriented mode of vi, addressable as its own command. Useful for scripted edits: ex -sc '%s/a/b/|x' file.

nano · picoThe friendly modeless editor with the shortcut bar at the bottom. pico is an alias. The default $EDITOR for anyone who has ever been trapped in vim.

mgMicro GNU Emacs — a tiny public-domain emacs clone from OpenBSD. Emacs keybindings without emacs. Almost nobody knows this ships with macOS.

xedOpen a file in Xcode from the terminal, optionally at a specific line: xed -l 42 file.swift. Blocks with -w, which makes it usable as $EDITOR for git.

Manual pages

macOS switched from groff to mandoc. Rendering is faster and the search database is per-directory (mandoc.db) rather than one global whatis file.

manDisplay a manual page. Sections that matter here: 1 user commands, 5 file formats, 8 daemons and system administration. Many Apple tools are documented only in section 8, so man 8 name when man name fails.

apropos · whatisSearch the man database by keyword / by exact name. man -k is the same as apropos. This is how you find a tool whose name you've forgotten.

manpathPrint the directories that will be searched for man pages, assembled from /etc/man.conf and /etc/manpaths.d/.

mandocThe formatter itself. Renders mdoc and man source to terminal, HTML, PostScript or PDF — and mandoc -Tlint validates a man page you're writing.

soelim · mandoc_soelimRecursively inline .so include directives in roff source before formatting.

demandocStrip all formatting from a manual page, emitting plain words. Built for indexing.

makewhatis(In /usr/libexec.) Rebuild the man search database. Run it after installing man pages by hand, or apropos won't see them.

Terminal & terminfo

tputQuery the terminfo database and emit control sequences. The correct way to do colour and cursor movement in a portable script: tput setaf 1, tput cols, tput civis.

clearClear the screen (and, on modern terminals, the scrollback with -x inverted).

reset · tsetReinitialise a terminal that a crashed program left in a broken state. reset is the blunt instrument; tset is the configurable one.

tabsSet hardware tab stops on the terminal.

tic · infocmpCompile a terminfo source description; and decompile/compare one. Needed when adding support for a terminal emulator macOS doesn't know.

captoinfo · infotocapConvert between the old termcap format and terminfo, in each direction.

toeTable of entries — list every terminal type in the terminfo database.

ttyPrint the device name of the terminal on stdin. tty -s is the standard "am I interactive?" test in scripts.

scriptRecord an entire terminal session — input, output and timing — to a typescript file. Excellent for capturing a bug reproduction verbatim.

screenGNU Screen, the terminal multiplexer. Also the standard way to open a serial console on macOS: screen /dev/tty.usbserial 115200.

less · more · lessecho · lesskeyThe pager and its helpers. more on macOS is less in a compatibility mode. lesskey compiles a custom keybinding file.

File metadata — the Apple layer

This is where macOS diverges most sharply from Unix. Files carry extended attributes, BSD flags, ACLs, resource forks, quarantine tags and Finder metadata, none of which ls -l shows.

xattrThe one to know. List, read, write and delete extended attributes. xattr -l file dumps them all; xattr -d com.apple.quarantine file is the incantation that makes "app is damaged and can't be opened" go away. Other common keys: com.apple.metadata:kMDItemWhereFroms (download URL), com.apple.FinderInfo, com.apple.ResourceFork.

chflagsSet BSD file flags. macOS-specific ones matter: hidden (invisible in Finder), uchg/schg (immutable — the "Locked" checkbox), restricted (SIP-protected), nodump. ls -lO displays them.

statDisplay inode data. BSD format strings: stat -f '%Sp %Su %N' file. Also shows APFS birth time, which ls can't.

SetFileSet classic Mac file attributes — creator code, type code, invisibility, creation date. Carbon-era, marked deprecated, still occasionally the only way to set a four-character type code.

GetFileInfoThe reader half. Prints type/creator codes and attribute flags.

dot_cleanMerge ._filename AppleDouble sidecar files back into the real file's extended attributes, then delete them. The cure for a directory full of ._ junk after a round trip through a FAT drive or a non-Apple NAS.

SplitForksThe inverse: split a file's resource fork out into an AppleDouble ._ sidecar so it survives a non-Mac filesystem.

mkbom · lsbomCreate and list a bill of materials — the binary manifest of every file, mode, owner and checksum inside an installer package. lsbom /var/db/receipts/*.bom tells you exactly what a .pkg put on your disk.

afscexpandDecompress a file that was compressed with HFS+/APFS transparent compression (the com.apple.decmpfs attribute). Most of the system's own binaries are stored this way, which is why du and Finder's "Get Info" disagree.

uttypeReport the Uniform Type Identifier for a file, extension or MIME type, and dump the UTI hierarchy. The modern replacement for type/creator codes: uttype -e pdf.

fileIdentify file type by content, using magic numbers. Knows about Mach-O, universal binaries, and most Apple formats.

duDisk usage. -h human-readable, -d 1 for one level. Beware compression and APFS clones: du reports allocated blocks, which for a cloned file is near zero.

installCopy a file while setting owner, group, mode and, optionally, stripping it. What Makefiles use instead of cp && chmod && chown.

touch · mkfifo · mktemp · truncateCreate/update timestamps; make a named pipe; safely create a unique temp file or directory; grow or shrink a file to an exact size.

basename · dirname · readlink · pathchkPath surgery: strip the directory, strip the filename, resolve a symlink, and check a name for portability.

chgrpChange group ownership. (chown lives in /usr/sbin on macOS, which trips people up.)

Users, sessions & accounting

macOS keeps accounts in OpenDirectory, not /etc/passwd. These BSD tools mostly still work, but they read a synthesised view — the authoritative tools are dscl, dsmemberutil and sysadminctl.

id · groups · whoami · lognameReport your uid/gid/groups, group memberships, effective username, and login name. On macOS id also prints the user's UUID-backed group memberships resolved through OpenDirectory.

who · w · usersWho is logged in; who is logged in and what they're running; just the names. On a desktop Mac these show console and each terminal window.

lastLogin history from /var/log/utmpx, most recent first. last reboot gives you an uptime history.

lastcommShow every command executed, in reverse order, from the process accounting log — if accounting is on (see accton).

suSubstitute user. On macOS su - to root works only if root is enabled (dsenableroot); otherwise use sudo.

sudoExecute as another user, per /etc/sudoers. macOS ships an Apple-patched sudo that can authenticate with Touch ID if you add auth sufficient pam_tid.so to /etc/pam.d/sudo_local.

loginSign in on a terminal. Also usable as login -f user to start a fully-initialised login session, which matters because a login shell gets a different environment and PAM session than su.

passwdChange a password. Routes through OpenDirectory and respects the password policy set by pwpolicy.

chpass · chfn · chshThree names for one program that edits the user record: full name, office, phone, and login shell. chsh -s /bin/bash is the common use.

newgrpStart a shell with a different primary group.

quotaShow a user's disk quota usage and limits.

mesg · wall · write · talkTerminal messaging from the timesharing era: allow/deny writes to your tty, broadcast to everyone, write to one user, and open a split-screen two-way chat. All still functional between terminal sessions on one machine.

bannerPrint a word in enormous ASCII letters. No practical purpose. Ships anyway.

Scheduling & process control

Both cron and at still work, but on macOS the right answer is nearly always a launchd plist with StartCalendarInterval — launchd survives sleep, catches up missed runs and runs in the correct session context.

crontabEdit the per-user cron table. Still honoured — cron in /usr/sbin is started on demand by launchd when a crontab exists. Note that cron jobs run outside the GUI session and lack most TCC permissions.

at · atq · atrm · batchQueue a command for one-shot execution at a given time; list the queue; remove a job; and run when load permits. Disabled by default — enable with sudo launchctl load -w /System/Library/LaunchDaemons/com.apple.atrun.plist.

nice · reniceStart a process at, or change a running process to, a different scheduling priority. On macOS, taskpolicy is more powerful — it can also change I/O priority and QoS class.

nohupRun immune to hangup, redirecting output to nohup.out. Largely superseded by launchd and screen.

timeTime a command's real, user and system CPU. The shell builtin has nicer formatting; /usr/bin/time -l adds page faults, peak RSS and context switches.

pgrep · pkillFind or signal processes by name, user, parent or full command line. pgrep -fl is the fast way to see if something is running.

killallKill by process name rather than PID. On macOS, killall Dock and killall Finder are the standard "apply that defaults change" gestures.

lockfRun a command while holding an exclusive lock on a file — a mutex for shell scripts, preventing two copies of a cron job overlapping.

shlockCreate or verify a PID-based lock file. The older, racier way to do the same thing.

ipcs · ipcrmReport and remove System V IPC objects — message queues, semaphores, shared memory segments. macOS supports them but almost nothing uses them; Mach ports and XPC took over.

leaveRemind you when it's time to leave, by nagging your terminal. From 1979, and endearing.

calendarA reminder service that reads a calendar file of dates and prints today's and tomorrow's entries. Ships with files for holidays, birthdays of famous scientists, and computing history.

cal · ncalPrint a calendar. ncal is the vertical-layout variant and can also tell you the date of Easter for any year.

Numbers, encodings & locales

bcArbitrary-precision calculator with a C-like language. echo 'scale=20; 4*a(1)' | bc -l gives you π to 20 places.

dcThe reverse-Polish arbitrary-precision calculator that bc was originally a front-end for. Older than C.

unitsInteractive unit conversion with a large database — currency excluded, but everything from furlongs to electronvolts included.

exprEvaluate an expression as an external command (also in /bin).

iconvConvert text between character encodings. iconv -l lists the several hundred supported.

locale · localedefShow the current locale settings and their effect; and compile a locale definition. locale -a lists what's installed.

gencatCompile a message catalogue for the X/Open NLS message API. Predates modern gettext.

hexdump · odDump a file in hex, octal, decimal or ASCII. hexdump -C gives the canonical side-by-side view.

xxdHex dump with a reverse mode (xxd -r) that rebuilds the binary from the dump. The usual way to hand-patch a byte.

stringsPrint printable character sequences from a binary. The first tool to reach for on an undocumented Apple binary — hidden flags and error messages live here.

vis · unvisEncode non-printable characters into a visible, reversible form and back. Safe way to move arbitrary bytes through a text channel.

cksum · sumCRC checksum and byte count; and the older BSD/SysV checksum algorithms. For real hashing use the sha* family in /sbin.

uuidgenGenerate a random (version 4) UUID. Used constantly in Apple plists and launchd labels.

base64 · b64encode · b64decode · uuencode · uudecode · bintransBinary-to-text encodings. base64 is the modern one; the others are historical mail-transfer formats, with bintrans a dispatcher across several.

Apple archive formats

Apple has quietly built a modern compression stack — LZFSE, LZBITMAP and the AppleArchive container — that preserves everything HFS/APFS files carry (xattrs, ACLs, forks, clones) and that tar loses. These are the tools for it.

aaApple Archive. The modern replacement for tar on macOS: create, list and extract .aar/.yaa archives with full APFS metadata fidelity, selectable compression (lzfse, lzma, zlib, lz4, lzbitmap), multithreaded by default. aa archive -d dir -o out.aar. Apple ships software updates in this format.

yaaThe older name for the same tool — "Yet Another Archiver." Kept as a compatibility alias; identical behaviour.

aeaApple Encrypted Archive. Wraps an Apple Archive in authenticated encryption, with key material either from a password, a symmetric key, or an ECDH keypair. This is the container used for encrypted system assets and some MDM payloads.

stzManipulate Streamable Archives — a format designed to be usable while it is still downloading, so an installer can begin unpacking the first files before the last ones arrive.

xarThe eXtensible ARchiver: an XML table-of-contents plus a heap of compressed files, with per-file checksums and signing support. This is the container inside every .pkg installer and every Safari extension. xar -tf foo.pkg lists it.

xipCreate or expand a signed .xip archive — a xar with a code signature that the system verifies before extracting a single byte. Apple distributes Xcode this way. Expanding an untrusted .xip is safe precisely because the signature is checked first.

dittoThe one to actually use. Copy a directory tree preserving every scrap of macOS metadata — resource forks, xattrs, ACLs, compression, symlinks, ownership. Also creates and extracts zip and cpio archives with that fidelity: ditto -c -k --sequesterRsrc --keepParent dir dir.zip is the canonical way to zip a Mac app for distribution. --arch can thin a universal binary during the copy.

archiveutilThe command-line entry point to Archive Utility, the GUI app that double-clicking a zip invokes. Useful when you want byte-identical behaviour to what a user gets from the Finder.

applesingleEncode and decode AppleSingle — the format that packs a data fork, resource fork and Finder info into one flat file. The sibling of AppleDouble (the ._ files).

macbinary · binhex · debinhex.pl · binhex.plMacBinary and BinHex 4.0 — how Mac files travelled over 7-bit email and BBSes in the 1980s and 90s. Still shipped, still decode a .hqx you find in an archive.

tar, cpio & friends

tar · bsdtarmacOS's tar is bsdtar (libarchive), not GNU tar. Consequences: it transparently reads zip, 7z, iso, xar, cab and rpm as well as tar; --strip-components exists; but GNU-only flags like --wildcards and --transform do not. It also writes ._ AppleDouble entries for xattrs unless you set COPYFILE_DISABLE=1.

cpioThe other classic archive format, still used by installer packages and by pax. Reads from a list of filenames on stdin, which makes it compose well with find.

paxThe POSIX-blessed archiver that reads and writes both tar and cpio and can also do a straight tree copy. Apple's package installer uses pax internally. (Also in /bin.)

ptar · ptardiff · ptargrepPure-Perl tar clone from Archive::Tar, plus a tool that diffs an extracted tree against its archive, and one that greps inside archive members without extracting.

sharCreate a shell archive — a self-extracting sh script containing text files. How source code was distributed on Usenet.

mtree(In /usr/sbin.) Record a directory hierarchy's structure, permissions and checksums into a spec file, then verify a tree against it later. Apple uses mtree specs to define the layout of the system volume.

Compressors

gzip · gunzip · zcat · gzcatDEFLATE compression, the universal default. zcat/gzcat decompress to stdout.

zcmp · zdiff · zless · zmore · zforce · znew · gzexeThe gzip helper suite: compare compressed files, page them, force a .gz suffix, convert .Z to .gz, and make a self-decompressing executable.

bzip2 · bunzip2 · bzcat · bzip2recoverBurrows-Wheeler compression — slower than gzip, noticeably smaller. bzip2recover salvages intact blocks from a damaged archive, which gzip cannot do at all.

bzcmp · bzdiff · bzless · bzmoreThe same helper suite for bzip2.

compress · uncompressThe original Unix LZW compressor producing .Z files. Obsolete since the 1990s patent mess; kept because POSIX says so.

zip · unzipInfo-ZIP. Note zip -X to omit extra attributes and zip -y to store symlinks rather than follow them — both matter when zipping a Mac app (though ditto does it better).

funzipExtract the first member of a zip from a pipe. Lets you do curl … | funzip without ever writing the archive to disk.

unzipsfxA stub you prepend to a zip file to make it self-extracting.

zipinfo · zipdetailsList an archive's contents in detail; and dump the raw internal structure — local headers, central directory, extra fields. zipdetails is a forensics tool.

zipnote · zipcloak · zipsplitEdit archive comments and member names; encrypt members (weak legacy zip crypto — don't); split an archive across several files.

streamzipPerl tool that builds a zip file from stdin, so you can compress a stream you can't seek.

Disk images

The .dmg is macOS's other archive format — a real filesystem in a file, which is why it can be encrypted, mounted read-write, and signed.

hdiutilThe disk image swiss army knife. attach and detach images; create new ones (sparse, sparsebundle, read-only, encrypted with AES-128/256); convert between formats; burn; compact a sparse image; imageinfo to inspect; attach -nomount to get a device without mounting. Also the tool for making an encrypted container: hdiutil create -encryption AES-256 -type SPARSEBUNDLE ….

hdikThe lightweight in-kernel attacher underneath hdiutil. Attaches an image without involving Disk Arbitration or the Finder — used during boot and install, when the higher layers aren't running yet.

hdidThe historical predecessor of hdiutil attach. Documented as obsolete; still present.

asrApple Software Restore. Block-copy an entire volume from a disk image or another volume, optionally over multicast to many machines at once. This is the engine behind restoring a Mac from an image, and it is dramatically faster than a file-by-file copy because it works at the block level.

Installer packages

A macOS .pkg is a signed xar containing a payload (cpio.gz or Apple Archive), a bill of materials, and installer scripts. A product archive (distribution package) wraps one or more component packages with a Distribution XML that drives the installer UI.

pkgbuildBuild a component package from a directory of files or from an installed root, with a component plist controlling relocation and bundle handling. The first half of building an installer.

productbuildBuild a product archive — wrap component packages with a Distribution file, licence, background image, requirement checks and signing. The second half. Also what you use to submit to the Mac App Store.

productsignSign (or re-sign) a finished product archive with a Developer ID Installer certificate. Separated from productbuild so build and signing can happen on different machines.

pkgutilThe inspection tool. --expand/--flatten a package to poke at its scripts; --pkgs lists every package ever installed; --files com.foo.pkg lists what it installed; --forget deletes a receipt; --check-signature verifies who signed it. Reads the receipt database in /var/db/receipts.

installer(In /usr/sbin.) Install a package from the command line: sudo installer -pkg foo.pkg -target /. Non-interactive, scriptable, and the standard MDM deployment path.

productutil(In /usr/libexec.) Low-level product archive utility used by the installer machinery — inspects and manipulates distribution metadata.

dist_package_toolInternal helper for manipulating distribution packages. Undocumented; used by Apple's own build tooling.

installer-core(In /usr/libexec.) The privileged helper that installer and the Installer app hand the actual work to.

Compilers & drivers

There is no GCC on macOS. gcc, g++, cc, llvm-gcc are all clang wearing a hat — gcc --version says so. This trips up autoconf scripts that test for GCC features.

clang · clang++The LLVM C, C++, Objective-C and Objective-C++ compiler. The real one. Apple's build is ahead of upstream in Objective-C/ARC and Swift interop, and behind in some C++ standards support.

cc · c++ · gcc · g++ · llvm-gcc · llvm-g++Six names, one clang. The gcc-named ones exist purely so old Makefiles work.

c89 · c99Standard-conforming compiler drivers that force the corresponding C dialect. Required by POSIX.

cppThe C preprocessor alone. Occasionally used to expand macros in non-C files — assembler, linker scripts, plists.

asThe assembler. On Apple silicon this is clang's integrated assembler; the old standalone as survives only as a driver.

clangdThe language server — code completion, diagnostics and go-to-definition over the Language Server Protocol. What VS Code and Neovim talk to for C/C++/ObjC.

swift · swiftcThe Swift compiler and its REPL/script driver. swift file.swift runs a script; swift build/test/run drive Swift Package Manager; swiftc compiles.

swift-inspectInspect the Swift runtime inside a live process — dump the type metadata, existential layouts and reference counts. A debugging tool for people writing runtime-level Swift.

sourcekit-lspThe Swift language server. The Swift half of what clangd does for C.

gcovCoverage report generator, reading the .gcda/.gcno files a --coverage build emits.

Mach-O binary tools

Mach-O is macOS's executable format, and these are the tools for reading and surgically editing it. Several have no Linux equivalent because they deal with concepts (universal binaries, install names, load commands, platform versions) that ELF doesn't have.

otoolThe essential one. Dump anything about a Mach-O: -L linked libraries and their versions, -l load commands, -h the header, -tV disassembly, -o Objective-C metadata, -D the install name. Being replaced by llvm-otool but not going anywhere.

nmList symbols. -g external only, -u undefined only, -m for Mach-O detail showing which library each undefined symbol comes from.

lipoUniversal binary surgery. -info lists the architectures in a fat binary; -thin arm64 -output … extracts one; -create merges several into a universal binary; -remove drops one. The tool you use to shrink an app by half.

install_name_toolRewrite the dynamic library paths baked into a binary: -id changes a dylib's own install name, -change old new repoints a dependency, -add_rpath/-delete_rpath edit the runtime search path. Essential for bundling third-party dylibs into an app — and it invalidates the code signature, so re-sign afterwards.

stripRemove symbols and debug information. -S keeps global symbols, -x strips local ones. Also breaks the signature.

nmeditChange global symbols to local ones without removing them — hides symbols from the linker while keeping them for the debugger.

ar · ranlibCreate static archive libraries and generate their symbol index. libtool -static is the Apple-preferred front end.

libtoolApple's library builder — not GNU libtool. libtool -static -o lib.a *.o or -dynamic for a dylib. A frequent source of confusion in ported build systems.

ldThe linker. Since Xcode 15 the default is the new "ld_prime"; ld-classic is kept for projects the new one breaks. Mach-O-specific flags to know: -dead_strip, -exported_symbols_list, -rpath, -install_name.

sizePrint the size of each Mach-O segment and section, and the total.

segeditExtract or replace an entire section of a Mach-O file. How you'd swap out an embedded plist or entitlement blob by hand.

vtoolRead and edit the LC_BUILD_VERSION load command — the minimum OS version and SDK a binary declares. Useful when a binary is refused as "too old" and you're certain it isn't.

objdumpThe LLVM disassembler and object inspector. Overlaps otool but with GNU-style syntax and better disassembly.

c++filtDemangle C++ (and Java) symbol names into something a human can read. Pipe compiler or crash output through it.

cmpdylibCompare two dynamic libraries for binary compatibility — does the new one still satisfy everything linked against the old one? A release-engineering gate.

pagestuffReport which Mach-O symbols and sections live on each virtual memory page. Used to optimise launch time by reordering hot code onto fewer pages.

lorderList dependency order among object files, for feeding to tsort so a static archive links in one pass. A 1970s solution still in the toolchain.

ctf_insertInsert Compact C Type Format data into a kernel binary — the type information DTrace needs to make sense of kernel structures.

Debug info, symbols & dyld

dsymutilCollect DWARF debug info scattered across .o files into a standalone .dSYM bundle. This is why release builds can be symbolicated later without shipping debug symbols.

dwarfdumpDump and verify DWARF debug information — compile units, line tables, inlining records. --uuid is the fast way to check whether a dSYM matches a binary.

atosSymbolication. Turn a raw address from a crash log into function (file:line): atos -o Foo.app/Contents/MacOS/Foo -l 0x100000000 0x100003f8c. Also works against a live PID. The single most useful tool for reading a crash report.

symbolsDump symbol and UUID information about a binary or a running process — architecture, load address, dSYM location, code signature identity. Feeds atos.

symbolscacheQuery and modify the system symbol cache that Spotlight-like symbol lookup uses when symbolicating.

dyld_infoShow what the dynamic linker sees: bindings, rebases, exports, the chained-fixup format, dependent libraries, and whether the binary is in the shared cache. The modern successor to several otool flags.

update_dyld_shared_cacheRebuild the enormous pre-linked cache that contains nearly every system library. Almost never run by hand — the system does it during updates — but its existence explains why /usr/lib/libSystem.B.dylib isn't a file on disk.

lldbThe debugger. Attach with lldb -p PID, load a core with -c. SIP prevents attaching to Apple-signed processes, which is the usual cause of "attach failed: not permitted."

