Inventory of installed applications with version, source, and signer (via system_profiler SPApplicationsDataType; first call can take ~30s).

Use for software-inventory questions and to shortlist risky installs: obtained_from='Unknown' plus no signer is the classic sideloaded-app signal. For a deep verdict on one app, follow up with signalgrid_codesign_inspect on its path.

Args: name_contains: substring filter on the application name. unsigned_only: only apps lacking signing info. limit/offset: pagination (default 30 per page; inventories often have hundreds of entries). response_format: markdown table (default) or JSON envelope; items have name, version, obtained_from, signed_by (first authority), last_modified, path.

Returns