Build systems & code generation

make · gnumakeGNU Make 3.81 — frozen, like bash, at the last GPLv2 release. Missing everything added since 2006: != shell assignment, $(file …), .ONESHELL improvements. Both names are the same binary.

bison · yacc · byaccParser generators. yacc here is Berkeley yacc; bison is GNU's, in yacc-compatible mode by default.

flex · lex · flex++Lexical analyser generators. lex is flex in compatibility mode; flex++ emits a C++ scanner class.

m4 · gm4 · bm4The macro processor that autoconf is built on. Three names covering the GNU and BSD variants.

gperfGenerate a perfect hash function for a fixed set of keywords — the trick behind fast keyword lookup in compilers.

migMach Interface Generator. Compiles a .defs file describing a Mach IPC interface into client and server stubs. This is how the kernel and userspace daemons define their message protocols; every Mach subsystem in macOS has a MIG definition behind it.

rpcgenThe Sun RPC protocol compiler — generates C stubs from an .x interface definition. Used by NFS and the surviving ONC RPC services.

gen_bridge_metadataGenerate the BridgeSupport XML that lets scripting languages (Ruby, Python via PyObjC) call C functions and use C constants from a framework. The metadata that makes dynamic-language Cocoa bindings possible.

ctagsBuild a tags index of source symbols for editor jump-to-definition. BSD ctags — less capable than Exuberant/Universal ctags.

indentReformat C source to a chosen style. The BSD ancestor of clang-format.

unifdef · unifdefallRemove #ifdef blocks for a given set of defined/undefined macros, leaving readable code. Invaluable for understanding heavily-conditional C.

git · git-shell · git-receive-pack · git-upload-pack · git-upload-archiveGit, plus its server-side helpers. Apple's build is a real git — but it is a shim that requires the Command Line Tools, and it is usually a year or more behind.

Xcode from the command line

xcrunThe dispatcher. Finds and runs a tool inside the active developer directory for a given SDK: xcrun --sdk iphoneos --find clang, xcrun simctl list. Every stub in this section is ultimately xcrun. --show-sdk-path and --sdk macosx --show-sdk-version are the two flags you'll actually type.

xcode-selectChoose which Xcode (or Command Line Tools) is active: xcode-select -p prints it, -s /Applications/Xcode.app switches, --install triggers the CLT download. Setting DEVELOPER_DIR overrides it per-invocation.

xcodebuildBuild, test, archive and export Xcode projects and workspaces without the IDE. The CI workhorse: xcodebuild -scheme Foo -destination 'platform=iOS Simulator,name=iPhone 17' test. -list shows a project's schemes and targets.

agvtoolApple-generic versioning — bump CFBundleVersion and marketing version across an Xcode project consistently. agvtool next-version -all.

actoolThe asset catalog compiler. Turns an .xcassets directory into the runtime Assets.car, choosing which image variants to include per target device.

assetutilInspect a compiled Assets.car: assetutil --info Assets.car lists every image, its scale, gamut and idiom. The only way to see inside a shipped asset catalog.

ibtoolCompile, inspect and update Interface Builder documents (.xib, .storyboard). Also extracts and re-imports localizable strings from them.

ictoolRelated Interface Builder tooling for the compiled representation.

genstringsScan source for NSLocalizedString calls and emit a .strings file. The starting point of localisation.

xctraceDrive Instruments from the command line: xctrace record --template 'Time Profiler' --launch -- ./myapp. Also imports, exports and symbolicates .trace files. Replaced the old instruments command.

xcdebug · xcscontrol · xcsdiagnoseXcode debugging helper, and the control and diagnostics tools for Xcode Server (Apple's discontinued CI product). Vestigial.

devicectlThe modern replacement for ios-deploy and friends: list connected and paired devices, install and launch apps, capture logs and crash reports, and manage device state — all over the CoreDevice framework.

Scripting bridges & documentation

sdefExtract a scripting definition (.sdef) from an application — the machine-readable description of everything it exposes to AppleScript. sdef /Applications/Safari.app tells you exactly what you can automate.

sdpThe .sdef processor: turn a scripting definition into Objective-C or Swift header files so you can drive an app from compiled code rather than AppleScript.

desdpThe reverse — generate a scripting definition from source. Rarely used.

gatherheaderdoc · headerdoc2htmlHeaderDoc, Apple's pre-Doxygen documentation generator. Reads specially-formatted comments in headers and produces HTML; gatherheaderdoc assembles a master index across many outputs. Superseded by DocC but still shipped and still functional.

hdxml2manxml · xml2manConvert HeaderDoc XML into man-page XML, then into an actual mdoc man page. Apple's pipeline for generating the man pages you're reading.

resolveLinksResolve cross-references between HTML files in a HeaderDoc output tree.

RezCompile a .r resource description into a classic Mac resource fork. Deprecated; needed only for maintaining pre-OS-X code.

DeRezDecompile a resource fork back into .r source. Occasionally the only way to read an old file's structure.

ResMergerMerge several resource files into one. The third leg of the Carbon resource toolchain.

tiff2icns · iconutilConvert a TIFF to a classic .icns icon; and convert between an .iconset folder of PNGs and a compiled .icns. iconutil -c icns MyIcon.iconset is how you build an app icon.

Profiling & sampling

sampleStart here. Profile a running process for N seconds by periodically capturing its call stacks, then print an aggregated call tree: sample Safari 10 -f out.txt. Needs no instrumentation, no recompile, works on any process you own. The fastest way to answer "why is this beachballing?"

spindumpThe same idea applied to the entire system at once — every process, every thread, with kernel stacks and the process hierarchy. This is what macOS runs automatically when an app stops responding, and what produces the "spin report" you're asked to attach to bug reports. sudo spindump -notarget 5 profiles everything for five seconds.

filtercalltreePost-process the call tree that sample or malloc_history produced: prune branches below a threshold, invert it, or filter to a library. Turns a 40,000-line dump into something readable.

powermetricsApple silicon's best-kept secret. Real-time per-core CPU residency and frequency, GPU and Neural Engine utilisation, package power in milliwatts, thermal pressure, per-process energy impact, disk and network activity. sudo powermetrics --samplers cpu_power,gpu_power -i 1000. Nothing else exposes E-core/P-core cluster behaviour like this.

topThe macOS top is heavily extended: -o cpu or -o mem to sort, -stats to choose columns, and Mach-aware fields — ports, mregions, purgeable memory, compressed memory, and per-process power score.

taskinfoDump the kernel's policy view of a process: QoS class, scheduling role, I/O tier, App Nap and jetsam state, coalition membership. Explains why a process is being throttled.

latencyMonitor scheduling and interrupt latency system-wide — how long threads wait between becoming runnable and actually running. The tool for diagnosing audio dropouts and stutter.

timerfiresTrace every kernel timer as it fires, with the process responsible. Excellent for finding the background app that wakes the CPU 200 times a second and ruins battery life.

timer_analyser.dThe DTrace-based companion that aggregates timer behaviour over an interval.

Memory analysis

All of these need to read another process's memory, so SIP will refuse on Apple-signed binaries and you'll usually need sudo plus the target being your own, non-hardened build.

leaksScan a process's heap for malloc buffers that nothing points to any more — genuine leaks, with the allocation backtrace if MallocStackLogging was on. leaks --atExit -- ./myapp runs a program and reports at exit.

heapSummarise every malloc block in a process, grouped by class name and size. Tells you that you have 40,000 NSStrings when you expected 40. heap -sortBySize.

malloc_historyGiven an address, print the backtrace that allocated it — and, with -allEvents, the whole allocation/free history. Requires MallocStackLogging=1 in the environment. This is how you find who allocated the block that leaks just reported.

vmmapDump a process's entire virtual address space: every region, its size, protection, and what it is — stack, heap, mapped file, shared cache, Metal buffer, JIT region. vmmap --summary gives the one-page version. The tool for understanding real memory footprint.

footprintReport a process's memory footprint the way the OS accounts for it — the "dirty memory" number that jetsam actually uses to decide who dies. Different from, and more meaningful than, RSS.

memory_pressureQuery the system's memory pressure state, or simulate it: memory_pressure -l critical makes the system behave as if memory is exhausted, so you can test that your app responds to the warnings. Also -S to allocate real memory.

vm_statMach virtual memory statistics — page-ins, page-outs, compressions, decompressions, swap usage, purgeable pages. The macOS answer to vmstat; multiply by 4096 to get bytes.

zprintPrint kernel zone allocator statistics — every kernel object type, how many are allocated, and how much memory each zone holds. The tool for diagnosing a kernel memory leak.

gcoreWrite a core dump of a running process without killing it, for later analysis in lldb. Needs SIP considerations and entitlements on modern macOS.

ReportMemoryException(In /usr/libexec.) Generates the memory diagnostic report that appears when a process is killed for exceeding its memory limit.

System call & I/O tracing

fs_usageThe strace of macOS, sort of. Live report of every filesystem operation and page fault system-wide or per process: sudo fs_usage -w -f filesys Finder. Filters by mode (filesys, network, exec, pathname). The fastest way to discover which file a program is actually reading — including the config file it never documented.

sc_usageLive per-process system call counts and timings in a curses display, updated continuously. Shows where a process's syscall time is going without the firehose of fs_usage.

dtrussA DTrace script that mimics Solaris truss / Linux strace: print every system call with arguments and return values. sudo dtruss -f -p PID. Hobbled by SIP on system binaries — see the note below.

ktraceThe modern, low-overhead kernel tracing front end (the successor to the old BSD ktrace and to trace). Records into a ktrace file: sudo ktrace trace -S. Underpins Instruments' System Trace.

traceThe older kernel-trace record/inspect tool. Still present, largely superseded by ktrace.

tailspinCapture a rolling window of system activity — the kernel keeps a continuous trace buffer, and tailspin save dumps the last few seconds. Designed for catching intermittent hangs after they've already happened.

dyld_usageReport dynamic linker activity in real time — every dylib loaded, every symbol bound, with timings. The tool for diagnosing slow app launch.

esloggerStream Endpoint Security events as JSON: process execs, forks, file opens, mounts, signals, XProtect events. Effectively a built-in EDR sensor you can run from a terminal — sudo eslogger exec is a superb way to see what the system is quietly launching.

imptraceTrace importance-donation events — when one process boosts another's priority over XPC. Explains mysterious priority inversions in the daemon graph.

lsmpList Mach ports for a process: every port right it holds, what it's connected to, and the send/receive counts. Since all macOS IPC is Mach ports underneath, this is how you see who is talking to whom.

lskqDump a process's kqueue state — every registered event filter, what it watches, and whether it's pending. Diagnoses event-loop bugs invisible from anywhere else.

lsof(In /usr/sbin.) List open files — sockets, regular files, pipes — per process. lsof -i :443 for network, lsof +D /Volumes/Foo for what's blocking an unmount.

fixprocApply a corrective action to a wedged process — Apple's internal "unstick it" tool. Undocumented actions; used by automated test infrastructure.

DTrace

3 + 40 scripts

Read this first: SIP blocks DTrace from instrumenting any Apple-signed binary, and restricts kernel probes. On a stock Mac these scripts work on your own unsigned or ad-hoc-signed programs and give partial system-wide data. Full functionality needs csrutil enable --without dtrace from Recovery.

dtraceThe tracing compiler and engine itself — D-language scripts, providers (syscall, proc, io, pid, fbt, profile), aggregations. sudo dtrace -n 'syscall:::entry { @[execname] = count(); }' is a whole system profile in one line.

plockstatStatistics on pthread mutex and rwlock contention in a process — who blocks, for how long, and on which lock. Built on DTrace.

lockstatThe kernel counterpart: kernel lock contention and profiling statistics.

DTraceToolkit — processes

execsnoopPrint every process as it is executed, with its full command line. Superb for seeing what a script or installer actually runs.

newproc.dThe same idea, more compact — snoop new processes.

pidpersec.dCount new PIDs created per second. Detects fork bombs and pathological shell loops.

kill.dSnoop signals as they are sent — who signalled whom, with which signal. Answers "what keeps killing my daemon?"

sigdist.dSignal distribution by sending and receiving process.

setuids.dSnoop every setuid call. A privilege-escalation audit in one command.

lastwordsPrint the last system calls a process made before it exited. Forensics for a program that dies silently.

errinfoPrint the errno for every failing system call, with the call and its arguments. The single most useful debugging script here — "it fails and tells me nothing" becomes "ENOENT on this path."

sampleprocSample which processes are on-CPU, DTrace-style. A poor man's profiler across the whole system.

dappprof · dapptraceProfile and trace user-level function calls in a program — every function entry and exit with timing, without a recompile.

procsystimeBreak down where a process's system-call time is going, by call.

DTraceToolkit — syscalls & CPU

topsyscall · topsysprocA top-like live view of the busiest system calls, and of the processes making the most calls.

syscallbypid.d · syscallbyproc.d · syscallbysysc.dAggregate syscall counts three ways: by PID, by process name, by syscall.

cpuwalk.dMeasure which physical CPUs a process actually runs on — on Apple silicon this reveals E-core versus P-core scheduling.

cpu_profiler.dSample kernel and user stacks at a fixed rate for a CPU profile.

dispqlen.dDispatcher run-queue length per CPU — how many threads are waiting to run. Sustained non-zero means you're CPU-bound.

loads.dPrint the load averages via DTrace.

priclass.d · pridist.dThread priority distribution, by scheduling class and by process.

hotspot.dShow which regions of a disk are being hit hardest, by block location.

DTraceToolkit — files & I/O

opensnoopSnoop every open() as it happens, with path, process and result. The DTrace equivalent of the fs_usage trick, and easier to read.

filebyproc.d · pathopens.d · creatbyproc.dOpens grouped by process; full pathnames successfully opened with counts; and file creations by process.

iosnoop · iotopSnoop individual disk I/O events as they occur; and a top-style live ranking of processes by disk I/O.

iopatternCharacterise the I/O workload — percentage random versus sequential, average size, throughput.

iopendingPlot the number of I/O requests outstanding over time. Queue depth, visualised in ASCII.

iofile.d · iofileb.dI/O wait time per file per process; and bytes transferred per file per process.

bitesize.dHistogram of I/O request sizes per process. Finds the process doing a million 512-byte writes.

seeksize.dHistogram of seek distances between consecutive I/Os — meaningful on spinning disks, mostly historical on SSDs.

rwsnoop · rwbypid.d · rwbytype.dSnoop read/write events; count them per PID; and break bytes down by vnode type (file, socket, pipe, tty).

fddistDistribution of file descriptor numbers in use — reveals descriptor leaks.

Logging

macOS replaced syslog with the unified logging system in 10.12. Logs are a compressed binary store in /var/db/diagnostics, not text files, and most messages are <private>-redacted unless you install a configuration profile.

logThe unified logging client, and one of the most useful commands on macOS. log stream --predicate 'process == "bird"' --level debug follows live; log show --last 1h --predicate '…' queries history; log collect packages the store into a .logarchive for someone else to analyse; log config --mode 'level:debug' --subsystem com.apple.foo turns up verbosity for one subsystem. Predicates use NSPredicate syntax over process, subsystem, category, eventMessage, senderImagePath.

syslogThe legacy Apple System Log client. Still reads the old ASL store and can send messages, but almost nothing writes there now. Kept for compatibility.

loggerWrite a message into the system log from a script. On modern macOS it lands in the unified log.

notifyutilPost, watch and query Darwin notifications — the lightweight system-wide pub/sub bus that daemons use to signal state changes. notifyutil -w com.apple.system.timezone waits for a timezone change. A remarkable amount of macOS coordination happens over this.

signpost_reporter(In /usr/libexec.) Reports telemetry on intervals instrumented with os_signpost — the API that feeds Instruments' custom intervals.

aslmanager(In /usr/sbin.) Manages the life cycle of the old ASL data store — rotation, aging out and deletion.

Diagnostic collectors

Every macOS subsystem has a one-shot tool that gathers its logs, state and configuration into a tarball for a bug report. They all take minutes, produce tens of megabytes, and are the correct first response to "file a radar with diagnostics attached."

sysdiagnoseThe big one. Collects everything: a system-wide spindump, the unified log archive, all crash reports, network and power state, installed profiles, kernel state, and about a hundred other things. Triggered from the terminal or by pressing ⌃⌥⇧⌘. Output lands in /var/tmp. Expect 200–500 MB.

mddiagnoseSpotlight: index state, importer activity, the store's health.

searchdiagnoseSearch more broadly — Spotlight plus the Siri/Suggestions search stack.

tmdiagnoseTime Machine: backup history, snapshot state, exclusions, destination health.

smbdiagnoseSMB file sharing, client and server side.

usbdiagnoseThe USB stack: device tree, descriptors, power negotiation, driver matching.

tbtdiagnoseThunderbolt topology, link state and firmware.

hpmdiagnoseUSB-C power delivery — the "HPM" is the USB-C port controller. For diagnosing a cable or dock that won't charge.

dddiagnoseData Detectors — the subsystem that finds dates and addresses in text.

csfdiagnoseCore Services / file coordination diagnostics.

avbdiagnoseAudio Video Bridging — deterministic low-latency audio over Ethernet.

uasysdiagnoseUserActivity framework — Handoff and Continuity state.

corebrightnessdiagDisplay brightness, Night Shift, True Tone and ambient light sensor state.

transparency-sysdiagnose · swtransparency-sysdiagnoseKey Transparency (for iMessage identity verification) and Software Transparency (the signed log of what Apple ships) diagnostics.

security-sysdiagnose(In /usr/libexec.) Keychain and trust-evaluation state.

viewdiagnosticRender a collected diagnostic report into something readable.

dmcControl the Disk Mount Conditioner — artificially degrade a volume's throughput and latency to simulate a slow disk or a network drive. The storage analogue of the Network Link Conditioner.

Code signing

codesignThe central tool. Sign a binary or bundle, and — far more often — inspect one. codesign -dvvv /Applications/Foo.app prints the identifier, team ID, signing authority chain and flags; add --entitlements - to dump the entitlements plist, which is the definitive statement of what a program is permitted to do. -v --deep --strict verifies. -f -s "Developer ID Application: …" --options runtime signs with the hardened runtime. Any edit to a signed binary (install_name_tool, strip) invalidates the signature and requires re-signing.

codesign_allocateMake room in a Mach-O for the signature blob. codesign calls it for you; you'd only invoke it directly inside a custom signing pipeline.

csreqCompile and decompile code signing requirements — the little expression language (anchor apple generic and identifier "com.foo") that says which signatures satisfy a check. csreq -r- -t to read one back as text. These strings appear throughout TCC, keychain ACLs and launchd plists.

derqQuery and manipulate DER-encoded entitlements — the newer binary entitlement format used on Apple silicon, replacing the XML plist for launch-critical checks.

trustcachectlLoad trust caches and ask whether a given code-directory hash is present in one. A trust cache is a signed list of binary hashes the kernel will execute without a full signature check — it's how the boot chain and internal tooling are authorised.

klist_cdhashes(In /usr/sbin.) Report the code-directory hashes of kexts that have been approved through Secure Kernel Extension Loading.

amfid(In /usr/libexec.) Apple Mobile File Integrity daemon — the userspace half of code signature validation. When the kernel meets a binary it can't validate alone, it asks amfid. Every launch on the system passes through it.

Gatekeeper, notarization & XProtect

spctl(In /usr/sbin.) The Gatekeeper control tool. spctl -a -vvv /Applications/Foo.app asks the system assessment engine whether it would allow this app to run and why not. --status, and historically --master-disable (which recent macOS has removed from the CLI — the toggle now requires the GUI).

gktoolThe newer Gatekeeper utility. gktool scan pre-scans an app so first launch isn't delayed by notarization verification — the fix for "opening a freshly-downloaded app takes 30 seconds."

staplerAttach a notarization ticket to an app, dmg or pkg, so Gatekeeper can verify it offline. stapler staple Foo.app, stapler validate. The last step of a release build.

syspolicy_checkCheck whether an app is actually ready for notarization or distribution before you submit it: syspolicy_check notary-submission Foo.app. Catches unsigned nested binaries and missing hardened runtime.

xprotectInteract with XProtect, Apple's built-in malware scanner: check its version, force an update, run a scan. XProtect signatures update out-of-band from macOS itself.

xprotectd(In /usr/libexec.) The daemon that performs XProtect scans and remediation.

notarytool(In Xcode's usr/bin.) Submit a build to Apple's notary service, poll for the result, and fetch the log. Replaced altool's notarization mode.

System policy & boot security

csrutilConfigure System Integrity Protection. csrutil status works anywhere; enable/disable only from Recovery. Fine-grained forms exist — csrutil enable --without dtrace keeps most protection while allowing full tracing, which is the setting serious performance work wants.

bputilBoot policy on Apple silicon. Sets a volume's security level: Full, Reduced (allows kexts and unsigned kernels), or Permissive. Must run from Recovery with an admin credential. This is what "Reduced Security" in Startup Security Utility does, with far more precision — including per-volume policy and the ability to allow user-managed kernel extensions or disable SSV authentication.

psmCommand-line interface to the Apple silicon password slot manager — the Secure Enclave's store of credentials used for FileVault and boot-time authentication.

firmwarepasswd(In /usr/sbin.) Set, change or remove the firmware password on Intel Macs. Meaningless on Apple silicon, where boot security works entirely differently.

system-override(In /usr/sbin.) Configure system overrides — a small set of boot-time behaviour switches, including disabling the library validation and SSV checks that certain enterprise setups need.

DevToolsSecurity(In /usr/sbin.) Enable the developer authorisation group so that debugging tools can attach without an admin prompt every time. sudo DevToolsSecurity -enable — run once per machine.

automationmodetoolManage UI-automation security preferences — whether the machine permits unattended automation of the UI, which is otherwise gated behind explicit consent.

Keychain, certificates & trust

securityThe keychain and Security.framework CLI, and it does far more than people realise. find-generic-password -s foo -w prints a stored password; add-generic-password stores one; find-certificate -a -p exports certificates as PEM; import/export move identities; cms -D decodes signed messages; unlock-keychain, set-keychain-settings, list-keychains, dump-trust-settings, verify-cert, authorizationdb read. It has about 80 subcommands and a man page that undersells all of them.

certtoolCreate, import and inspect certificates and keys directly in a keychain, including generating a CSR. Older than the corresponding security subcommands but sometimes more direct.

crlrefreshUpdate and maintain the system-wide certificate revocation list cache.

ocspcheckQuery an OCSP responder to check whether a certificate has been revoked. From LibreSSL.

ocspd(In /usr/sbin.) The daemon that performs OCSP and CRL fetching on behalf of every trust evaluation on the system, with caching.

trustd(In /usr/libexec.) Performs every certificate trust evaluation on the machine — TLS connections, code signatures, S/MIME. If a site's certificate is rejected, trustd decided that.

otctlOctagon — the trust circle behind iCloud Keychain syncing. otctl status dumps whether this device is in the circle, its peer list and sync state. The tool for diagnosing "my passwords aren't syncing."

ckksctl(In /usr/sbin.) CloudKit Keychain Sync diagnostics — the other half of the iCloud Keychain machinery, showing per-zone sync state.

keychain-accessA small helper for querying keychain access from the command line, used by system components.

systemkeychain(In /usr/sbin.) Create system keychains and set up one keychain to automatically unlock another — the mechanism behind unattended server keychain unlock.

opensslLibreSSL, not OpenSSL — Apple switched, and the command-line surface differs in places. Still your general-purpose tool for s_client, x509, genrsa, dgst and format conversion.

Privacy, sandbox & disk encryption

tccutilManage the TCC (Transparency, Consent and Control) privacy database — the one that governs camera, microphone, screen recording, full disk access and automation permissions. The public surface is deliberately tiny: tccutil reset All com.foo.bar forgets an app's grants so the prompts appear again. Direct edits to the TCC database are blocked by SIP.

sandbox-execRun a command inside a sandbox described by a Scheme-like profile. Marked deprecated for a decade and still the only general-purpose way to sandbox an arbitrary command line: sandbox-exec -p '(version 1)(deny default)(allow file-read*)' cmd. Profiles for the system's own daemons live in /System/Library/Sandbox/Profiles and are worth reading.

authopenOpen a file with authorization — prompts for admin credentials, then hands the opened descriptor back. Lets an unprivileged program read a protected file without being setuid.

fdesetupFileVault from the command line. status, enable, disable, list enabled users, changerecovery, and — importantly for fleets — authrestart, which reboots an encrypted Mac and unlocks it once automatically so it can come back up unattended.

bioutilView and change biometrics configuration: whether Touch ID is enabled for unlock, Apple Pay and password autofill, and how many fingerprints are enrolled. Can also delete templates.

sfltoolInspect and debug SharedFileList — the databases behind Login Items, recent documents, favourite servers and Finder sidebar entries. sfltool dumpbtm dumps the Background Task Management store, which is how you enumerate everything that has registered to launch at login.

app-ssoControl and inspect the Kerberos SSO extension — the enterprise single-sign-on mechanism that acquires tickets on behalf of apps. app-sso -l lists configured extensions.

pcsctestTest the PC/SC smart card stack — enumerate readers and cards. Paired with the drivers in /usr/libexec/SmartCardServices.

sc_auth(In /usr/sbin.) Configure smart card authentication — pair a card to an account, list paired identities, enforce card-only login.

pwpolicy(In /usr/sbin.) Get and set password policies — length, complexity, expiry, history — at the global, user or directory-node level.

pcsstatusPrint the current status of PCS (Protected Cloud Storage) credentials — the keys protecting end-to-end encrypted iCloud data classes.

Auditing

macOS includes the BSM (Basic Security Module) audit subsystem, an old Solaris-derived kernel audit trail. It is disabled by default; the modern equivalent is Endpoint Security (eslogger).

audit(In /usr/sbin.) Control the audit system — start, stop, rotate the trail, and reload the configuration.

auditd(In /usr/sbin.) The daemon that writes the audit trail to /var/audit.

auditreduce(In /usr/sbin.) Select records from an audit trail by time, user, event class or object. The filter you run before praudit.

praudit(In /usr/sbin.) Print binary audit records as text or XML.

accton(In /usr/sbin.) Turn classic BSD process accounting on or off. Feeds lastcomm and sa.

sa · ac(In /usr/sbin.) Summarise process accounting statistics; and report per-user connect time. Both from the era of billing users for CPU seconds.

Preferences & property lists

macOS configuration is plists, and plists are usually binary. Editing one in a text editor corrupts it — use these.

defaultsThe famous one. Read and write the user defaults database — every "secret Mac tip" blog post is a defaults write. defaults read com.apple.dock, defaults write com.apple.finder AppleShowAllFiles -bool true, defaults domains to list everything, defaults find keyword to search. Two things to know: values are cached by cfprefsd, so the owning app must be restarted (killall Dock) to notice; and writing directly to the plist file instead of using defaults is how you lose your change.

plutilThe property list utility. -p pretty-prints any plist in a readable form; -convert xml1/binary1/json transcodes; -lint validates; and -extract path.to.key raw pulls out a single value for a script. The correct way to read a plist you didn't write.

PlistBuddy(In /usr/libexec.) Read and write arbitrary plist structures with a path syntax: PlistBuddy -c "Set :CFBundleVersion 2.0" Info.plist, -c "Add :Foo:Bar array". Where plutil reads, PlistBuddy edits — including creating nested dictionaries. Not on your PATH; everyone symlinks it.

plConvert between the old ASCII/NeXT property list format and modern plists. Occasionally needed for ancient config files.

cfprefsd(In /usr/sbin.) The preferences daemon that owns every plist read and write on the system, caching aggressively. Its existence is why direct file edits are unreliable.

Desktop & user interface

openThe bridge from terminal to GUI. open . reveals the current directory in the Finder; open -a Safari file.html picks an app; open -R file reveals rather than opens; open -e opens in TextEdit; open -n forces a new instance; open -g keeps it in the background; and open x-apple-systemsettings: or any URL scheme launches the handler. Also open --env FOO=bar -a App to pass environment into a GUI app.

pbcopy · pbpasteRead and write the system clipboard. cat file | pbcopy, pbpaste > file. -Prefer txt|rtf|ps chooses the flavour when the pasteboard holds several.

screencaptureTake a screenshot. -x silences the shutter, -R x,y,w,h captures a rectangle, -l windowid a specific window, -i is interactive, -c puts it on the clipboard, -V 10 records ten seconds of video, -T 5 adds a delay. Requires Screen Recording permission.

osascriptRun AppleScript — or JavaScript for Automation — from the shell. osascript -e 'tell app "Finder" to activate', osascript -l JavaScript -e '…'. Also the standard way to show a native dialog or notification from a script: osascript -e 'display notification "done"'.

osacompile · osadecompileCompile a script into a .scpt or a runnable .app; and decompile one back to source. osacompile -o Foo.app script.applescript turns three lines of AppleScript into a double-clickable application.

osalangList the installed Open Scripting Architecture languages — normally AppleScript, JavaScript and Generic Scripting System.

automatorRun an Automator workflow from the command line, optionally with input. Lets a .workflow be used as a shell command.

shortcutsRun and manage Shortcuts: shortcuts list, shortcuts run "My Shortcut" -i input.txt. The modern successor to Automator, and the only scripting surface for a lot of newer system functionality.

sayText to speech. say -v '?' lists voices, -o out.aiff writes to a file, -f file.txt reads a file, --interactive highlights words as spoken. Genuinely useful as a long-build notifier: make && say done.

qlmanageThe Quick Look debugging tool. qlmanage -p file shows the preview panel; -t -s 512 -o dir file generates a thumbnail image; -m lists registered generators; -r resets the Quick Look cache when previews go stale.

lsappinfoQuery Launch Services about running applications: lsappinfo list dumps every app with its state, PID, bundle ID, activation policy and front-most status. lsappinfo front names the frontmost app — useful in scripts that need to know what has focus.

trashMove files to the Trash instead of deleting them, honouring the per-volume .Trashes layout and Finder's undo. A recent addition, and the safe alternative to rm.

textutilConvert between every text format Cocoa understands — txt, rtf, rtfd, html, doc, docx, odt, webarchive. textutil -convert txt file.docx extracts plain text from a Word document with no Word installed.

Spotlight & metadata

mdfindQuery the Spotlight index from the command line — instantly, across the whole disk. mdfind "kMDItemContentType == 'public.png'", mdfind -onlyin ~/Documents budget, -name foo for filename search, -live to keep updating. Far faster than find, and it searches file contents.

mdlsList every metadata attribute Spotlight holds for a file — dimensions, duration, author, where it was downloaded from, EXIF, page count. mdls file is the fastest way to see what an unknown file actually is.

mdimportForce a file or tree to be re-imported into the index. -L lists the installed importer plugins, -d2 shows what an importer extracts — the debugging tool if you're writing one.

mdutilManage the indexes themselves: mdutil -s / reports status, -i off disables indexing on a volume, -E erases and rebuilds the index — the standard fix for a Spotlight that has stopped finding things.

hiutilCreate and inspect Help Viewer indices — the search index inside an application's help book.

lsmLatent Semantic Mapping — Apple's built-in text classifier. Train a map from categories of sample text, then classify new text against it. A complete, undocumented little machine-learning tool that has shipped since 10.5 and is what Mail's junk filter was built on.

mds · mdworkerThe daemon side, which lives outside any bin directory — in Metadata.framework/Versions/A/Support. mds is the metadata server, mds_stores holds the indexes, and a pool of sandboxed mdworker processes runs the importer plugins so a malformed file can only crash a worker. See also spotlightknowledged.* in /usr/libexec, which build the newer knowledge graph behind Siri Suggestions.

Power, thermals & sleep

pmsetAll power management. pmset -g shows current settings, -g assertions reveals exactly which process is preventing sleep (the answer to "why won't my Mac sleep?"), -g log gives a full sleep/wake history, -g batt the battery state. Setting: sudo pmset -a displaysleep 10 sleep 30, sudo pmset -a powernap 0, and repeat wakeorpoweron MTWRF 08:00:00 to schedule a wake.

caffeinatePrevent sleep for the duration of a command or a timeout. caffeinate -dimsu -t 3600 (display, idle, system, user-active for an hour), or caffeinate -i make to keep the machine awake only until the build finishes. Creates a real power assertion, visible in pmset -g assertions.

thermalQuery and simulate thermal pressure. Lets you test how your app behaves when the system is throttling without needing to actually cook the machine.

power_report.shA shipped shell script that assembles a power-usage report from powermetrics and system state. Read it — it's a good worked example of the tooling.

systemstats(In /usr/sbin.) Summarise long-run system statistics — CPU, disk, network and energy use aggregated over days, from the database that Battery Usage in System Settings displays.

cpuctl(In /usr/sbin.) Enable and disable individual CPUs. On Apple silicon this can take entire efficiency or performance clusters offline — useful for reproducing single-core behaviour or testing under constrained hardware.

taskpolicy(In /usr/sbin.) Launch a program with, or change a running process to, a different I/O tier, latency QoS or background policy. taskpolicy -b cmd runs something as a true background task — throttled I/O, efficiency cores, no App Nap exemption.

Kernel & system extensions

The story here is a migration: kexts (kernel extensions, running in the kernel) are being replaced by system extensions and DriverKit drivers, which run in userspace. Both toolchains ship.

kmutilThe modern kext tool. kmutil showloaded lists what's in the kernel; inspect examines a collection; create builds a boot or auxiliary kernel collection; load/unload; trigger-panic-medic for a machine that won't boot because of a kext. On Apple silicon, kexts are baked into an auxiliary kernel collection at install time and require a reboot, which is why kextload feels broken.

kextstat(In /usr/sbin.) List loaded kernel extensions with their load addresses, sizes, dependencies and reference counts. kextstat | grep -v com.apple is the one-liner for "what third-party code is in my kernel?"

kextutilLoad a kext with full diagnostics — dependency resolution, validation, authentication, symbol generation for kernel debugging. Where kextload says "failed", kextutil says why.

kextcache(In /usr/sbin.) Build the prelinked kernel and kext caches. Largely superseded by kmutil create.

kextfind(In /usr/sbin.) Search the kext repositories by an expressive set of criteria — bundle ID, dependency, architecture, whether it's signed, whether it's loadable — and print chosen properties.

kextlibs(In /usr/sbin.) Work out which OSBundleLibraries declarations a kext needs, by examining its undefined symbols. A kext-development tool.

mkextunpack(In /usr/sbin.) Extract the contents of an old multi-kext (mkext) archive.

systemextensionsctlManage system extensions — the userspace successors to kexts, used for network filters, endpoint security agents and DriverKit drivers. list shows what's installed and its activation state; developer on relaxes the rules so you can test an unsigned one; reset removes them all.

kcditto(In /usr/sbin.) Copy kernel collections into the preboot volume so the machine can actually boot with them. Part of the Apple silicon boot dance.

nvram(In /usr/sbin.) Read and write firmware NVRAM variables. nvram -p dumps everything; boot-args is the famous one (SIP restricts it); nvram -c clears. Holds boot policy, verbose-boot flags, panic logs and the startup disk selection.

ioreg(In /usr/sbin.) Dump the IORegistry — the live tree of every device, driver and hardware property in the system. ioreg -l -w0 for everything, -c AppleSmartBattery for battery internals, -p IOUSB for the USB tree. The definitive source for hardware detail that system_profiler summarises.

ioalloccount · ioclasscount(In /usr/sbin.) Summarise IOKit memory allocation, and count instances of each IOKit class. Used to find driver leaks.

Machine identity & inventory

sw_versPrint the macOS product name, version and build. sw_vers -productVersion is the canonical version check in scripts.

unameKernel name, release and machine. uname -m gives arm64 or x86_64 — but note that under Rosetta it reports x86_64, which is often the point.

archPrint the architecture, or run a program under a specific one: arch -x86_64 zsh starts a Rosetta shell on Apple silicon, arch -arm64 cmd forces native. Essential when a universal binary needs to be pinned.

machinePrint the machine's hardware class. Older and coarser than uname -m.

hostinfo(In /usr/sbin.) Mach-level host information: kernel version, number of physical and logical processors, memory size, load averages. Predates sysctl and still reports things sysctl doesn't format as nicely.

system_profiler(In /usr/sbin.) The command-line System Information app. system_profiler -listDataTypes shows the fifty-odd sections; system_profiler SPHardwareDataType SPStorageDataType gets just what you want; -json or -xml for machine-readable output. The standard way to inventory a fleet.

sysctl(In /usr/sbin.) Get and set kernel state. macOS-specific keys worth knowing: hw.memsize, hw.ncpu, hw.perflevel0.logicalcpu (P-cores) and hw.perflevel1.logicalcpu (E-cores), machdep.cpu.brand_string, kern.osproductversion, sysctl.proc_translated (am I under Rosetta?).

uptimeHow long the system has been up, plus load averages.

purge(In /usr/sbin.) Force the disk cache to be flushed and emptied. Used before benchmarking to get cold-cache numbers.

Software update, MDM & backup

softwareupdate(In /usr/sbin.) macOS updates from the terminal. -l lists available, -i -a installs everything, --fetch-full-installer --full-installer-version 15.0 downloads a complete installer app, --list-full-installers shows what's available, --background triggers the normal background download. Also --install-rosetta --agree-to-license.

profilesManage configuration profiles — the .mobileconfig payloads that MDM uses to set policy. profiles show lists what's installed, -P for detail, install -path foo.mobileconfig, renew -type enrollment. Also reports whether the Mac is supervised or DEP-enrolled.

mdmclientThe Mobile Device Management client itself. Undocumented but talkative: mdmclient QueryInstalledProfiles, dumpSMBIOS, and a long list of verbs used for debugging enrolment.

tmutilTime Machine control. startbackup --block, latestbackup, listbackups, compare two snapshots, localsnapshot to make an APFS snapshot immediately, listlocalsnapshots /, deletelocalsnapshots, addexclusion -p path, and destinationinfo. Also the only way to restore a specific path non-interactively: tmutil restore.

AssetCacheManagerUtil(In /usr/sbin.) Control the Content Caching service — the local cache of Apple software updates and App Store content that a Mac can serve to its whole network. status, flushCache, reloadSettings.

AssetCacheLocatorUtil(In /usr/sbin.) Discover which content caches this Mac can see and would use, with diagnostics for why one was rejected.

AssetCacheTetheratorUtil(In /usr/sbin.) Manage tethered caching — serving cached content to iOS devices over USB.

swcutilManage shared web credentials and universal links: swcutil dl -d example.com fetches and validates a site's apple-app-site-association file. The tool for debugging why a universal link isn't opening your app.

brctlControl and inspect CloudDocs — the iCloud Drive daemon (bird). brctl status, brctl log --wait --shorten to watch sync live, brctl download path to force a file out of the cloud. Indispensable when iCloud Drive stalls.

fileproviderctlThe modern equivalent for File Provider extensions — Dropbox, OneDrive, Google Drive and iCloud all present themselves through this framework now. fileproviderctl dump shows the domain state; materialize forces a download.

pluginkitManage app extensions — share sheets, Finder sync, widgets, Quick Look generators, Safari extensions. pluginkit -mAvvv lists every registered extension on the system; -e use/ignore -i bundleid enables or disables one. The tool for finding the extension that's misbehaving.

umtoolDiagnostics for UserManagement — Screen Time, parental controls and managed-user policy.

mcxquery · mcxrefreshQuery the composited Managed Client (MCX) preferences that apply to a user or computer, and force a refresh. The pre-MDM management system, still underneath some profile behaviour.

Hardware & peripherals

hidutilThe HID (keyboard/mouse) debugging tool — and the supported way to remap keys system-wide without third-party software:

hidutil property --set '{"UserKeyMapping":[{"HIDKeyboardModifierMappingSrc":0x700000039,"HIDKeyboardModifierMappingDst":0x7000000E0}]}'

makes Caps Lock a Control key. Also dumps live HID events with hidutil monitor.

drutilDrive the optical drive: drutil status, eject, tray open, burn, erase. Still works with an external SuperDrive.

SafeEjectGPUCleanly disconnect an external GPU: migrate any apps or displays off it first, then release it. Prevents the kernel panic that yanking an eGPU otherwise causes.

usbcfwflasherFlash firmware to a USB-C controller. One of a family of firmware updaters for chips inside cables, docks and the Mac itself.

update_mcdp29xxUpdate the firmware of the MCDP29xx DisplayPort converter chip used in some Macs and displays. A good illustration of how many separate processors are in a modern Mac.

codecctlControl audio codec hardware directly — register-level access to the audio chip.

IOAccelMemory · IOSDebug · IOMFB_FDR_LoaderGraphics-stack internals: accelerator memory accounting, an IOKit debugging tool, and a loader for the Mobile Framebuffer's factory diagnostic data. Undocumented Apple internal tools.

afktoolAppleFirmwareKit debug utility — inspects and manipulates the firmware images used by Apple's various coprocessors.

bputil · psmSee the security section — boot policy and Secure Enclave password slots.

smbutilClient-side SMB tool: smbutil view //server lists shares, statshares -a shows what's mounted and with which protocol dialect and encryption. The way to prove whether you're on SMB3 with signing.

mnthomeMount a network (AFP) home directory with correct privileges. From the era of network-booted labs.

nbdst(In /usr/sbin.) NetBoot deferred shadow tool — manages the writable shadow file that a NetBoot client overlays on its read-only network image.

Audio files

The af* family are Core Audio's command-line front ends. They handle every format the system knows — including AAC, ALAC and Opus — with the same encoders QuickTime and Music use.

afplayPlay an audio file. -t seconds, -r rate multiplier (a free pitch-shifted playback), -v volume, -d to choose an output device. The quickest possible "did this file record correctly?"

afinfoPrint everything about an audio file: format, sample rate, channel layout, bit depth, duration, bitrate, and any embedded metadata. afinfo -b for the brief version.

afconvertThe workhorse. Convert between formats and codecs using Apple's own encoders: afconvert -f m4af -d aac -b 256000 in.wav out.m4a, or -d alac for lossless. afconvert -hf lists every supported file format and -h every codec. Apple's AAC encoder is widely considered the best available, and this is how you reach it.

afhashCompute a hash of an audio file's decoded samples rather than its bytes — so two files that sound identical hash identically regardless of container.

afclipDetect clipping in an audio file — samples that hit or exceed full scale.

afidaAudio File Image Distortion Analyzer. Measures encoding artefacts by comparing an encoded file against its source.

auval · auvaltoolAudio Unit validation. auval -a lists every Audio Unit plugin installed on the system; auval -v aufx xxxx MANU runs the full conformance test suite against one. If you write or install AU plugins, this is the tool that says whether a host will load it.

shazamA command-line interface to ShazamKit: identify music from a file or the microphone, and generate signatures for custom catalogs. Yes, macOS ships a Shazam CLI.

Video & media containers

avconvertConvert video using AVFoundation's presets — the same hardware-accelerated pipeline QuickTime Player's "Export As" uses. avconvert --preset PresetHEVC1920x1080 --source in.mov --output out.mov. Hardware encode on Apple silicon makes it dramatically faster than a software ffmpeg build, at the cost of tuning control.

avmediainfoAnalyse a media file: every track, its format description, codec, dimensions, frame rate, colour space, HDR metadata and timing. Far more detail than afinfo, and correct about Apple-specific things (ProRes variants, spatial audio) that other tools guess at.

avmetareadwriteRead and write the metadata of a QuickTime or MPEG-4 file — titles, chapters, artwork, location, and the Apple-specific keys. Non-destructive: it rewrites only the metadata atoms.

mpsgraphtoolInspect and compile Metal Performance Shaders Graph files — the serialised compute graphs Apple's ML and image-processing frameworks execute on the GPU.

Audio Video Bridging

AVB/TSN is the IEEE standard for deterministic, low-latency audio and video over ordinary Ethernet — used in studios, live sound and automotive. Macs have supported it in hardware for years.

avbutilManage AVB features and settings — enable AVB on an interface, list discovered entities, inspect stream reservations.

avbanalyseAnalyse AVB traffic for timing correctness — presentation time accuracy, stream jitter, clock synchronisation quality.

avbcaptureCapture raw AVB traffic for offline analysis.

avbdeviced(In /usr/sbin.) The daemon holding persistent state about discovered AVB entities.

audioclocksyncd(In /usr/libexec.) Precision Time Protocol clock management — the sub-microsecond clock discipline AVB depends on.

Images & icons

sipsScriptable Image Processing System — macOS's built-in ImageMagick. Resize (-Z 800 to fit, -z h w exact), rotate, flip, convert format (-s format png), set DPI, embed or convert ICC colour profiles, and read/write EXIF and IPTC properties. It also does the thing nothing else does easily: sips -i icon.png then DeRez to build a custom folder icon. Handles HEIC natively.

tiffutilManipulate TIFF files — merge several images into one multi-page TIFF, extract pages, and build the @2x multi-resolution TIFFs that Cocoa uses for Retina assets (tiffutil -cathidpicheck).

iconutilConvert between an .iconset folder of PNGs at standard sizes and a compiled .icns. The supported way to build an app icon: iconutil -c icns MyIcon.iconset.

tiff2icnsConvert a TIFF straight to .icns, skipping the iconset step.

layerutilCompile a layered image stack (.lsr) — the parallax layered artwork format used for tvOS icons and some macOS assets.

assetutilInspect a compiled asset catalog. See the Xcode section.

USD & 3D

Pixar's Universal Scene Description is the interchange format behind AR Quick Look, Reality Composer and visionOS. Apple ships the reference toolchain, unadvertised, in /usr/bin.

usdcatPrint a USD file as text, or convert between the binary (.usdc) and ASCII (.usda) encodings. The cat of the USD world, and the way to actually read a scene file.

usdtreeDisplay the scene hierarchy as an ASCII tree — prims, their types and their relationships. The fastest orientation in an unfamiliar asset.

usdcheckerValidate a USD stage or a .usdz package against Apple's requirements for AR Quick Look. Run this before wondering why an asset won't display on a device.

usdzipCreate a .usdz — the zero-compression zip package that bundles a USD scene with its textures — and inspect existing ones.

usdextractPull the constituent files out of a .usdz, and also out of glTF .glb/.gltf files.

usdcrushReduce the size of a USD asset — texture downsampling, mesh simplification, redundant data removal.

usdrecordRender a USD scene to an image file from the command line, using Hydra. Headless thumbnail generation for an asset pipeline.

Machine learning & text intelligence

modelcatalogdumpDump the on-device model catalog — which machine-learning models the system has installed, their versions and which subsystem owns each. A window into the models behind Apple Intelligence, Siri, dictation and photo analysis.

modelmanagerdumpDump the state of the model manager: what is downloaded, what is being fetched, what has been evicted.

lsmLatent Semantic Mapping — the classical text classifier described in the Spotlight section. Trainable from the command line.

coremlc · coremlcompiler(In Xcode's toolchain.) Compile a .mlmodel into the .mlmodelc form the runtime loads. Note the .mlmodelc bundles sitting in /usr/libexec and /usr/sbin — those are shipped models for battery-drain prediction and handwriting recognition.

createml(In Xcode's toolchain.) Train a Core ML model from the command line — image classifiers, text classifiers, tabular regressors — the CLI form of the Create ML app.

Fonts & colour

atsutil(In /usr/sbin.) Font registration system utility. atsutil databases -remove deletes the font caches — the standard fix for garbled text, missing fonts and font-panel corruption. Requires a restart afterwards.

fontrestore(In /usr/sbin.) Restore the system fonts to their pristine set, moving anything unexpected aside. The recovery tool for a font folder someone has vandalised.

colorsyncd · colorsync.displayservices(In /usr/libexec.) The ColorSync daemon and its display-services half — colour profile matching for every window on screen, and per-display calibration.

corebrightnessd(In /usr/libexec.) Display brightness, Night Shift, True Tone and adaptive brightness. Its diagnostic companion is corebrightnessdiag.

Transfer & connection clients

curlTransfer a URL. Apple's build links against Secure Transport rather than OpenSSL, so it uses the system keychain for trust — which means a certificate you added to the keychain works, and --cacert behaves slightly differently from a Homebrew curl. -v, -L, -o, -H, --resolve as everywhere.

nscurlApple's own URL fetcher, built on NSURLSession rather than libcurl. Its real purpose is diagnostics: nscurl --ats-diagnostics https://example.com runs every App Transport Security configuration against a server and reports which TLS settings your app would need. Nothing else answers that question.

ncNetcat — raw TCP and UDP connections, port scanning (-z), and listening (-l). The Apple build supports -x for SOCKS/HTTP proxies and --apple-* flags for network-service-type tagging.

ssh · sloginOpenSSH client. Apple's patches: UseKeychain yes in ~/.ssh/config stores a key's passphrase in the login keychain, and the agent is started automatically per session by launchd.

scp · sftpCopy over SSH. Note that modern scp uses the SFTP protocol underneath by default, which changes some quoting and wildcard behaviour.

ssh-keygen · ssh-add · ssh-agent · ssh-copy-id · ssh-keyscanGenerate keys, load them into the agent, start an agent, install a public key on a server, and harvest host keys. ssh-add --apple-use-keychain is the macOS-specific form.

rsyncApple ships openrsync (a BSD-licensed reimplementation) rather than GNU rsync now. Most common flags work; some GNU-only options (--info=progress2, some filter syntax) do not. Also historically bad at Mac metadata — use ditto or add -E.

tftpTrivial FTP client. Still the way network devices and PXE loaders fetch images.

uucp · uux · uustat · uuto · uupick · uuname · uulog · uucico · cuThe Unix-to-Unix Copy suite — store-and-forward file transfer and remote execution over modems and serial lines, from the 1970s. Nine commands, entirely non-functional in any modern sense, still shipping in 2026. cu ("call up") is the exception: it's a usable serial terminal program.

DNS & discovery

digThe proper DNS query tool. dig +short, dig @8.8.8.8 example.com MX, dig +trace to follow delegation from the root. Note that dig bypasses macOS's own resolver and its per-domain configuration — so dig and the browser can genuinely disagree.

host · nslookupSimpler DNS lookups. nslookup is interactive and deprecated in BIND, but everybody still types it.

delvDNS lookup with DNSSEC validation — shows whether an answer is cryptographically verified and why it failed if it isn't.

nsupdate · tsig-keygen · ddns-confgenSend dynamic DNS updates to a server; and generate the TSIG shared keys that authenticate them.

dscacheutilThe macOS resolver's own tool. dscacheutil -q host -a name foo.local asks through the real system path — Directory Services, mDNS, and the search-domain rules — so it agrees with what apps see. dscacheutil -flushcache is half of the standard DNS-flush incantation (the other half is sudo killall -HUP mDNSResponder).

dns-sdBonjour from the command line. dns-sd -B _http._tcp browses for every web server advertising on the network; -L resolves one to a host and port; -R registers your own service; -G v4v6 resolves a name. The complete tool for understanding what is advertising itself on your LAN — printers, AirPlay targets, Time Capsules, HomeKit bridges.

whoisQuery domain and IP registration databases.

mDNSResponder(In /usr/sbin.) The daemon itself — unicast DNS resolution, multicast DNS, service discovery and DNS64/NAT64. Every name lookup on the Mac goes through it.

Diagnosis & measurement

netstatShow sockets, routing tables and per-interface statistics. macOS lacks Linux's -p for process names — use lsof -i or nettop for that.

nettopThe one you want. A live, top-style view of network activity per process — bytes in and out, connection state, per-interface. nettop -P aggregates by process, -m tcp filters. Answers "what is using my bandwidth?" in one command.

networkQualityApple's responsiveness test — measures not just throughput but "round-trips per minute" under load, which is the number that actually predicts whether video calls will be usable. networkQuality -v. Reports bufferbloat honestly, unlike a speed-test website.

iperf3-darwinThe standard throughput benchmark, Apple-built. Needs an iperf3 server at the other end.

fpingPing many hosts in parallel, or sweep a subnet. Far faster than looping ping.

traceroute · traceroute6(In /usr/sbin.) Map the path packets take. macOS's default uses UDP; -I switches to ICMP and -P TCP to TCP, which gets through more firewalls.

tcpdump(In /usr/sbin.) Packet capture, with Apple additions: -i pktap and -k capture per-process metadata, so you can see which application sent a packet — something no other platform's tcpdump does. -P enables it; -w writes a pcap for Wireshark.

arp · ndp(In /usr/sbin.) Inspect and manipulate the IPv4 ARP cache and the IPv6 neighbour discovery cache.

wdutil(In /usr/sbin.) Wireless diagnostics. sudo wdutil info dumps the complete Wi-Fi state — SSID, BSSID, channel and width, RSSI and noise, PHY mode, security, and the country code. This replaced the old airport command (which Apple removed in Sonoma) and is now the only supported CLI view of Wi-Fi.

skywalkctl(In /usr/sbin.) Interact with Skywalk, Apple's modern userspace networking datapath — the kernel-bypass stack that carries Wi-Fi, cellular and virtual interfaces. skywalkctl show lists its channels and flows. Deeply undocumented and fascinating.

nlcontrol · nlcdThe Network Link Conditioner — impose artificial latency, packet loss and bandwidth limits on the machine's traffic to test how software behaves on a bad connection. The daemon lives in /usr/libexec.

dnctl(In /usr/sbin.) Control dummynet, the traffic shaper that the Network Link Conditioner is built on. Pipes, queues and bandwidth limits, configured directly.

timesyncanalyseAnalyse time synchronisation quality — how far the clock has drifted and how well NTP is correcting it.

sntpA minimal SNTP client — query a time server and report or set the offset.

Configuration

macOS network configuration lives in the SystemConfiguration dynamic store, owned by configd — not in /etc. Editing /etc/resolv.conf does nothing; it is a generated file.

scutil(In /usr/sbin.) The System Configuration client. Interactive or scripted access to the dynamic store: scutil --dns shows the real resolver configuration including per-domain servers; --proxy the proxy settings; --nwi network information and which interface is primary; --get ComputerName/--set HostName manage the machine's three names. scutil then list at the prompt browses the whole store.

networksetup(In /usr/sbin.) The scriptable equivalent of the Network settings pane, with about ninety verbs: -listallnetworkservices, -setdnsservers Wi-Fi 1.1.1.1, -setairportnetwork en0 SSID password, -setwebproxy, -createlocation, -setmanual. The right tool for fleet configuration.

ipconfig(In /usr/sbin.) Not the Windows command. Query and control the DHCP client: ipconfig getifaddr en0 prints the current address, getpacket en0 dumps the whole DHCP lease including options the GUI never shows, set en0 DHCP forces a renew.

scselect(In /usr/sbin.) Switch between network Locations from the command line.

sharing(In /usr/sbin.) Create and manage SMB/AFP share points without the GUI: sharing -a /path -S name.

wfsctl(In /usr/sbin.) Control WebDAV file sharing — the server side.

socketfilterfw(In /usr/libexec/ApplicationFirewall.) The application firewall control tool — the thing the Firewall pane in System Settings actually drives. --getglobalstate, --setglobalstate on, --add /path/to/app, --setstealthmode on. Note this is entirely separate from pfctl's packet filter.

NFS & RPC

nfsstatNFS client and server statistics — operation counts, retransmissions, cache hit rates.

showmount(In /usr/sbin.) List a server's exports and who has them mounted.

ncctl · ncinit · ncdestroy · nclistManage per-mount NFS Kerberos credentials — initialise a credential for a mount, list them, destroy one. Apple-specific; needed for Kerberised NFS in enterprise environments.

rpcinfo(In /usr/sbin.) Query the portmapper for registered RPC services on a host. The first step in debugging any NFS problem.

rpcbind(In /usr/sbin.) The portmapper daemon itself.

spray(In /usr/sbin.) Flood a host with RPC packets to measure how many it drops. A 1980s network-quality test that still works.

rpcgenThe RPC protocol compiler — also present at /System/Library/PrivateFrameworks/oncrpc.framework/bin/rpcgen, one of the very few bin directories hidden inside a framework.

nfs4mapid(In /usr/sbin.) Show how NFSv4 maps between numeric uids/gids and the user@domain strings that go over the wire. The tool for diagnosing "everything is owned by nobody".

automount · automountd(In /usr/sbin and /usr/libexec.) The autofs client and daemon — mount network filesystems on first access, per /etc/auto_master. This is what makes /net/servername and network home directories work.

SNMP

macOS bundles the complete net-snmp suite. The daemon is off by default. Useful for monitoring your Mac from an existing NMS, or for querying switches, printers and UPSes from the Mac.

snmpget · snmpgetnext · snmpsetFetch one OID, fetch the next OID, and write a value.

snmpwalk · snmpbulkwalk · snmpbulkgetWalk a subtree with repeated GETNEXTs, or with the far more efficient v2c GETBULK.

snmptableRetrieve a MIB table and render it as an aligned table. Much more readable than walking it.

snmptranslateConvert between numeric OIDs and their textual names, and print MIB documentation. The tool for making sense of .1.3.6.1.2.1.1.3.0.

snmpstatus · snmpdf · snmpnetstat · snmpdeltaCanned queries: a device's basic status, its disk usage, its network stats in netstat form, and the rate of change of counters over time.

snmptrap · snmpinform · traptoemailSend a trap or an acknowledged inform to a manager; and a handler script that turns received traps into email.

snmpusm · snmpvacm · net-snmp-create-v3-user · encode_keychangeSNMPv3 user management, view-based access control, user creation, and key-change encoding. The v3 security model, which is the only one you should use over an untrusted network.

snmpconf · net-snmp-config · net-snmp-certInteractively build a configuration file; report build and library paths; and manage certificates for SNMP over TLS/DTLS.

mib2c · mib2c-update · snmp-bridge-mib · tkmibGenerate C skeleton code to extend the agent with a new MIB; merge custom code into regenerated skeletons; a bridge-MIB provider; and a Tk graphical MIB browser.

snmpd · snmptrapd · agentxtrap(Daemons in /usr/sbin.) The agent, the trap receiver, and a tool to send an AgentX notification to a master agent.

snmptestAn interactive request builder for poking at an agent by hand.

OpenDirectory

dsclThe Directory Service command line — the real user database tool. Navigate it like a filesystem: dscl . -list /Users, dscl . -read /Users/bob, dscl . -create /Users/bob RealName "Bob", dscl . -append /Groups/admin GroupMembership bob, dscl . -search /Users UniqueID 501. The . means the local node; substitute /LDAPv3/server or /Active Directory/DOMAIN to work against a remote one. Creating a working user needs UniqueID, PrimaryGroupID, NFSHomeDirectory, UserShell and a password — which is why sysadminctl exists.

dsmemberutilResolve group membership the way the kernel does — including nested groups and UUID-based membership that id doesn't show. dsmemberutil checkmembership -U bob -G admin, dsmemberutil flushcache when a change isn't taking effect.

odutilExamine and control opendirectoryd itself: odutil show statistics, show nodenames, set log debug to turn on verbose logging when directory lookups are failing mysteriously.

dserrTranslate a Directory Services numeric error code into a description. dserr -14090.

dsexport · dsimportExport records from OpenDirectory to a delimited file, and bulk-import them back. The tool for creating three hundred student accounts.

dseditgroup(In /usr/sbin.) Create, delete and edit groups and their membership with proper validation — safer than raw dscl for group work.

sysadminctl(In /usr/sbin.) The modern, correct way to create and modify user accounts: sysadminctl -addUser bob -fullName "Bob" -password - -admin. Also manages FileVault secure-token status (-secureTokenStatus, -secureTokenOn), which raw dscl cannot do and which matters enormously on encrypted Macs.

dsenableroot(In /usr/sbin.) Enable or disable the root account and set its password.

createhomedir(In /usr/sbin.) Create and populate home directories from the user template for accounts that don't have one yet — network and mobile accounts especially.

dsconfigad(In /usr/sbin.) Bind the Mac to Active Directory and configure the binding: mobile accounts, home directory mapping, admin group mapping, packet signing. The scriptable form of the Directory Utility AD plugin.

dsconfigldap(In /usr/sbin.) Bind to and unbind from an LDAP directory.

opendirectoryd(In /usr/libexec.) The daemon behind all of the above. Its plugin modules are what make a Mac able to authenticate against a local database, LDAP, AD or a config file simultaneously.

Kerberos

macOS uses Heimdal Kerberos, not MIT. Every Mac runs a "LocalKDC" that issues tickets for local services — this is how screen sharing and file sharing authenticate without a password prompt in some configurations.

kinitAcquire a ticket-granting ticket. kinit user@REALM, -k -t keytab for a service.

klistList the tickets in the current credential cache, with their flags and expiry. klist -v for the full detail.

kdestroyDestroy a credential cache — log out of Kerberos.

kswitch · kccSwitch between multiple credential caches; and manage caches generally (list, copy, delete). Useful when you hold tickets in several realms.

kgetcredExplicitly obtain a service ticket for a named principal — the way to test whether a service's SPN is registered correctly.

kpasswdChange a Kerberos password.

krb5-configPrint the compiler and linker flags needed to build against Heimdal.

ktutil(In /usr/sbin.) Manage keytab files — the on-disk credentials a service uses to authenticate itself without a human.

kadmin · kadmin.local(In /usr/sbin.) Kerberos administration: create principals, change policies, manage the database. The .local variant runs directly against the database without going over the network.

kdcsetup · krbservicesetup · sso_util(In /usr/sbin.) Set up a KDC for an Open Directory master; register services with it; and configure single sign-on for the built-in services. From macOS Server.

checkLocalKDC · configureLocalKDC · migrateLocalKDC(In /usr/libexec.) Verify, create and migrate the per-machine local KDC. Run automatically; occasionally the thing you re-run when local authentication has broken.

gssd(In /usr/sbin.) The GSS-API daemon that performs Kerberos and NTLM authentication on behalf of the kernel — for NFS and SMB mounts.

app-ssoControl the Kerberos SSO app extension. See the security section.

LDAP clients

The full OpenLDAP client suite. Useful against any directory server, not just macOS ones — and the fastest way to explore an Active Directory schema.

ldapsearchThe one you'll use. ldapsearch -H ldap://server -D binddn -W -b "dc=example,dc=com" "(uid=bob)". Add -LLL for clean LDIF output.

ldapadd · ldapmodifyAdd entries from an LDIF file, and modify existing ones. The same binary under two names.

ldapdelete · ldapmodrdnDelete an entry; and rename one by changing its relative distinguished name.

ldappasswdChange an entry's password using the LDAP password-modify extended operation.

ldapcompareTest whether an attribute has a given value without being able to read it — useful when read access is restricted.

ldapwhoamiAsk the server who it thinks you are after binding. The first thing to run when authentication behaves oddly.

ldapurlCompose and decompose LDAP URLs.

ldapexopInvoke an arbitrary LDAP extended operation — "Who am I", "Cancel", "StartTLS", or a server-specific one.

The server side — slapd and its eleven slap* administration tools — lives in /usr/sbin and is covered there. macOS still ships a complete OpenLDAP server even though macOS Server is discontinued.

Submitting & managing jobs

The System V family (lp, lpstat, cancel) and the BSD family (lpr, lpq, lprm) do the same things with different syntax. Both work; pick one.

lpSubmit a file for printing, System V style: lp -d PrinterName -n 2 file.pdf. Options with -o: sides=two-sided-long-edge, media=A4, number-up=2, fit-to-page.

lprThe BSD equivalent: lpr -P PrinterName file.pdf. Takes the same -o options.

lpstatReport status: lpstat -p -d lists printers and the default, -o shows queued jobs, -t shows everything. The diagnostic starting point.

lpqShow one queue, BSD style.

cancel · lprmCancel a job — System V and BSD forms. cancel -a clears an entire queue.

lpoptionsDisplay or set per-user or system-wide default options for a printer, including the default destination. lpoptions -p Printer -l lists every option the driver supports with its current value — the fastest way to discover what a printer can do.

lpadmin(In /usr/sbin.) Add, remove and configure printers and classes. lpadmin -p Name -E -v ipp://host/ipp/print -m everywhere adds a driverless IPP printer in one line — the modern way, requiring no PPD at all.

lpc(In /usr/sbin.) The BSD line printer control shell. Deprecated in CUPS; mostly a status display now.

lpinfo(In /usr/sbin.) List available devices and drivers — what CUPS can see on USB, on the network, and which PPDs are installed.

lpmove(In /usr/sbin.) Move a job, or every job, to a different destination.

cupsaccept · cupsreject · cupsenable · cupsdisable(In /usr/sbin.) Two orthogonal switches per queue: whether it accepts new jobs, and whether it prints them. A queue can accept but not print, which is how you pause a printer without losing work.

IPP & drivers

ippfindDiscover IPP printers on the network via Bonjour, and filter them by capability — "find me every colour duplex printer" is a one-liner.

ipptoolSend arbitrary IPP requests from a test file and check the responses. The conformance-testing tool, and the way to interrogate a printer's full attribute set: ipptool -tv ipp://host/ipp/print get-printer-attributes.test.

ippeveprinterRun a fake IPP Everywhere printer — turns your Mac into a network printer that accepts jobs and runs a command on them. Excellent for testing, and a genuinely useful way to make a PDF-capturing "printer".

cupsctl(In /usr/sbin.) Change cupsd.conf settings without editing the file: cupsctl --debug-logging is the standard first move when printing fails.

cupsd(In /usr/sbin.) The scheduler itself, started on demand by launchd. Its web interface at http://localhost:631 is fully functional and much richer than System Settings — though on macOS it's disabled until you run cupsctl WebInterface=yes.

cups-configReport compiler and linker flags for building against the CUPS API.

cupstestppdValidate a PPD file against the specification.

cupsfilterRun a file through the CUPS filter chain by hand — convert a document to what a given printer would receive. Deprecated but still the easiest way to render anything to PDF or PostScript from a script.

ppdc · ppdi · ppdmerge · ppdpo · ppdhtmlThe PPD compiler suite — compile a .drv source into PPDs, import existing ones, merge translations, extract message catalogs and generate HTML summaries. All five are deprecated: CUPS is moving to driverless IPP Everywhere, and Apple has removed PPD-based drivers from recent macOS.

getPPDVersion(In /usr/libexec.) Internal helper that reports a PPD's version during printer setup.

ippusbd(In /usr/libexec.) Bridges IPP-over-USB — makes a USB printer that speaks IPP appear as a network printer to CUPS.

Perl

~130 files

Perl 5.34 with a large slice of CPAN preinstalled. Every script appears twice — once plain and once with a 5.34 suffix (pod2man and pod2man5.34) — so that a future Perl version can be added without breaking existing shebangs. The suffixed copies are identical; they are not listed separately below.

The interpreter

perl · perl5.34The interpreter. Deprecated by Apple "for future removal", but still present and still what a great deal of the system's own tooling is written in.

perldocRead Perl documentation — perldoc -f sprintf for a function, perldoc Module::Name for a module, perldoc perlre for the regex manual.

cpanInstall modules from CPAN. On a stock Mac this will try to write into the system Perl and fail; use local::lib or a Homebrew Perl.

corelistWhich Perl version first shipped a given module in core, and which shipped last. The compatibility oracle.

instmodshAn interactive shell for browsing installed modules and their files.

perlbug · perlthanks · perlivpFile a Perl bug; send praise instead; and run the installation verification procedure to check the install is sane.

splainExpand terse Perl warnings into the full explanation from perldiag. Pipe your error output through it.

proveRun a test suite through a TAP harness with a readable summary. Perl's make test, usable on any TAP-emitting tests.

POD documentation

pod2man · pod2html · pod2text · pod2usage · pod2readmeConvert Perl's POD markup into a man page, HTML, plain text, a usage message, or a README. pod2man in particular is how a great many man pages on this system were generated.

podcheckerValidate POD syntax.

Module authoring

h2ph · h2xsConvert C headers into Perl-readable constants; and scaffold an XS extension module from a header. The old way of binding C libraries.

xsubppCompile XS glue code into C. The actual translator behind every compiled Perl module.

enc2xsGenerate an Encode module from character mapping tables.

pl2pmRoughly translate a Perl 4 .pl library into a Perl 5 module. Of purely archaeological interest.

libnetcfgConfigure the libnet module's default hosts for FTP, SMTP and friends.

config_dataQuery or change the configuration of an installed module built with Module::Build.

Bundled CPAN tools

json_pp · json_xsCommand-line JSON: pretty-print, minify, and convert between JSON, YAML, storable and Perl formats. json_pp is pure Perl and always available — a serviceable jq substitute for reformatting.

shasumCompute or check SHA digests. Its -c mode verifies a checksum file, which the /sbin hash tools cannot do.

lwp-request · lwp-download · lwp-mirror · lwp-dumpThe libwww-perl user agent as command-line tools: make a request, download a file, mirror one only if changed, and dump the headers and content of a URL. lwp-mirror in particular does something curl needs several flags for.

xpathRun an XPath expression against an XML document and print the matching nodes.

htmltreeParse HTML and dump the resulting tree — a quick way to see how a mangled page actually parses.

findruleA command-line front end to File::Find::Rule — find with a more composable expression language.

ptar · ptardiff · ptargrepPure-Perl tar, plus diff-against-archive and grep-inside-archive. See the archives section.

piconviconv reimplemented in Perl, with access to every Encode codec — including several that the C iconv lacks.

encguessGuess a file's character encoding.

tidy_changelogReformat a CPAN Changes file to the standard specification.

dbiprof · dbilogstrip · dbiproxy · dbicadminThe DBI database toolkit: profile query performance, normalise trace logs so two runs can be diffed, run a proxy server, and administer DBIx::Class schemas.

spfquery · spfdCheck an email's sender against a domain's SPF policy, and run a daemon that answers SPF queries for a mail server.

net-serverThe Net::Server framework's starter — turns a Perl module into a daemon.

pp · par.pl · parl · parldyn · tkppPAR — the Perl Archive Toolkit. pp packages a Perl script and all its dependencies into a single standalone executable, the way PyInstaller does for Python. tkpp is a graphical front end.

scandeps.plScan a script and report every module it needs — the dependency analyser PAR uses.

yapp · eyapp · treeregParse::Yapp and Parse::Eyapp — yacc-style parser generators that emit Perl, plus a compiler for tree regular expressions.

yamlpp-load · yamlpp-events · yamlpp-highlight · yamlpp-parse-emit · yamlpp-load-dumpYAML::PP's diagnostic tools: load a document, dump its parse events, syntax-highlight it, and round-trip it. Useful for finding out exactly why a YAML file isn't parsing as you expect.

test-yamlRun the YAML test suite.

macerror · macoserrorLook up a classic Mac OS error number and print its symbolic name and meaning. macerror -43 → fnfErr, file not found. Still genuinely useful when an old API returns a bare number.

ip2cc · ipcount · iptabMap an IP address to a country; count addresses in a CIDR block; and print the IP allocation table.

crc32Compute a CRC-32 checksum.

binhex.pl · debinhex.plEncode and decode BinHex using Convert::BinHex.

moose-outdated · package-stash-conflictsReport outdated Moose dependencies and Package::Stash conflicts. Left over from the Moose object system's install checks.

mp2bugmod_perl bug report generator.

xgettext.plExtract translatable strings from Perl source into a gettext catalog.

zipdetailsDump the internal structure of a zip file, field by field.

streamzipBuild a zip from a stream.

Ruby

Ruby 2.6, formally deprecated by Apple and unchanged since 2019. Present largely because CocoaPods, Fastlane and Homebrew's early bootstrap expect it. Do not build on it — install a real Ruby.

rubyThe interpreter, version 2.6.10 — three major versions behind current, with known CVEs.

irbThe interactive Ruby shell.

gemThe package manager. Installing into the system Ruby requires sudo and is a reliable way to break things; gem install --user-install is the least bad option.

bundle · bundlerDependency resolution from a Gemfile.

rakeRuby's make.

erbThe template engine as a command-line tool — a general-purpose text templater that happens to ship with macOS. erb file.erb > out.

rdoc · riGenerate documentation from Ruby source; and look it up from the terminal.

railsA stub that errors unless Rails is installed. Its presence in /usr/bin is an artefact of the bundled gem set.

Python

macOS no longer ships a usable Python. Python 2 was removed in Monterey; what remains is a stub.

python3 · pip3Shims that resolve to the Command Line Tools' Python 3 if installed, and otherwise prompt you to install it. On this machine that is Python 3.9.6 — unchanged by the 26.6 / Xcode 26.6 update, and years behind upstream. That Python exists for Xcode's own build scripts; Apple explicitly says not to depend on it. Install python.org's build, Homebrew's, or uv.

Tcl / Tk & Expect

A complete Tcl 8.5 with Tk graphical bindings still ships, which means macOS can draw a native-ish GUI window from a shell script with no dependencies at all.

tclsh · tclsh8.5The Tcl interpreter.

wish · wish8.5The windowing shell — Tcl with Tk loaded. Run wish and you get a window. This is why tkmib, tkcon and tkpp can ship as graphical tools with no installer.

expectAutomate interactive programs. Drives anything that expects a human at a terminal — ssh password prompts, passwd, serial consoles, installers. spawn, expect, send. Still the only clean answer for a program with no non-interactive mode.

tkconA much better interactive Tcl console than tclsh, with history, completion and inspection.

sdxStarkit Developer eXtension — wrap a Tcl application and its files into a single-file "starkit" executable.

Java

None of these work by default. Apple stopped shipping a JDK in 2013. Every command here is a stub that prints "No Java runtime present, requesting install." Once you install a JDK they become live forwarders to it. Listed for completeness because they occupy thirty entries in /usr/bin.

java · javac · javadoc · javap · jar · jarsigner · keytoolRuntime, compiler, doc generator, class disassembler, archiver, archive signer, keystore tool.

jdb · jconsole · jcmd · jstack · jmap · jstat · jstatd · jinfo · jhsdbThe diagnostic suite: debugger, monitoring console, command interface, thread dump, heap dump, statistics, and the HotSpot serviceability agent.

jshell · jrunscript · jjsThe Java REPL, a generic script runner, and the (removed) Nashorn JavaScript engine.

jlink · jimage · jpackage · jdepsBuild a custom runtime image, inspect one, package an application, and analyse class dependencies.

rmic · rmid · rmiregistry · orbd · servertool · tnameserv · serialverRMI and CORBA infrastructure — all removed from modern JDKs, the stubs remain.

javaws · policytool · pack200 · unpack200 · jcontrolWeb Start, the policy editor, the (removed) class-file compressor pair, and the Java control panel.

java_home(In /usr/libexec.) The one that is Apple's and does work. Locates installed JDKs: /usr/libexec/java_home -V lists them all, -v 21 prints the path to a specific version. The correct way to set JAVA_HOME on a Mac.

Data & markup tools

jqThe JSON processor. A relatively recent and very welcome addition to the base system — jq '.items[].name'. Pairs with the growing number of Apple tools that speak JSON (system_profiler -json, eslogger, log show --style json).

sqlite3The SQLite shell. Essential on macOS because an enormous amount of system state is in SQLite databases — Messages, Photos, Mail, Notes, the TCC database, Launch Services, Spotlight's store. Open them read-only (file:db?immutable=1) so you don't corrupt a live one.

xmllintParse, validate and reformat XML. --format pretty-prints, --xpath queries, --noout --schema validates. The workhorse for anything XML on macOS.

xsltprocApply an XSLT stylesheet. Still the fastest way to transform a large XML document.

xmlcatalogManage XML catalogs — the mapping from public identifiers to local DTD files that keeps validation from hitting the network.

tidyCheck, correct and pretty-print HTML. HTML5-aware in the shipped version.

xml2-config · xslt-config · xml2-configReport build flags for libxml2 and libxslt.

db_dump · db_load · db_verify · db_stat · db_recover · db_archive · db_checkpoint · db_deadlock · db_hotbackup · db_upgrade · db_printlog · db_codegenThe complete Berkeley DB administration suite — twelve commands for a database engine that macOS itself barely uses any more. Present because OpenLDAP and a few other bundled projects link against it.

cap_mkdb · pwd_mkdb · dev_mkdbCompile the termcap-style capability database, the password databases, and the device database into their hashed binary forms.

Mail

macOS ships Postfix as its MTA. It is configured to accept local mail only and is not running by default, but it works — cron and system tools still deliver to local mailboxes through it.

mail · mailxThe classic terminal mail reader and sender. echo body | mail -s subject user still delivers locally. Two names for one program.

sendmail(In /usr/sbin.) Postfix's sendmail-compatible front end. Scripts that pipe to /usr/sbin/sendmail work unchanged.

mailqShow the mail queue. An alias for postqueue -p.

newaliasesRebuild the alias database after editing /etc/aliases. An alias for postalias.

postfix(In /usr/sbin.) The control program — start, stop, reload, check, flush.

postconf(In /usr/sbin.) Show and set Postfix parameters. postconf -n prints only non-default settings, which is the single most useful diagnostic output.

postqueue · postsuper(In /usr/sbin.) List and flush the queue; and delete, hold or requeue messages in it.

postcat(In /usr/sbin.) Print the contents of a queue file — headers, envelope and body — for a message that's stuck.

postmap · postalias(In /usr/sbin.) Build and query the hashed lookup tables Postfix uses for aliases, transports and access rules.

postdrop · postlock · postlog · postkick · postmulti(In /usr/sbin.) Submit mail to the maildrop queue; lock a mailbox while running a command; log in Postfix's format; wake a service; and manage multiple Postfix instances on one host.

Xsan / StorNext

Apple's clustered SAN filesystem, licensed from Quantum's StorNext, letting many Macs mount the same Fibre Channel volume read-write simultaneously. Aimed at film and broadcast post-production. Still bundled with every copy of macOS, and effectively invisible.

cvlabel(In /usr/sbin.) Label the raw LUNs that will form a volume. The first step of setting up an Xsan.

cvmkfs(In /usr/sbin.) Create the filesystem across the labelled LUNs.

cvfsck(In /usr/sbin.) Check and repair an Xsan volume.

cvadmin(In /usr/sbin.) The interactive administration shell — activate volumes, list clients, inspect stripe groups, fail over the metadata controller.

cvupdatefs(In /usr/sbin.) Apply configuration changes — add stripe groups, grow the volume — to a live filesystem.

cvgather · cvversions · cvfsid(In /usr/sbin.) Collect diagnostics for support; report component versions; and print this host's filesystem identity.

cvdb · cvdbset · cvfsdb(In /usr/sbin.) Debug tracing controls and the filesystem debugger.

cvcpA copy tool tuned for the SAN — large I/O sizes and direct I/O, dramatically faster than cp on a striped volume.

cvmkdir · cvmkfileCreate a directory or preallocate a file with a specific affinity — pinning it to a particular stripe group, so that video streams land on the fast disks.

cvaffinityQuery or set the affinity of an existing file or directory.

snfsdefragDefragment a file's extents on an Xsan volume — important for sustained video playback.

snquota(In /usr/sbin.) Manage directory-level quotas on an Xsan volume.

sndiskmove(In /usr/sbin.) Move data off a LUN so it can be retired, without downtime.

xsanctl(In /usr/sbin.) The Apple-facing wrapper: create and join a SAN, add and remove computers, manage the configuration profile.

mount_acfs(In /sbin.) The mount helper for Xsan volumes.

InfiniBand & RDMA

Yes, macOS ships an InfiniBand verbs toolkit. Left over from Xserve and high-performance computing ambitions; harmless, unused, and a nice piece of evidence about where Apple once thought the Mac Pro was going.

ibv_devicesList InfiniBand devices present on the system. On any modern Mac: none.

ibv_devinfoPrint detailed attributes of an InfiniBand device — ports, link state, GUIDs, MTU.

ibv_uc_pingpongA latency benchmark between two hosts over an unreliable-connected queue pair.

rdma_ctlControl the RDMA subsystem.

Everything else

safaridriverThe WebDriver server for Safari — lets Selenium and other browser-automation frameworks drive Safari. Must be enabled once with safaridriver --enable. Also present in the Safari cryptex, which is the copy that actually gets updated.

trimforceEnable TRIM on third-party SSDs, which macOS otherwise refuses to do. sudo trimforce enable presents an alarming warning and reboots. Genuinely improves the longevity of an aftermarket SSD in an older Mac.

memacctReport memory accounting by "coalition" — the group of processes an app and its XPC helpers form. How the system attributes an app extension's memory back to its host.

devmodectlControl Developer Mode — the per-device switch that must be on before a Mac will run locally-built code on a paired iOS device or allow certain debugging.

setregionSet the DVD drive's region code. Six changes and it locks permanently. A relic of a settled argument.

lsvfsList the virtual filesystem types the kernel currently has loaded, with their flags and reference counts. A quick check of whether an FSKit or third-party filesystem has registered.

pagesizePrint the system page size. 16384 on Apple silicon, 4096 on Intel — a difference that breaks a surprising amount of ported software.

fingerLook up information about a user — real name, shell, home directory, last login, and their .plan file. Networked finger is long dead; local lookups still work.

getoptParse command options in a shell script. The BSD version does not handle embedded whitespace correctly; the shell builtin getopts is safer for anything non-trivial.

ulTranslate underscore-backspace sequences into the terminal's actual underline mode. A companion to col for reading nroff output.

asaInterpret FORTRAN carriage-control characters in column one. Present because POSIX requires it. Genuinely from another era of computing.

curl-config · pcap-config · ncurses5.4-configReport the compiler and linker flags needed to build against libcurl, libpcap and ncurses.

bashbugFile a bug report against bash. Against bash 3.2, in 2026. It will not be fixed.

jpsList running Java processes. Another JDK stub.

Disks & volumes

diskutilThe disk tool. list shows every disk, container and volume with identifiers; info disk3s1 gives everything about one; apfs list shows the container/volume relationships that list flattens. Also eraseDisk, partitionDisk, mount/unmount/unmountDisk force, repairVolume, apfs addVolume, apfs deleteVolume, apfs resizeContainer, enableFileVault, and appleRAID for software RAID. Coordinates with diskarbitrationd, which is why it works when umount fails.

fdiskEdit an MBR partition table. Only relevant for Boot Camp remnants, old external drives and bootable USB sticks for other systems.

gptEdit a GUID partition table directly — gpt show /dev/disk0 prints the raw partition layout including the EFI and Recovery partitions that diskutil hides. The tool for when diskutil refuses.

pdiskEdit an Apple Partition Map — the PowerPC-era partition scheme. Present for reading very old disks.

vsdbutilManipulate the volume status database — specifically, whether ownership is honoured on a given volume. The command-line form of the "Ignore ownership on this volume" checkbox.

mkfileCreate a file of a given size, filled with zeros, quickly. Used for creating swap files and test data. mkfile 1g test.dat.

mtreeRecord a directory hierarchy's structure and checksums to a spec, and verify a tree against it later. Apple defines the entire system volume's expected layout in mtree specs under /System/Library/….

BootCacheControlControl the boot cache — the recorded playlist of disk blocks read during startup, which the system prefetches on the next boot. BootCacheControl statistics shows how effective it was.

iostatPer-disk I/O statistics: transfers per second, throughput, and CPU breakdown. iostat -w 1 for a live view.

dev_mkdbRebuild the /dev name database that some older tools consult to map device numbers to names.

Machine setup & policy

systemsetupThe scriptable System Settings. About forty verbs, most requiring root: -setcomputersleep, -setrestartpowerfailure on, -setremotelogin on (enables SSH), -setremoteappleevents, -settimezone, -setusingnetworktime, -setnetworktimeserver, -setwakeonnetworkaccess, -setstartupdisk. The standard tool for provisioning a Mac from a script. -getX forms read each setting back.

languagesetupSet the system's primary language non-interactively — the CLI form of the first-boot language picker. Used in imaging workflows.

localemanagerConfigure OpenDirectory server locales — which directory servers a site should prefer.

blessSet which volume the machine boots from, and mark a volume as bootable. bless --info / reports the current blessing; --mount … --setBoot changes it. On Apple silicon much of its power moved into the boot policy system, but it remains the tool that writes the startup disk selection.

startupdiskhelper(In /usr/libexec.) The privileged helper behind the Startup Disk pane.

nvramRead and write firmware variables. See the kernel extensions card in the system section.

newsyslogRotate log files according to /etc/newsyslog.conf — size or time triggers, compression, and a signal to the owning daemon. Runs hourly from launchd. Note this only handles the classic text logs; the unified log manages itself.

zic · zdumpCompile a timezone source file into the binary format in /usr/share/zoneinfo; and dump a compiled zone to show its transitions. zdump -v America/New_York prints every DST change ever defined for that zone.

graphicssessionInitialise a graphics session — the plumbing that establishes the WindowServer session for a login. Not something you run.

Accounts, passwords & quotas

chownChange file owner and group. Lives here rather than /bin, which surprises everyone who copies a Linux script.

chrootRun a command with a different root directory. Weak isolation on macOS — it is not a container and does not restrict much.

vipw · vifs · visudoSafely edit the password file, /etc/fstab and /etc/sudoers — each takes a lock and validates the syntax before installing the new version. Always use visudo; a malformed sudoers file locks you out of root.

checkgidValidate group identifiers — check that a GID exists and is usable.

repairHomePermissionsReset a home directory's ownership and ACLs to the expected defaults. The surviving fragment of Disk Utility's old "Repair Permissions" function, which Apple removed for the system volume but kept for home directories.

unsetpasswordClear a user's password in the Password Server database.

mkpassdbCreate the Password Server database. From macOS Server's authentication stack.

weakpass_editEdit the dictionary of weak passwords that the Password Server rejects.

PasswordService · authserver · DirectoryServiceThe macOS Server authentication daemons: the Password Server itself, the authentication server, and the pre-OpenDirectory DirectoryService daemon kept as a compatibility shim.

quotaon · quotaoffEnable and disable disk quotas on a filesystem.

edquota · setquotaEdit a user's quota interactively, and set one non-interactively.

repquotaReport quota usage for every user on a filesystem.

rpc.rquotad(In /usr/libexec.) Serve quota information to NFS clients so their quota command works against a network home.

Core system daemons

These live in /usr/sbin rather than /usr/libexec mostly for historical reasons — they predate the convention. All are started by launchd; running them by hand is almost never right.

notifydThe Darwin notification server — the lightweight system-wide publish/subscribe bus. Thousands of state changes per minute flow through it; notifyutil is its client.

distnotedThe distributed notification server — the richer, per-session Cocoa notification bus (NSDistributedNotificationCenter), which carries a payload dictionary where notifyd carries only a name.

cfprefsdThe preferences daemon. Owns every plist read and write, and caches aggressively — the reason defaults changes sometimes appear not to take.

syslogdThe Apple System Log server. Largely superseded by logd but still running, still handling /etc/syslog.conf and the BSD syslog socket.

aslmanagerAges out and deletes old ASL log data on a schedule.

coreaudiodThe Core Audio daemon. Owns every audio device, mixes every stream, and hosts audio plugins. sudo killall coreaudiod is the standard fix for a Mac that has lost its sound — it restarts instantly.

systemsoundserverdPlays system sounds and alerts — a separate, tiny server so that a UI alert doesn't have to route through the full audio graph.

filecoordinationdSystem-wide file coordination — the arbitration that lets several processes read and write the same document safely (NSFileCoordinator). Central to iCloud Drive and document-based apps.

usernotedThe Notification Center daemon — receives notifications from apps, applies Focus and delivery rules, and drives the banners.

appsleepdImplements App Nap — detecting that an application is not visible and not doing anything the user can perceive, then throttling its timers and I/O.

universalaccessdThe accessibility server — VoiceOver, Zoom, Switch Control, Hover Text and the accessibility API that automation tools also use.

KernelEventAgentPresents user-facing dialogs on the kernel's behalf. When you see "Your disk is almost full" or "The disk was not ejected properly", this is the process that put it there.

securitydThe security context daemon — keychain operations and cryptographic services on behalf of every process. Its modern siblings secd and trustd live in /usr/libexec.

amtAbstract Machine Test utility — an Apple internal test harness left in the shipping system.

Bluetooth & wireless

bluetoothdThe Bluetooth daemon — pairing, connection management, profile handling, and the bridge between hardware and every Bluetooth API. sudo pkill bluetoothd is the standard fix for a Bluetooth stack that has wedged.

BlueToolAn interactive Bluetooth debugging shell — send raw HCI commands, dump controller state, control the radio. Apple's internal tool, undocumented and powerful.

BTLEServer · BTLEServerAgentBluetooth Low Energy — the daemon and its per-user agent. BLE is handled separately from classic Bluetooth because its connection model (advertise, scan, GATT) is entirely different.

bluetoothaudiodBluetooth audio specifically: A2DP and HFP codec negotiation, AAC and the AirPods-specific extensions, and the latency management that keeps audio in sync with video.

bluetoothuserd(In /usr/libexec.) The per-user-session half — handles features that need to know who is logged in, like Handoff device lists.

WirelessRadioManagerdArbitrates between the radios that share antennas and spectrum — Wi-Fi, Bluetooth and, on some hardware, cellular and UWB. Coexistence management, which is why Bluetooth audio stutters less on Apple hardware than it might.

airportd(In /usr/libexec.) The Wi-Fi daemon — scanning, association, roaming decisions and the auto-join database. The old user-facing airport symlink to this was removed; wdutil replaced it.

Network services

sshdThe OpenSSH server. Not enabled by default — sudo systemsetup -setremotelogin on, or the Remote Login checkbox. Its helpers (sshd-session, sshd-auth, sshd-keygen-wrapper, sftp-server) are in /usr/libexec.

smbdThe SMB file server. Apple's own implementation, not Samba — replaced Samba in 10.7 for licensing reasons. Serves File Sharing over SMB2/3.

netbiosdNetBIOS name service — makes the Mac visible under a name to older Windows machines browsing the network.

wspd(In /usr/libexec.) Implements MS-WSP, the Windows Search Protocol, so Windows clients can search an SMB share the Mac exports.

pppdThe Point-to-Point Protocol daemon — dial-up and PPPoE. Still the transport under some VPN types. chat is its scripted-dialogue companion for talking to a modem.

vpndThe macOS Server VPN service — L2TP and PPTP server. Its client side is in the Network Extension framework now.

racoon · setkeyIKE key management for IPsec, and the tool that manipulates the kernel's security association and policy databases directly. Legacy — modern VPNs use Network Extension providers.

rtadvdIPv6 router advertisement daemon — makes the Mac advertise itself as an IPv6 router, used by Internet Sharing.

rarpdReverse ARP daemon — answers "what is my IP?" for diskless clients booting from the network. Ancient, and still functional.

sntpdA minimal SNTP server, so the Mac can serve time to other devices.

rpc.lockd · rpc.statdNFS file locking and the host status monitor that makes lock recovery possible after a reboot.

nlcontrolNETLOGON secure channel utility — maintains the trust relationship with an Active Directory domain controller.

smbdiagnose · sharing · wfsctlDiagnostics, share point management and WebDAV sharing — see the networking section.

Apache HTTP Server

macOS still ships a complete Apache 2.4 with roughly 120 modules in /usr/libexec/apache2. It is disabled by default; sudo apachectl start serves /Library/WebServer/Documents on port 80 immediately. Apple no longer configures or supports it, but it works.

httpdThe server binary. httpd -M lists loaded modules, -t tests the configuration, -S dumps the virtual host layout.

apachectlThe control script — start, stop, restart, graceful, configtest. Use this rather than invoking httpd directly; it sets the environment first.

httpd-wrapper · envvars · envvars-stdThe launchd wrapper and the environment files it sources before starting the server.

htpasswd · htdigest · htdbmManage password files for basic auth, digest auth, and DBM-format auth respectively.

dbmmanageThe Perl equivalent of htdbm, kept for compatibility.

httxt2dbmConvert a text file into a DBM database for use with RewriteMap — fast lookups in rewrite rules.

rotatelogsA piped-logging program that rotates the access log by time or size without restarting Apache.

logresolveResolve IP addresses to hostnames in an access log, offline — so the server doesn't pay for reverse DNS on every request.

htcachecleanGarbage-collect Apache's on-disk cache, keeping it under a size limit.

fcgistarterStart a FastCGI application for mod_proxy_fcgi.

abApacheBench — a simple HTTP load generator. ab -n 1000 -c 10 http://host/. Crude but always available.

serverinfoReport information about the server installation. A remnant of macOS Server.

OpenLDAP server

The slapd server and its offline administration tools. macOS uses these for the local OpenDirectory database — the directory that holds your user account is a real LDAP server running on your Mac.

slapd(In /usr/libexec.) The stand-alone LDAP daemon.

slapadd · slapcatLoad entries into the database directly from LDIF, and dump the database back out. Both work offline, without the server running — the standard backup and restore path.

slapindexRebuild the database's indexes after changing which attributes are indexed.

slappasswdGenerate a hashed password string suitable for a userPassword attribute.

slaptestCheck a slapd.conf or cn=config tree for validity before restarting.

slapaclTest whether a given identity would be allowed to read or write a given attribute — debugging access rules without trial and error.

slapauthCheck how an authentication identity maps to an authorization identity under the configured rules.

slapdnValidate distinguished names against the schema's syntax rules.

slapschemaCheck every entry in the database against the schema — finds records that became invalid after a schema change.

slapconfigApple's own wrapper for configuring slapd and the related Open Directory daemons — promoting a machine to an OD master, setting up replication, backing up and restoring the directory. slapconfig -createldapmasterandadmin.

slapconfig-keygen(In /usr/libexec.) Generate the keys that OpenDirectory replication uses.

Hardware & firmware daemons

appleh13camerad · appleh16cameradCamera daemons for the H13 and H16 image signal processors — the dedicated silicon that handles the built-in camera, Center Stage, Portrait mode and Desk View. Two versions because different Mac generations have different ISPs.

xartutilManage xART (eXtended Anti-Replay Technology) — the Secure Enclave's tamper-resistant counter storage, used to prevent rollback attacks on things like passcode attempt counts. xartutil --list.

iRATBW.mlmodelcNot a program — a compiled Core ML model sitting in /usr/sbin. "iRAT" is intelligent radio access technology selection: the model that decides when to hand off between Wi-Fi and cellular. A good illustration of how thoroughly ML has been threaded into the OS.

ioupsd(In /usr/libexec.) Tracks the state of a connected UPS over USB, and triggers upsshutdown when the battery runs low.

applessdstatistics · StorageDEHelper(In /usr/libexec.) Collect SSD wear and performance statistics from the internal storage controller.

mDNSResponderHelperA privilege-separation helper: mDNSResponder runs unprivileged, and asks this small helper to perform the few operations that need root.

purge · taskpolicy · cpuctl · systemstats · spindumpPerformance and power tools — see the debugging section.

Also in `/usr/sbin`, covered above

~60

Command	Where it's described
diskutil, mkfile, mtree, fdisk, gpt	above, and the archives section
spctl, csrutil, firmwarepasswd, DevToolsSecurity, system-override, sc_auth, pwpolicy, ckksctl, systemkeychain, ocspd, securityd, klist_cdhashes	Security & Trust
audit, auditd, auditreduce, praudit, accton, sa, ac	Security → Auditing
scutil, scselect, networksetup, ipconfig, wdutil, skywalkctl, dnctl, tcpdump, traceroute, traceroute6, arp, ndp, mDNSResponder, showmount, rpcinfo, rpcbind, spray, nfs4mapid, automount, aslmanager	Networking
lpadmin, lpc, lpinfo, lpmove, cupsd, cupsctl, cupsaccept, cupsreject, cupsenable, cupsdisable, cupsfilter	Printing
dseditgroup, dsconfigad, dsconfigldap, dsenableroot, createhomedir, sysadminctl, ktutil, kadmin, kadmin.local, kdcsetup, krbservicesetup, sso_util, gssd	Directory & Kerberos
kextstat, kextcache, kextfind, kextlibs, mkextunpack, kcditto, nvram, ioreg, ioalloccount, ioclasscount, system_profiler, sysctl, hostinfo	System Administration
softwareupdate, installer, AssetCacheManagerUtil, AssetCacheLocatorUtil, AssetCacheTetheratorUtil, mcxquery, mcxrefresh, nbdst	System Administration
postfix, postconf, postqueue, postsuper, postcat, postmap, postalias, postdrop, postlock, postlog, postkick, postmulti, sendmail	Oddities → Mail
cvadmin, cvlabel, cvmkfs, cvfsck, cvupdatefs, cvgather, cvversions, cvfsid, cvdb, cvdbset, cvfsdb, snquota, sndiskmove, xsanctl	Oddities → Xsan
snmpd, snmptrapd, agentxtrap	Networking → SNMP
atsutil, fontrestore, avbdeviced, cfprefsd	Media, and above
uuchk, uuconv, uusched, uuxqt, uucico	Networking → UUCP
xscertadmin, xscertd	Certificate signing for macOS Server's OD environment — process CRLs and sign certificates.

launchd, XPC & process lifecycle

xpcproxyThe most important program you've never heard of. When launchd needs to start a job, it execs xpcproxy first, which sets up the execution environment — sandbox, entitlements, environment variables, resource limits, session — and only then execs the real binary. If you see xpcproxy in a crash log, the process died before it became itself.

xpcroleaccountdManages the role accounts (unprivileged service users like _locationd) that daemons run as.

UserEventAgentThe high-level system event handler — a plugin host that runs dozens of small event-driven modules in one process, so each doesn't need its own daemon. A large fraction of "something changed, react to it" logic lives inside it.

runningboarddThe assertion broker. Every claim that a process should stay alive, stay unsuspended, or get a particular resource priority is an assertion held through RunningBoard. It decides who gets suspended, who gets CPU, and who gets killed under pressure. Ported from iOS; now central to macOS.

sandboxdThe userspace half of the sandbox — logs violations and answers policy questions the kernel extension can't decide alone. Sandbox denials appear in the unified log under its name.

taskgated · taskgated-helperDecides who may call task_for_pid — that is, who may inspect or debug another process. Every debugger attach passes through it. This is the mechanism DevToolsSecurity configures.

secinitdThe security policy initialisation daemon — sets up a process's sandbox container and security context at launch, before its first instruction runs.

containermanagerd · containermanagerd_systemCreate and manage the sandboxed container directories that apps and extensions get in ~/Library/Containers. The user-session and system-wide halves.

ContainerMigrationServiceMoves data between containers when an app's identity or container layout changes.

smdThe ServiceManagement daemon — installs and manages privileged helper tools and login items registered by apps through SMAppService. What populates the Login Items & Extensions list.

loginitemregisterdRegisters login items, including the modern per-app background-item registrations.

pkd · pkreporterPlugInKit — discovers, validates and launches app extensions (share sheets, widgets, Finder Sync, Quick Look, Safari extensions). pkd is the daemon; pkreporter inventories what's registered. pluginkit is the CLI client.

lsdThe Launch Services daemon — the database mapping file types and URL schemes to applications, and the registry of every app the system has ever seen. Corruption here causes "wrong app opens my files"; the fix is rebuilding the LS database.

rootless-initRuns early in boot to establish the SIP ("rootless") protections on the filesystem.

init_data_protection · init_exclavekit · init_featureflagsThree early-boot initialisers: set up the data protection (file encryption class) keys; bring up ExclaveKit, the Apple-silicon secure-world execution environment introduced for sensitive sensor access; and load the feature-flag configuration that gates which OS features are active.

otherbsd"Other Bootstrapper Daemon" — bootstraps a secondary BSD environment. Related to virtualization and recovery contexts.

gettySet terminal modes and present a login prompt on a serial line or console.

pboardThe pasteboard server — owns the clipboard and every named pasteboard. pbcopy and pbpaste talk to it.

Scheduling & background activity

macOS does not run background work when asked; it runs it when the system decides conditions are right — on power, cool, idle, on Wi-Fi. This is that machinery.

dasdDuet Activity Scheduler. The system's background-work broker: every NSBackgroundActivityScheduler and XPC activity is submitted here with constraints (requires power, requires network, must run daily) and dasd decides when. sudo launchctl print system | grep -A5 dasd, or better, log stream --predicate 'process=="dasd"' to watch it make decisions. The reason Time Machine, Spotlight indexing and software updates happen when you're plugged in.

coreduetdThe CoreDuet daemon — collects behavioural signals (what you use, when, where) into a local knowledge store that feeds prediction across the system.

duetexpertdThe prediction engine on top of that store — Siri Suggestions, proactive app launching, "you usually do this now."

powerexperiencedCoordinates the overall power experience — battery health management, optimised charging, and the policy decisions that trade performance for battery life.

powerdatad · powerlogHelperdCollect and store the fine-grained power accounting that Battery Usage in System Settings displays.

PerfPowerServices · PerfPowerServicesExtended · perfpowermetricdMaintain the structured log archives of system power and performance data that Apple's tools (and, with permission, third parties) can retrieve.

thermald · thermalmonitordThermal management: read the sensors, apply pressure levels, and tell the system to throttle before anything melts.

peakpowermanagerdManages instantaneous peak power draw — prevents a burst of CPU, GPU and storage activity from exceeding what the power supply or battery can deliver, which matters most on laptops with small adapters.

warmd · warmd_agent"Warming" — prefetch and pre-launch work that makes frequently-used apps start faster.

mmaintenancedManages kernel and runtime tuning parameters, adjusting them as conditions change.

jetsam_prioritySets the jetsam priority bands — the ordering in which processes are killed when memory runs out. Higher-priority processes (the frontmost app, the WindowServer) die last.

sysmond · systemstats_bootThe system monitor daemon that collects resource statistics, and the boot-time initialiser for the statistics database.

tmp_cleaner · dirs_cleaner · dirhelperRemove aged content from /tmp; clean out designated directories; and create the per-user temporary and cache directories with correct permissions (the /var/folders/xx/… paths).

watchdogdThe software watchdog — if the system stops responding at a low level, this triggers a reset so the machine reboots rather than hanging.

Logging, telemetry & crash reporting

logdThe unified logging daemon. Receives every os_log message on the system, compresses and stores it in /var/db/diagnostics, and serves queries from log show. Handles hundreds of thousands of messages per minute on a busy machine.

logd_helper · logd_reporterPrivileged helper and the component that packages log data for reporting.

diagnosticdServes live log streaming to clients — what log stream and Console.app connect to.

enhancedloggingdManages the temporary "enhanced logging" profiles Apple support asks you to install to capture verbose data for one subsystem.

symptomsd · symptomsd-diag · symptomsd-distributedThe Symptoms framework — continuously watches network and system behaviour for anomalies ("this Wi-Fi network has no internet", "this app is using excessive data") and drives the resulting UI and remediation.

DumpPanic · DumpPanicRecoveryOSExtract the kernel panic log from NVRAM after a crash and write it to /Library/Logs/DiagnosticReports. The RecoveryOS variant does the same from the recovery environment.

ReportMemoryExceptionGenerates the diagnostic report when a process is killed for exceeding its memory limit.

gkreportReports Gatekeeper events — what was blocked and why.

tailspindThe daemon side of tailspin, maintaining the rolling system-activity buffer.

spindump_agentThe per-session agent that spindump uses to gather user-space data.

sysdiagnosed · sysdiagnose_helperThe daemon and privileged helper that run a sysdiagnose collection.

corecapturedCaptures wireless and driver-level diagnostic data into /Library/Logs/CrashReporter/CoreCapture when a driver reports a problem.

microstackshotAggregates lightweight, continuously-sampled call graphs — a low-overhead system-wide profiler that runs all the time so that after-the-fact analysis is possible.

metrickitdCollects and vends the per-app performance metrics that MetricKit delivers to developers — launch times, hangs, memory, energy.

signpost_reporterReports os_signpost interval telemetry.

rtcreportingdDiagnostics and usage reporting for real-time communications.

audioanalyticsd · inputanalyticsd · wifianalyticsd · usbctelemetrydSubsystem-specific analytics collectors: audio, keyboard and trackpad input, Wi-Fi, and USB-C. All feed the "Share Mac Analytics with Apple" pipeline.

securityuploaddUploads keychain and security subsystem metrics.

feedbackdBacks the Feedback Assistant — gathers the attachments a feedback report needs.

diagnosticextensionsd · diagnosticspushdHosts diagnostic extensions, and handles push-triggered diagnostic collection (Apple can ask an enrolled device to gather data).

proactived · proactiveeventtrackerdCollect and periodically upload aggregate behavioural metrics used to improve proactive suggestions.

endpointsecuritydManages the userspace components of the Endpoint Security subsystem — the supported API that security vendors use instead of kernel extensions, and what eslogger reads.

managedeventsdAn Endpoint Security client used for device management — reports the events MDM policies care about.

Security & code integrity

amfidApple Mobile File Integrity daemon. The userspace arbiter of code signatures. Every time the kernel executes a page of code it can't validate from a trust cache, it asks amfid. Kill it and the system stops being able to launch anything.

syspolicydThe system policy daemon — Gatekeeper, notarization checks, quarantine handling and the assessment database in /var/db/SystemPolicy. spctl is its client.

trustd · trustdFileHelperPerforms every certificate trust evaluation on the machine, and its file helper. Also maintains the pinned-certificate and CT policy data.

secdThe centralised keychain agent — the per-user daemon that actually holds and syncs keychain items. Its sibling securityd_system handles the system keychain.

xprotectdRuns XProtect malware scans on files as they're opened and on demand, and performs remediation when a known-bad signature matches.

endpointsecuritydManages Endpoint Security clients — the supported hook API for security products.

transparencyd · transparencyStaticKeyKey Transparency — the cryptographic append-only log that lets iMessage and iCloud verify that Apple hasn't substituted a different key for a contact. The static-key daemon pins the log's own verification keys.

swtransparencydSoftware Transparency — the equivalent log proving that the software binaries Apple served you are the same ones everyone else got.

cryptexdManages cryptexes — mounting, verifying and updating the sealed disk images that carry Safari, Rapid Security Responses and some system components.

security_authtrampolineThe trampoline that AuthorizationExecuteWithPrivileges uses to run a tool as root after an authorization prompt. A classic privilege-escalation target, and now heavily restricted.

security-checksystemValidates the system keychain's integrity.

cc_fips_testRuns the FIPS 140 self-tests on corecrypto at boot. If these fail, cryptography is disabled and the system won't come up — which is the point of the certification.

prng_seedctlLoads and updates the kernel's random-number generator seed file across reboots, so entropy isn't lost at shutdown.

misagentManages provisioning profiles — installing, validating and removing the .mobileprovision files that authorise development and enterprise builds.

mobileactivationdHandles device activation — the exchange with Apple's servers that produces the activation record proving this device is legitimately owned. Also involved in Activation Lock.

frauddefensedFraud detection for Apple services — App Store and Apple Pay abuse signals.

coreidvdManages identity-verification operations — the ID document verification flow for Apple Wallet and Apple Pay.

Keys, keychain & the Secure Enclave

seputilSecure Enclave utility — the interface for querying and managing SEP state. The Secure Enclave is a separate processor with its own OS; this is one of the few ways to talk to it.

seservicedThe Secure Element service daemon — manages the NFC secure element that holds Apple Pay cards and keys.

seldSecure element manager daemon — the higher-level coordinator over seserviced.

applekeystoredKeybag management. The keybag holds the class keys that protect files under Data Protection; this daemon unlocks and locks them as the device locks and unlocks.

keybagdThe other half of keybag handling — creates and maintains the keybags themselves.

KeychainStasherTemporarily stashes the keychain unlock key across an authenticated restart — the mechanism that makes fdesetup authrestart possible.

kcproxyKeychain proxy — brokers keychain access across security boundaries.

keychainsharingmessagingdThe messaging transport for iCloud Keychain syncing between devices in a trust circle.

ciphermldSupports private information retrieval and private set intersection workflows — the cryptographic protocols behind features like Safari's Safe Browsing lookups and stolen-password checks, which query a server without revealing what you asked.

fairplaydeviceidentitydManages the FairPlay device identity used for DRM-protected content.

filevaultd · FDERecoveryAgentThe FileVault daemon, and the agent that transmits a recovery key to an institutional escrow server for managed Macs.

chkpasswdVerifies a user's password against the various authentication systems — used by services that need to confirm a password without a full login.

Privacy, advertising & accounts

tccdThe TCC daemon — enforces every privacy consent decision on the system. When an app asks for camera, microphone, screen recording, contacts, or full disk access, tccd shows the prompt and records the answer in ~/Library/Application Support/com.apple.TCC/TCC.db. (Runs from /System/Library/PrivateFrameworks rather than libexec, but belongs in this list.)

adprivacydAdvertising privacy — manages the advertising identifier, the "Personalized Ads" setting and its opt-out.

dprivacydDifferential privacy — adds calibrated noise to metrics before they leave the device, so Apple can learn aggregate patterns without learning about you.

appleaccountdManages Apple Account (Apple ID) state — sign-in, tokens, the account's services and their entitlements.

appleidsetupdDrives the Apple ID setup flow during first boot and when adding an account.

online-auth-agentPerforms online authentication challenges on behalf of system services.

icloudmailagent · icloudwebdiCloud Mail account handling, and the daemon backing iCloud's web-facing integration (including Hide My Email and iCloud web sign-in).

swcdShared Web Credentials — validates the apple-app-site-association files that authorise universal links and password sharing between an app and its website. swcutil is its client.

usermanagerd · usermanagerhelperManage user sessions, fast user switching, and Screen Time / managed-user policy.

studentd · assessmentagentThe Classroom app's student agent, and the coordination agent for Assessment Mode — the locked-down state a Mac enters during a proctored exam.

Storage & filesystems

diskarbitrationdThe volume traffic controller. Every disk that appears or disappears goes through it: probe the filesystem, decide whether to mount, pick a mount point, notify interested clients, and give apps a chance to veto an unmount. This is why diskutil unmount succeeds where umount reports "resource busy" — it asks politely first.

apfsdThe APFS volume manager daemon — handles container-level operations, space management between volumes, and snapshot maintenance.

corestoraged · corestoragehelperdThe CoreStorage volume manager and its helper. CoreStorage predates APFS and still backs Fusion Drives and legacy encrypted HFS+ volumes.

storagekitdThe helper behind the StorageKit framework — the modern API that Disk Utility and diskutil use for partitioning, formatting and RAID.

diskmanagementstartupRuns at boot to bring the DiskManagement framework's view of storage into a consistent state.

diskimagesiodHandles I/O for attached disk images — the userspace backing store behind a mounted .dmg or sparsebundle.

fskitd · fskit_agent · fskit_helperFSKit — the framework that lets a filesystem be implemented as a userspace extension rather than a kernel extension. The daemon manages mounts, the agent supports third-party extensions, and the helper does the privileged work. This is the future of filesystem support on macOS.

autofsd · automountdThe autofs daemons — mount network filesystems on first access according to /etc/auto_master. What makes /net/host/share work and network home directories mount at login.

od_user_homesAn autofs executable map that synthesises auto_home entries from OpenDirectory user records — so a network user's home directory mounts automatically at the right path.

mount_urlMount a remote filesystem given a URL, dispatching to the right protocol handler. What "Connect to Server" calls.

MobileStorageMounter · mobile_storage_proxyMount storage for the mobile-device subsystem — used when a Mac hosts an iOS device's filesystem, and in virtualization contexts.

mobile_obliteratorPerforms the secure erase that "Erase All Content and Settings" triggers — destroys the encryption keys so all data becomes unrecoverable instantly.

applessdstatistics · StorageDEHelperCollect SSD wear, health and performance statistics from the storage controller.

NANDTaskScheduler · ASPCarryLogPeriodically refresh data on NAND flash to prevent charge decay in rarely-read blocks; and log NAND I/O patterns on selected devices. Both are flash-longevity maintenance you never see.

NVMeAgent · scsidAgents for NVMe devices and the SCSI subsystem — handle device-level events, errors and firmware interactions.

rpc.rquotadServes quota information to NFS clients.

wfs/webdavsharing_mapper · webdavsharing_virtual_rootWebDAV file sharing internals — map shares into a virtual root the server exposes.

Network core

configdThe System Configuration daemon. Owns the dynamic store — the live database of network interfaces, IP addresses, DNS settings, proxies, and which interface is primary. Loads plugins for IPv4/IPv6 configuration, DNS, Kerberos, PPP and more. Every network change on the Mac is mediated by configd, and scutil is how you read its mind.

nehelper · neagent · nesessionmanagerThe Network Extension trio: the helper that brokers configuration and entitlement checks, the host process that runs third-party VPN and content-filter plugins, and the session manager that starts and stops them. Every modern VPN client on macOS is a Network Extension running inside neagent.

networkserviceproxyThe transparent proxy for Apple's own service traffic — and the component behind iCloud Private Relay's first hop.

nsurlsessiondPerforms background NSURLSession transfers on behalf of apps — downloads that continue after the app quits, with system-managed retry and scheduling.

bootpdThe DHCP and BOOTP server. Enabled by Internet Sharing, and used for NetBoot/NetInstall.

dhcp6dStateless DHCPv6 server, for handing out DNS servers over IPv6 while addresses come from router advertisements.

natpmpdNAT Port Mapping Protocol daemon — lets devices behind the Mac's Internet Sharing request port forwards. Apple's alternative to UPnP.

InternetSharingThe Internet Sharing service — bridges one interface to another, brings up bridge100, and starts bootpd and natpmpd.

pfdConfigures the packet filter and NAT rules on behalf of firewall and sharing settings — the daemon that writes what pfctl then enforces.

ftp-proxyAn FTP proxy for use with the packet filter, so active-mode FTP works through NAT.

captiveagentDetects captive portals — the hotel and airport Wi-Fi networks that intercept your traffic — and pops the Captive Network Assistant window. It works by fetching a known URL and checking whether the response is what it should be.

nlcdThe Network Link Conditioner daemon — applies artificial latency, loss and bandwidth limits.

srp-mdns-proxyService Registration Protocol to mDNS proxy — lets constrained devices (Thread and Matter accessories) register services into Bonjour without speaking full mDNS.

nexusdManages Skywalk "nexus" instances — the channels through which userspace networking datapaths connect to drivers.

tftpd · kdumpd · ntalkd · pcapdThe TFTP server; a remote kernel core dump receiver; the network talk daemon; and the packet capture helper that lets tools capture without being root themselves.

netbootdisk · bootinstalldFind a local disk to use as a NetBoot shadow, and run boot-time installation steps — the phase of a macOS update that happens before the desktop appears.

Remote access & device pairing

remoted · remotectlThe Remote Service Discovery daemon and its command-line client. remotectl list shows every paired and connected Apple device — including devices attached over USB and over the network — with their properties and available services. This is the modern replacement for the old lockdownd/usbmux path, and it's how Xcode finds an iPhone.

rpmuxd(In /Library/Apple/usr/libexec.) The remote port multiplexer — tunnels service connections to attached devices.

notification_proxyForwards notifications between a Mac and an attached device.

dtfetchsymbolsdCopies symbol caches off a connected device so the Mac can symbolicate its crash logs. Runs once per new iOS version, and takes a while.

testmanagerdCoordinates XCTest runs on a device or simulator — the daemon Xcode's test runner talks to.

devicerecoverytoolDrives device recovery and DFU restore from the Mac side.

mobilerepaird · corerepairdSupport the Self Service Repair and authorised repair flows — part validation and configuration after a component swap.

remotesoftwareupdatedHandles updating a connected device (an Apple Watch, an iPhone during setup) from the Mac.

remotecompositorclientdClient for remote display compositing — used by Sidecar, screen sharing and continuity display features.

AppleQEMUGuestAgent · AppleVirtualPlatformHIDBridgeGuest-side agents for running macOS inside a virtual machine: QMP command support, and bridging keyboard and mouse from the host into the guest.

rvictl(In /Library/Apple/usr/bin.) Remote Virtual Interface — creates a virtual network interface on the Mac that mirrors a connected iOS device's traffic, so you can tcpdump an iPhone. rvictl -s <udid> then capture on rvi0. Extremely useful and almost unknown.

Continuity, sharing & proximity

The features that make Apple devices work together are implemented by a dozen small daemons talking over Bluetooth LE, AWDL (Apple Wireless Direct Link) and iCloud.

sharingdThe Continuity workhorse. Runs AirDrop, Handoff, Instant Hotspot, Universal Clipboard, Shared Computers and Remote Disc. If AirDrop stops seeing devices, killall sharingd is the fix.

rapportdThe Rapport daemon — the low-level device-to-device link (over BLE and AWDL) that Continuity features are built on. Handles discovery, pairing and the encrypted transport.

nearbydThe proximity daemon — computes how close other devices are, using BLE signal strength and, on hardware with a U1/U2 chip, ultra-wideband ranging. Drives Handoff prompts, AirDrop proximity and precision device finding.

companiondManages the relationship with a paired companion device — an Apple Watch or iPhone — including Auto Unlock and Apple Watch approval prompts.

mediacontinuityd · ContinuityCaptureAgentContinuity media features, and Continuity Camera specifically — using an iPhone as the Mac's webcam, including Desk View and Center Stage.

SidecarDisplayAgent · SidecarRelaySidecar — using an iPad as a second display. The display agent presents the virtual display; the relay carries the video and touch events.

AirPlayXPCHelperSupports AirPlay sending and receiving — display mirroring and audio streaming.

avconferencedThe FaceTime and audio/video conferencing daemon — call setup, media negotiation and the connection to Apple's relay infrastructure.

replaydSupports ReplayKit — screen recording and broadcasting from apps and games.

wifip2pdManages peer-to-peer Wi-Fi (AWDL) discovery and data links — the direct device-to-device Wi-Fi that AirDrop and AirPlay use without an access point.

wifivelocitydBacks the WiFiVelocity framework — Wi-Fi performance measurement and the wireless diagnostics reports.

bubbledHandles the notification "bubbles" for incoming calls and similar transient overlays.

ptpcameradThe PTP camera daemon — talks to digital cameras over Picture Transfer Protocol so Image Capture and Photos can import from them.

nfcdThe NearField daemon — NFC on Macs with the hardware, used for Apple Pay on some models and for accessory provisioning.

atcrtcommCommunication with the Apple Type-C real-time controller.

Find My & location

locationdThe location services daemon. Fuses Wi-Fi scanning, Bluetooth beacons, cell towers and GPS into a position, and enforces the per-app location permissions. Everything on the Mac that knows where you are asks this process.

locationaccessstoredStores the record of which apps accessed location and when — the data behind the location-access indicators and privacy reports.

searchpartyd · searchpartyuseragentThe Find My network — the crowd-sourced mesh where every Apple device anonymously reports the rotating BLE identifiers it hears. This is what lets a lost, offline MacBook still be located. Cryptographically designed so Apple can't tell who found what.

findmydeviced · findmydevice-user-agentThe Find My Device service — remote lock, erase, play sound, and Activation Lock enforcement.

findmybeaconingdMakes this Mac emit the Find My beacons that other people's devices will report.

findmylocateagentThe per-user agent that handles locate requests and shows the resulting UI.

routinedLearns your significant locations — where you are habitually and when — to drive predictions like "you usually leave for work now". Data stays on device and is end-to-end encrypted if synced.

milodMicroLocation — fine-grained indoor positioning using BLE and UWB, for things like knowing which room a HomePod is in.

countrydDetermines the country the device is in and publishes it through RegulatoryDomain.framework — which governs Wi-Fi channel legality, feature availability and radio power limits.

Machine learning & intelligence

A decade of quiet accumulation. Note the compiled .mlmodelc bundles sitting directly in /usr/libexec — battery-drain predictors, engagement models, a CJK recipe model — models shipped as part of the OS rather than downloaded.

aned · aneuserdThe Apple Neural Engine daemons — schedule and arbitrate access to the ANE hardware between processes, and manage compiled model loading. On Apple silicon the ANE is a separate 16-core accelerator; nothing reaches it except through these.

mlhostd · mlruntimedHost processes that run machine-learning models out-of-process, so a crash or a memory spike in a model doesn't take an app down.

modelmanagerdManages the on-device model catalog — which models are installed, downloading new ones, evicting unused ones. modelcatalogdump reads its state.

naturallanguagedThe Natural Language framework's daemon — tokenisation, language identification, named entity recognition, sentiment, and the post-editing that improves dictation output.

textcomposerdPowers generative writing features — the Writing Tools that rewrite, summarise and proofread.

textunderstandingd · textcontextdText understanding, and the contextual model that knows what's on screen so features can act on it.

handwritingdHandwriting recognition — Scribble input and recognising handwriting in scanned images and Notes.

siriknowledgedSiri's on-device knowledge store — the entity graph it answers questions from.

knowledge-agentThe CoreDuet knowledge store agent — accumulates the events and relationships that prediction runs on.

spotlightknowledged.graph · .importer · .updaterThree processes building the Spotlight knowledge graph: the graph store, the importer that ingests new items, and the updater that keeps it current. This is what makes Spotlight answer questions rather than just match filenames.

ospredictiond · sensingpredictdPredict OS-level conditions (when you'll next charge, when the machine will be idle); and run the sensing models for AirPods and audio accessories — in-ear detection, head tracking, conversation awareness.

attentionawarenessdAttention awareness — using the camera to tell whether you are looking at the screen, so the display doesn't dim and notifications can behave differently.

intelligentroutingdRecommends how to route traffic (Wi-Fi versus cellular versus wired) based on learned historical patterns. The iRATBW.mlmodelc model in /usr/sbin feeds this.

triald · triald_systemApple's Trial framework — the on-device A/B testing and feature-rollout system. Decides which experimental configurations this machine receives. triald is why two identical Macs can behave differently.

eligibilitydComputes feature availability — whether this device, in this country, with this account, is eligible for a given feature. Apple Intelligence availability is decided here.

biomesyncd · BiomeSyncBiome — the on-device event stream that records user activity in a structured, syncable form and feeds Siri Suggestions and Focus. The sync daemon replicates it across your devices end-to-end encrypted.

duetexpertd · coreduetd · proactivedThe prediction and suggestion stack described in the scheduling card.

relatived · griddatad · datastored · coredatadRelative-motion sensing; grid data services; the generic data store daemon; and the daemon that handles CloudKit syncing for Core Data + CloudKit apps.

linkd · remindd · sportsd · tipsd · promotedcontentd · videosubscriptionsdApp Intents link handling; Reminders sync; sports scores and Live Activities; the Tips app's content; promoted App Store content; and TV app channel subscriptions.

DataDetectorsLocalSources · DataDetectorsSourceAccessData Detectors — the code that finds dates, addresses, flight numbers and phone numbers in arbitrary text and offers actions on them.

Display, graphics & audio

corebrightnessd · corebrightnessdiagDisplay brightness, auto-brightness from the ambient light sensor, True Tone, and Night Shift scheduling. Its diagnostic tool collects the sensor and calibration state.

colorsyncd · colorsync.displayservicesColorSync — profile matching for every window, and per-display profile and calibration management.

displaypolicydDecides which GPU drives which display, and manages automatic graphics switching on machines with more than one GPU.

kcgendCore Graphics kernel event generation — synthesises input events into the window server's event stream.

TouchBarServerRenders the Touch Bar. Present on every Mac even though only some laptops had one.

IOMFB_bics_daemonBacklight and internal-display calibration for the Mobile Framebuffer driver — panel-specific correction data.

dp2hdmiupdaterUpdates the firmware of DisplayPort-to-HDMI converter chips.

gputoolsservicedServes the Metal GPU debugger and frame capture in Xcode.

MTLAssetUpgraderDUpgrades compiled Metal shader assets when the GPU driver or Metal version changes, so shipped shader caches remain usable.

swiftuitracedCollects SwiftUI tracepoints for Instruments' SwiftUI profiling.

audiomxdThe Core Audio media experience daemon — spatial audio rendering, head tracking, and the personalised HRTF profiles.

micactivitydTracks microphone activity — what drives the orange dot in the menu bar and the privacy indicators.

historicalaudiodRetains historical audio state for Core Audio, so device and routing preferences persist correctly.

audioclocksyncdPrecision Time Protocol clock synchronisation for networked audio.

cameracapturedManages camera capture sessions and arbitrates between clients wanting the camera.

com.apple.cmio.videodriverkithostextension.systemextensionThe host for DriverKit-based virtual camera extensions — how third-party virtual cameras (OBS, Zoom's, Continuity Camera) plug in without a kext.

Input, HID & accessories

hiddThe HID daemon — the userspace half of keyboard, mouse, trackpad and game controller handling. Applies key remapping, modifier behaviour and the accessibility input options.

keyboardservicesdText input services — autocorrect, text replacement, the emoji picker's data, and dictation input routing.

gamecontrollerd · gamecontrolleragentdDiscover, pair and manage game controllers — Xbox, PlayStation and MFi — and expose them through the GameController framework.

biometrickitdThe Touch ID daemon — enrolment, matching, and the attempt-counter handling. Actual template matching happens in the Secure Enclave; this daemon only orchestrates.

aonsensed · alwaysonexclavesdAlways-on sensing (the low-power processor that listens for "Hey Siri" and monitors motion), and the host for the always-on Exclave — the isolated secure environment that owns direct access to the camera and microphone hardware on recent Apple silicon.

arkitdThe ARKit daemon — scene understanding, tracking and the sensor fusion behind AR features.

ioupsdTracks a connected UPS over USB and reports its state; triggers upsshutdown on low battery.

usbnotificationagent · usbpowerdNotify the user about accessory problems ("USB accessory disabled", "cable not supported"); and manage Apple's Extra Power Protocol so devices can draw more than standard USB allows.

retimerdManages the USB-C retimer chips that clean up high-speed signals on long cables.

x11-selectSelects which X11 server to use when one is installed. Apple stopped shipping X11 in 2012; the stub remains.

Firmware updaters

A modern Mac contains a dozen or more separately-flashable processors. Each of these keeps one of them current — usually silently, during a macOS update.

uarpd · uarphidd · uarppersonalizationd · uarpassetmanagerdUARP — Apple's Update And Restore Protocol for accessories. Four daemons: the general device manager, the HID-accessory specialist (Magic Keyboard, Magic Mouse), the personalisation service that signs firmware for a specific device so it can't be rolled back, and the asset manager that fetches the payloads. This is how your AirPods and keyboard get firmware updates without you noticing.

smcupdater · smcDiagnoseUpdate and diagnose the System Management Controller — the chip that handles power, thermals, fans and sleep. On Apple silicon its role folded into the main SoC, but the tooling remains.

efiupdater · efi-dump-logsUpdate the EFI/iBoot firmware, and extract its logs after a boot failure.

FirmwareUpdateLauncher · firmwaresyncdLaunch a pending firmware update at the right moment in the boot sequence; and keep the files the firmware reads in sync with the OS.

sdfwupdater · ssdupdater · psfupdaterUpdate the firmware of the SD card reader, the internal SSD controller, and the power supply.

vbiosupdaterUpdate a discrete GPU's video BIOS.

usbcupdaterUpdate the USB-C subsystem's firmware.

wifiFirmwareLoaderLoad firmware into the Wi-Fi chip at boot — the Wi-Fi controller has no persistent storage of its own.

ucupdateCPU microcode update, on Intel Macs.

msutil · MSUEarlyBootTaskMobile Software Update utility and its early-boot task — the machinery that applies an OS update during the boot phase, before the desktop exists.

xartstorageremotedServes remote storage for xART, the Secure Enclave's anti-replay counter store.

Software update & asset delivery

mobileassetd · MobileAssetEarlyBootTaskThe asset delivery system. Almost everything macOS downloads outside of a full OS update is a "Mobile Asset": dictionaries, Siri voices, ML models, XProtect definitions, timezone data, font packs, Rosetta. This daemon fetches, verifies and installs them. ls /System/Library/AssetsV2 to see what's arrived.

assetsubscriptiondDecides which assets this configuration needs and subscribes to them — so the right dictionaries and voices arrive when you add a language.

languageassetdManages language-specific assets specifically — keyboards, dictionaries, speech data.

backgroundassets.userSupports the Background Assets framework, which lets third-party apps download large content packs outside the App Store download.

AssetCache · AssetCacheAgentThe Content Caching service — cache Apple downloads locally and serve them to other devices on the network. A directory here holds the service and its Core Data model.

inboxupdaterd · multiversed · NRDUpdatedHandle staged updates: process incoming update packages, manage multiple concurrent OS versions during an update, and the Network Recovery on Disk updater that keeps the local recovery environment current.

audinstaller · installer-core · productutilAudio component installation; the privileged installer helper; and the product archive utility.

betaenrollmentd · betaenrollmentagentThe Seeding framework — enrolling in and leaving the public beta and developer beta programmes.

tesladA software-update-related daemon (the name is an internal project name, not the car company).

managedeventsdReports Endpoint Security events that management policies subscribe to.

CSCSupportd · sysstatuscheckCore System Check support and the system status checker — verify that the system's own components are intact and correctly configured.

Directory, time & localisation

opendirectorydThe directory services daemon — local database, LDAP, Active Directory and the module architecture that unifies them. Every user lookup, group check and authentication on the Mac goes through it.

odproxyd · dspluginhelperdProxy directory requests to a remote node; and host legacy DirectoryService plugins that predate OpenDirectory.

slapd · slapconfig-keygenThe OpenLDAP server backing the local directory, and the key generator for its replication.

checkLocalKDC · configureLocalKDC · migrateLocalKDCVerify, create and migrate the per-machine Kerberos KDC.

timedThe time synchronisation daemon. macOS uses this rather than ntpd; it disciplines the clock against time.apple.com and adjusts for network conditions.

tzd · tzinit · tznotify · tzlinkdTimezone handling: the daemon that determines the current zone (from location if enabled), the boot-time initialiser, the change notifier, and the link daemon that resolves zone aliases.

ifcstartRebuilds the international data caches — locale, collation and formatting data — after a language or region change.

makewhatis · makewhatis.localRebuild the man page search database. Run sudo /usr/libexec/makewhatis after installing man pages by hand.

locate.updatedb · locate.bigram · locate.code · locate.mklocatedb · locate.concatdbThe five programs that build the locate database: walk the filesystem, compute bigram frequencies, apply the front-compression encoding, assemble the database, and concatenate several together. Disabled by default on macOS.

path_helperBuilds PATH and MANPATH from /etc/paths, /etc/paths.d/ and their manpath equivalents. Invoked from /etc/zprofile at every login.

java_homeLocate installed JDKs. /usr/libexec/java_home -V.

Games

gamepolicyd · GamePolicyAgentGame Mode. When a game goes fullscreen, these give it priority access to the CPU's performance cores and the GPU, and double the Bluetooth sampling rate for controllers and AirPods to cut input and audio latency. The agent handles the UI side.

gamedThe Game Center daemon — accounts, achievements, leaderboards and multiplayer matchmaking.

gamesavedManages saved-game synchronisation through iCloud.

gamecontrollerd · gamecontrolleragentdController discovery and management. See the input card.

GKCentralCache.momdThe Core Data model for Game Center's local cache — a data file, not a program.

Rosetta

In /usr/libexec/rosetta. Rosetta 2 translates x86-64 code to arm64 — ahead of time when an app is first launched, and just-in-time for code that's generated at runtime. It is not installed by default; softwareupdate --install-rosetta fetches it.

oahdThe Rosetta daemon. "OAH" is the internal codename. It manages the translation cache in /var/db/oah — once a binary has been translated, subsequent launches reuse the result, which is why the second launch of an Intel app is so much faster than the first.

oahd-helper · oahd-root-helperUnprivileged and privileged helpers for the translation process.

translate_toolThe ahead-of-time translator itself — converts an x86-64 Mach-O into an arm64 one.

runtimeThe runtime support library injected into every translated process, handling JIT translation, memory ordering (Apple silicon has a hardware total-store-ordering mode enabled specifically for Rosetta) and x87 floating point.

debugserverA Rosetta-aware debug server, so lldb can debug translated processes.

oah(In /Library/Apple/usr/libexec.) The Rosetta support directory outside the sealed system volume.

SSH, automation & leftovers

sshd-session · sshd-auth · sshd-keygen-wrapper · sftp-server · ssh-keysign · ssh-pkcs11-helper · ssh-sk-helper · ssh-apple-pkcs11OpenSSH's privilege-separated helpers: the per-connection session and authentication processes, the wrapper that generates host keys on first start, the SFTP subsystem, the host-based authentication signer, the PKCS#11 smartcard helper, the FIDO security-key helper, and Apple's own PKCS#11 module for Secure Enclave-backed SSH keys.

reset-ssh-configurationRestore the SSH configuration to Apple's defaults.

automation_trampoline · attach_automation_image · create_automation_image_overlayInfrastructure for running automated tests at boot from a disk image: attach the image, overlay its content, and trampoline into the test harness. Apple's internal CI machinery, shipped by accident or design.

osaappletThe interpreter that runs an AppleScript applet — the stub inside every .app produced by osacompile -o.

PlistBuddyRead and write plists with a path syntax. See the preferences card.

MiniTerm.appA minimal terminal window used to show modem dialogue during a PPP connection. From the dial-up era, still shipping.

kuncdThe Kernel User Notification Center daemon — lets kernel code display an alert dialog to the user.

mc_notifier · mcxalrManaged Client notifications, and the application launch restriction agent that enforces "only these apps may run" policies.

dmd · toolkitd · tracd · nexusd · corercd · asktod · centauridA handful of small, entirely undocumented Apple daemons. corercd is Core Remote Control; the others have no public documentation at all. Good candidates for the codesign --entitlements trick.

rpcsvchostA hosting environment for DCE/RPC services — used by the SMB stack for the Windows-compatible RPC interfaces.

smb-sync-preferences · smb-migrate-preferencesSynchronise and migrate SMB server preferences across OS upgrades.

undoServerAppDNSPrefsReverts DNS preferences that macOS Server used to set. An upgrade-cleanup script that outlived the product.

wallpaperexportdExports wallpaper images — supports the dynamic and aerial wallpapers and their per-display rendering.

AdvancedCommandsMigratorMigrates saved advanced-command configurations across OS versions.

IOAccelMemoryInfoCollectorCollects GPU memory usage information for diagnostics.

apache2/ · cups/ · postfix/ · dtrace/ · swift/ · fax/ · TrustKitResources/ · SmartCardServices/Sub-hierarchies rather than programs. apache2 holds ~120 Apache modules; cups holds the printing filters, backends and CGI programs; postfix holds Postfix's internal daemons (smtpd, qmgr, cleanup, pickup, tlsproxy and two dozen more); dtrace holds Apple's own D scripts; swift holds swift-backtrace, the pretty crash-backtrace printer for Swift programs; fax holds a cover-page generator; SmartCardServices/drivers holds CCID reader drivers.

kernelmanagerd · kernelmanager_helperThe daemon that owns kernel extension and kernel collection management on Apple silicon — it is what kmutil and kextload actually talk to, and what decides that a reboot is required.

logkextloadsdRecords which kexts get loaded, and when, for audit and diagnostics.

MobileGestaltHelperHelper for MobileGestalt — the internal property database that answers "what device is this?" Device model, capabilities, serial number, region and hundreds of feature flags all come from it. Heavily used, entirely private.

PowerUIAgentDrives the power-related user interface — low battery warnings, the charging state in the menu bar, and Low Power Mode prompts.

lightsoutmanagementdLights-Out Management — remote power control of a headless Mac (originally an Xserve feature, retained for Mac mini and Mac Pro server deployments).

pmudiagnoseCollects diagnostics from the Power Management Unit.

amsdstatReports statistics from the Apple Media Services daemon — the App Store and media purchase infrastructure.

eoshostdHost process for the "EOS" subsystem — audio accessory firmware and feature support (the AirPods family).

xscertd · xscertd-helperThe macOS Server certificate signing daemon and its helper — issue and manage certificates for an Open Directory environment.

DuetActivityScheduler.momd · GKCentralCache.momd · AssetCache.momdCore Data managed object models — schema definitions, not programs. They describe the databases that dasd, Game Center and Content Caching keep.

*.mlmodelcFifteen compiled Core ML models sitting directly in /usr/libexec, not in a bundle: _OSDischargeETA, _OSHighBatteryDrain*, Prev12Next12Drain, shortDurationModel, longDurationModel, watch_duration, watch_engage, engageOnPlugin, dynamic_scheduling, freezer_app_ranking_model, xgb_last_lock_model, WiFiStallDetect, tte_v1, Recipe and Recipe_CJK. Battery-life prediction, background scheduling, app ranking and Wi-Fi stall detection — machine learning doing the OS's routine housekeeping.

Where the tools live

Path	Contents
Xcode.app/Contents/Developer/usr/bin	111 developer tools — build, package, test, simulate, sign, inspect. Xcode-specific.
…/Toolchains/XcodeDefault.xctoolchain/usr/bin	119 toolchain tools — clang, swift, the LLVM utilities, linkers, Mach-O editors. Swappable: you can install a Swift.org toolchain alongside.
…/Platforms/{iPhoneOS,AppleTVOS,WatchOS,XROS}.platform/usr/bin	Per-platform helpers for each SDK.
/Library/Developer/CommandLineTools/usr/bin	137 tools — the same toolchain without the IDE, installed by `xcode-select --install`. Version-stamped separately from Xcode; `pkgutil --pkg-info=com.apple.pkg.CLTools_Executables` reports it.

The stubs in /usr/bin — clang, git, make, swift, lldb and about eighty others — are a few kilobytes each and simply forward here.

Build, test & simulate

simctlThe simulator's entire control surface. xcrun simctl list shows every runtime and device; boot, shutdown, erase; install and launch an app; openurl to test deep links; push to deliver a fake push notification from a JSON file; io booted screenshot out.png and recordVideo; privacy booted grant location com.foo; status_bar override to force the 9:41 screenshot bar. Indispensable for CI.

xcdeviceEnumerate and manage connected devices and simulators as JSON — what Xcode's device picker is built on. xcrun xcdevice list.

devicectlThe CoreDevice command-line tool: pair, inspect, install, launch, capture diagnostics from a physical device. Replaced the older private device tooling.

xctestThe test runner binary that executes an .xctest bundle.

xccovRead code-coverage data out of an .xcresult bundle and report it as text or JSON. How you get a coverage percentage in CI.

xcresulttoolExtract anything from an .xcresult — test results, logs, attachments, screenshots, failure messages — as JSON. The programmable interface to a build's output.

xcodebuild · agvtool · xcdebugBuild and version; see the toolchain section.

scalarMicrosoft's Scalar, bundled with git — manages very large repositories with partial clone and sparse checkout.

make · gnumake · gitThe real binaries behind the /usr/bin stubs.

python3.9 · pydoc3 · pydoc3.9 · pip3.9 · 2to3 · 2to3-3.9Symlinks into Developer/Library/Frameworks/Python3.framework/Versions/3.9 — Python 3.9.6, still, and the thing /usr/bin/python3 resolves to once developer tools are installed. It exists for Xcode's build scripts; Apple says not to depend on it, and 2to3 was dropped from upstream Python in 3.13. Present in both the Xcode and Command Line Tools installs.

logdumpDump build and device logs.

xcdiagnoseCollect Xcode's own diagnostics for a bug report.

xcindex-testTest the source-indexing engine that powers Xcode's symbol navigation.

instrumentbuilderBuild custom Instruments packages — define your own analysis instrument from signposts and schema definitions.

Asset & resource compilers

momc · mapcCompile a Core Data model (.xcdatamodeld → .momd) and a mapping model for migrations. The .momd bundles you find in /usr/libexec were built by these.

actool · ibtool · ictool · ibtoold · assetutilAsset catalogs and Interface Builder documents. ibtool is a front end: it locates ibtoold, spawns it, and talks to it over pipes — ibtoold does the IDE initialisation and the actual compile, which is why ibtool errors sometimes read "ibtoold must have exited abnormally". See the toolchain section.

coremlc · coremlcompilerCompile a .mlmodel into the .mlmodelc the runtime loads.

createmlTrain Core ML models from the command line.

intentbuildercCompile SiriKit intent definitions into generated classes.

appintentsmetadataprocessor · appintentsnltrainingprocessor · appshortcutstringsprocessorExtract App Intents metadata, train the natural-language model that maps spoken phrases to intents, and process the shortcut phrase strings. This trio is what makes "Hey Siri, <do the thing> in MyApp" work.

xcstringstoolCompile and validate .xcstrings string catalogs — the modern replacement for .strings files.

extractLocStringsExtract localisable strings from source. The Xcode-side counterpart to genstrings.

metal · metal-package-builderCompile Metal shading language into .air and link it into a .metallib. The GPU compiler.

compileSceneKitShaders · copySceneKitAssets · scntoolSceneKit's shader compiler, asset copier and scene tool — convert and optimise .scn, .dae and related 3D assets.

TextureAtlas · TextureConverterBuild sprite atlases for SpriteKit, and convert textures into GPU-compressed formats (ASTC, PVRTC).

realitytool · referenceobjectc · referenceobjectcompilerProcess Reality Composer scenes and USD for RealityKit; and compile ARKit reference objects for object detection. referenceobjectc is a symlink to referenceobjectcompiler — the real binary.

copypng · pngcrushOptimise PNGs during a build, including Apple's iOS-specific premultiplied-alpha "CgBI" transformation.

doccThe DocC documentation compiler — build a documentation archive from Swift source and Markdown, the modern replacement for HeaderDoc.

snippet-extract · symbolgraph toolsExtract code snippets for documentation, and swift-symbolgraph-extract which emits the symbol graph DocC consumes.

Signing, packaging & distribution

notarytoolSubmit to Apple's notary service, wait for the result, and fetch the log: xcrun notarytool submit foo.zip --keychain-profile "AC" --wait. Store credentials once with store-credentials. Replaced altool's notarization mode and is dramatically faster.

altoolThe older Application Loader tool — upload builds to App Store Connect, validate them, and (legacy) notarize.

staplerAttach a notarization ticket. See the security section.

xcsigningtool · xarsignerSign build products, and sign a xar archive.

CreateIPA · ipatool · ipatool2Build and manipulate .ipa packages — the iOS app archive format.

iTMSTransporterThe iTunes Store transporter — a large Java application for uploading apps, metadata and media to Apple's stores. Predates App Store Connect's API and still underpins some of it.

appleProductTypesTool · embeddedBinaryValidationUtilityQuery the product-type definitions the build system uses; and validate that embedded frameworks and extensions inside an app bundle are correctly formed and signed. The second one catches the errors that cause an App Store rejection.

safari-web-extension-converter · safari-web-extension-packagerConvert a Chrome or Firefox WebExtension into a Safari App Extension project, and package it. The supported migration path for browser extensions.

ba-package · ba-serve · backgroundassets-debugBuild, serve and debug Background Assets packs — the framework for downloading large content outside the app download.

cktoolCloudKit's command-line tool — manage schemas, import and export records, and reset a development environment. cktool save-schema in CI keeps a CloudKit schema in version control.

iphoneos-optimizePost-process an iOS app bundle for shipping — strip and optimise plists and assets.

placeholderutilManipulate the placeholder app bundles the system uses while a real app downloads.

swinfo · compositeMD5 · amlintReport software information; compute a composite hash across a bundle; and lint asset manifests. Internal build-system helpers.

Toolchain: LLVM & Swift

The llvm-* tools are upstream LLVM's versions of Apple's classic Mach-O utilities. Apple is gradually replacing nm, otool, size and strings with them — the old ones survive as *-classic.

llvm-otool · llvm-nm · llvm-size · llvm-objdump · llvm-cxxfilt · llvm-dwarfdumpThe LLVM implementations. Behaviour is close but not identical to the classic tools — worth knowing when a script's output changes after an Xcode upgrade.

otool-classic · nm-classic · size-classic · ld-classicThe original Apple implementations, kept for compatibility. ld-classic in particular is the escape hatch when the new linker breaks a project.

llvm-profdata · llvm-covMerge raw profiling data from an instrumented build, and generate coverage reports from it. The pair behind profile-guided optimisation and coverage measurement.

llvm-readtapi · readtapi · tapi · tapi-analyzeTAPI — Text-based API. A .tbd file describes a dylib's exported symbols without containing any code, which is how SDKs ship "stub libraries" you can link against without shipping the real binary. These tools create, read and diff them.

clang-format · clang-format-diff.pyFormat C-family source to a style, and format only the lines a diff touches.

clang-stat-cache · clang-cache · clang-cas-test · llvm-cas · swift-cache-toolContent-addressable-storage caching for compilation — Apple's build-caching infrastructure, which lets identical compilations be reused across machines. swift-cache-tool is the Swift side, and a symlink to swift-frontend.

swift-frontend · swift-driverThe compiler's actual frontend, and the driver that decides which frontend jobs to run. swiftc is the friendly face.

swift-demangleTurn a mangled Swift symbol ($s4main3fooyyF) into readable form. Essential for reading Swift crash logs. Pipe output through it.

swift-package · swift-build · swift-test · swift-runSwift Package Manager's subcommands, invoked as swift package, swift build and so on. swift-package-collection and swift-package-registry are symlinks to swift-package (they back swift package-collection and swift package-registry), and swift-build-tool is the llbuild executor underneath them.

swift-api-digesterEmit a machine-readable description of a module's API, and diff two versions to find breaking changes. The tool for maintaining a stable library ABI.

swift-synthesize-interface · swift-helpGenerate the Swift interface that an Objective-C or C header maps to — what Xcode shows as "Generated Interface"; and the driver's help system.

swift-stdlib-toolCopy the correct Swift runtime libraries into an app bundle for back-deployment to older OS versions.

swift-formatThe official Swift code formatter and linter.

swift-plugin-serverHosts Swift macro implementations out-of-process during compilation — macros run as separate programs so a broken macro can't crash the compiler.

swift-sdk · swift-experimental-sdkManage cross-compilation SDKs — including the Linux musl SDKs whose clang config files sit alongside in this directory ({aarch64,x86_64}-swift-linux-musl-clang{,++}.cfg, four lines each: a -target triple and -rtlib=compiler-rt), letting a Mac build static Linux binaries.

iigThe DriverKit interface generator — compiles a .iig class definition into the C++ glue for a userspace driver. The modern successor to the kext class machinery.

dyld_analyzer · unwinddumpAnalyse dyld's behaviour on a binary; and dump the unwind tables that exception handling and backtraces depend on.

bitcode_strip · bitcode-build-toolRemove or rebuild LLVM bitcode embedded in a binary. Bitcode submission is deprecated, so these are on their way out.

modules-verifierVerify that a framework's headers are self-contained and can be built as a Clang module.

fmadapterc · fmadaptercompiler · exutil · cache-build-sessionInternal build-system components: adapter compilers and the build-session cache manager.

lldb-dapAn adapter exposing LLDB through the Debug Adapter Protocol, so VS Code and other editors can debug Swift and C++ natively.

crashlogAn LLDB command plugin that loads a macOS crash report and reconstructs a debuggable session from it.

gamepolicyctlControl Game Mode policy for testing — force it on or off for a process.

mcpbridgeA bridge for the Model Context Protocol, exposing Xcode capabilities to AI coding tools. A recent addition.

ssu-cli · ssu-cli-app · ssu-cli-nluSiri speech and natural-language-understanding command-line tools, used for testing intent recognition.

convertRichTextToAscii · agent · xcdebugSmall build-support utilities.

The Safari cryptex

/System/Cryptexes/App/usr/{bin,libexec}. Safari and WebKit ship as a sealed, signed disk image mounted at boot and grafted into the system paths — note that /System/Cryptexes/App/usr/bin is in your default PATH, ahead of /usr/bin. This lets Apple ship a Safari update, or an emergency Rapid Security Response, without touching the sealed system volume.

safaridriverThe WebDriver service for Safari. This is the copy that actually runs — it shadows the one in /usr/bin.

webinspectordThe Web Inspector daemon — brokers remote debugging connections between Safari's developer tools and a web page, including pages on a connected iOS device.

webpushdHandles Web Push notifications — the standards-based push API that lets a website send notifications to macOS without an app.

AuthenticationServicesAgentThe agent behind password autofill, passkeys and Sign in with Apple — the UI and coordination layer for the AuthenticationServices framework.

PasswordBreachAgentChecks saved passwords against known breach databases, using the private-information-retrieval protocols so Apple never learns your passwords.

SafariBookmarksSyncAgent · com.apple.Safari.History · SafariHistoryServiceAgentBookmark synchronisation, and the history store and its service agent.

SafariLaunchAgent · SafariNotificationAgentLaunch coordination, and the agent that delivers website notifications.

com.apple.passwordmanager.jsonNot a program: the native-messaging manifests in /System/Cryptexes/App/Library that let the iCloud Passwords extension in Chrome and Firefox talk to macOS.

/System/Cryptexes/OS holds the corresponding library cryptex — a second dyld shared cache and the Swift runtime libraries, so the language runtime can be updated with Safari's WebKit.

Apple, outside the seal

/Library/Apple/usr/ — an Apple-owned hierarchy on the writable Data volume, for components installed separately from the OS.

bin/rvictlRemote Virtual Interface. Creates a virtual network interface mirroring a connected iOS device's traffic so you can packet-capture an iPhone from the Mac: rvictl -s <device-udid>, then sudo tcpdump -i rvi0. One of the most useful undiscovered tools on the system.

libexec/oahRosetta's support directory. Rosetta is an optional download, so it cannot live on the sealed volume.

libexec/rpmuxdThe remote port multiplexer that carries service connections to attached devices.

Framework bins

Almost unheard of, but there is exactly one bin directory hidden inside a framework on a stock system.

oncrpc.framework/bin/rpcgenThe ONC RPC protocol compiler, shipped inside its own framework as well as in /usr/bin. Compiles an .x interface definition into C stubs.

Plenty of frameworks ship executables in Resources/, Support/, Helpers/ or XPCServices/ rather than bin/ — Spotlight's mds and mdworker, the Screen Sharing agent, tccd, WindowServer. Find them with find /System/Library/{Frameworks,PrivateFrameworks} -type f -perm -111, which turns up several thousand more programs than this reference covers.

Yours

2 + 1396

/usr/local/binThe one place in the traditional hierarchy that is yours. On the writable Data volume, firmlinked into /usr/local, unprotected by SIP, and first in the default PATH. Empty on a clean install; on this machine it holds aws and aws_completer.

/usr/local/sbinThe administrative counterpart. Often doesn't exist until something creates it.

/opt/homebrew/binHomebrew on Apple silicon — 1393 programs on this machine. The prefix moved from /usr/local to /opt/homebrew for arm64 so that Intel and Apple silicon installs can coexist. Because it is prepended to PATH, brewed curl, git, python3, openssl and grep shadow Apple's — usually what you want, occasionally the cause of a mystery.

/opt/homebrew/sbinThree entries here: php-fpm, and GnuPG's addgnupghome and applygnupgdefaults.

Other bin directoriesLanguage package managers scatter more: ~/.cargo/bin, ~/.local/bin, /Library/Ruby/Gems/*/gems/*/bin, /Library/Java/JavaVirtualMachines/*/Contents/Home/bin, and every Python virtualenv. None are part of macOS.

If you learn twelve commands, learn these

Command	Why
launchctl	Nothing on macOS starts, stops or stays running without launchd. `print`, `bootstrap`, `bootout`, `kickstart -k`.
log	The system narrates everything it does. `log stream --predicate` turns a mystery into an explanation.
codesign -dvvv --entitlements -	Tells you what a binary is allowed to do, which is usually a better description than its man page.
defaults / plutil / PlistBuddy	Read and write the configuration of everything.
fs_usage	Which file is it actually reading? Answered in ten seconds.
sample / spindump	Why is it slow? No instrumentation required.
diskutil	Every disk operation, with APFS containers modelled correctly.
mdfind / mdls	Instant content search, and the complete metadata of any file.
xattr	Quarantine flags, download provenance, and the invisible half of every file.
scutil --dns / --nwi	The real network configuration, as opposed to what `/etc` claims.
ditto	The only copy tool that preserves everything a Mac file carries.
pmset -g assertions	Why won't it sleep? Named, with the responsible process.

Recipes

What is this process doing?

sample PID 10 -f /tmp/s.txt # call tree, 10 secondssudo fs_usage -w -f filesys PID # every file it toucheslsof -p PID # what it has open right nowlsmp -p PID # which daemons it talks tolog stream --predicate 'processID == PID'

Why won't this app open?

spctl -a -vvv /Applications/Foo.app # Gatekeeper's verdictcodesign -dvvv /Applications/Foo.app # is it signed, and by whomxattr -l /Applications/Foo.app # quarantine flag present?xattr -dr com.apple.quarantine /Applications/Foo.applog show --last 5m --predicate 'subsystem == "com.apple.syspolicy"'

Where did my disk space go?

du -sh * | sort -h # per directorytmutil listlocalsnapshots / # APFS snapshots hiding spacetmutil deletelocalsnapshots <date>diskutil apfs list # per-volume reserve and quotamdfind 'kMDItemFSSize > 1000000000' # every file over 1 GB

What is this Mac doing to my battery?

sudo powermetrics --samplers cpu_power,tasks -i 5000 -n 3pmset -g assertions # who is blocking sleeppmset -g log | grep -i wake # wake history with reasonssudo timerfires # who wakes the CPU, and how often

What is on my network?

dns-sd -B _services._dns-sd._udp # every service type advertiseddns-sd -B _airplay._tcp # then browse onenettop -P # bandwidth per processnetworkQuality -v # real responsiveness, not just speedsudo wdutil info # complete Wi-Fi state

Investigate an unknown daemon

man 8 foo; strings -a /usr/libexec/foo | grep -i usagecodesign -d --entitlements - /usr/libexec/foootool -L /usr/libexec/foo # frameworks ⇒ subject areagrep -rl foo /System/Library/Launch* # its launch conditionssudo launchctl print system/com.apple.foo

Package a Mac app correctly

codesign -f -s "Developer ID Application: …" --options runtime --timestamp -v Foo.appditto -c -k --sequesterRsrc --keepParent Foo.app Foo.zipxcrun notarytool submit Foo.zip --keychain-profile AC --waitxcrun stapler staple Foo.appspctl -a -vvv Foo.app # confirm before shipping

Things that will bite you

These are BSD tools, not GNU. sed -i needs a suffix argument. ls has no --color. grep has no -P. sort has no -h. date arithmetic uses -v. Scripts written on Linux will fail in small, confusing ways.
bash is 3.2 and make is 3.81. Both frozen in 2006 over GPLv3. If your script needs anything newer, require zsh or install real versions.
Writing a plist file directly often does nothing. cfprefsd caches, and will overwrite you. Use defaults, and restart the owning process.
Editing a signed binary breaks it. install_name_tool, strip and segedit all invalidate the code signature. Re-sign afterwards or the binary will refuse to launch.
killall often achieves nothing. launchd restarts most daemons instantly. To actually restart one deliberately, use sudo launchctl kickstart -k system/com.apple.foo.
DTrace is crippled by SIP. Its scripts silently return partial data on Apple binaries. csrutil enable --without dtrace from Recovery is the fix, and it is a reasonable trade for a development machine.
cron jobs have no permissions. A cron job runs outside the GUI session, so it has no TCC grants — it cannot read your Documents folder, take a screenshot or send an Apple event. Use a launchd LaunchAgent instead.
The system volume is read-only and sealed. You cannot add to /usr/bin. Put your own tools in /usr/local/bin.
sudo is not enough for much. SIP restricts root itself. If a command fails as root with EPERM, check SIP before assuming the command is broken.
Deprecated does not mean removed — yet. Apple has already deleted Python 2, PHP, Samba, the airport command and telnet. Perl, Ruby, sandbox-exec and the Carbon resource tools are marked for the same fate. Do not build anything durable on them.

How this reference was built

The inventory was taken directly from the machine — every entry of /bin, /sbin, /usr/bin, /usr/sbin, /usr/libexec, the Xcode and Command Line Tools directories, the Safari cryptex and /Library/Apple — on macOS 26.6.2 (25G83) with Xcode 26.6 (17F113) and Command Line Tools 26.6, Apple silicon.

for d in /bin /sbin /usr/bin /usr/sbin /usr/libexec; do ls "$d"; donefind / -maxdepth 6 -type d $ -name bin -o -name sbin -o -name libexec $ 2>/dev/nullman -k . | grep -E '$1$|$8$' # every documented command

Descriptions were cross-checked against the shipped man pages where one exists — 1,235 of the 1,651 entries in the four main directories have one, which leaves 416 documented only by their own strings, their entitlements, and the frameworks they link against.

Counts drift between macOS releases; Apple adds and removes daemons every year. Re-run the commands above on your own machine to see what has changed. Anything in /usr/libexec whose purpose looks obscure is worth thirty seconds with codesign --entitlements.

macOS Executable Directory Reference every bin, sbin and libexec on the system — what lives there and what each program does

The Map

1 · The Signed System Volume

2 · System Integrity Protection

3 · The dyld shared cache

4 · Cryptexes

/bin

/sbin

/usr/bin · Shell, Text & Files

/usr/bin · Archives, Compression & Packages

/usr/bin · Compilers & the Mach-O Toolchain

/usr/bin · Debugging, Profiling & Diagnostics

DTraceToolkit — processes

DTraceToolkit — syscalls & CPU

DTraceToolkit — files & I/O

/usr/bin · Security, Signing & Trust

/usr/bin · System & Desktop Administration

/usr/bin · Media, Graphics & Machine Learning

/usr/bin · Networking

/usr/bin · Directory Services, Kerberos & LDAP

/usr/bin · Printing

/usr/bin · Bundled Language Runtimes

The interpreter

POD documentation

Module authoring

Bundled CPAN tools

/usr/bin · Oddities & Leftovers

/usr/sbin

/usr/libexec

Xcode & the Command Line Tools

macOS Executable Directory Reference every `bin`, `sbin` and `libexec` on the system — what lives there and what each program does

`/bin`

`/sbin`

`/usr/bin` · Shell, Text & Files

`/usr/bin` · Archives, Compression & Packages

`/usr/bin` · Compilers & the Mach-O Toolchain

`/usr/bin` · Debugging, Profiling & Diagnostics

`/usr/bin` · Security, Signing & Trust

`/usr/bin` · System & Desktop Administration

`/usr/bin` · Media, Graphics & Machine Learning

`/usr/bin` · Networking

`/usr/bin` · Directory Services, Kerberos & LDAP

`/usr/bin` · Printing

`/usr/bin` · Bundled Language Runtimes

`/usr/bin` · Oddities & Leftovers

`/usr/sbin`

`/usr/libexec`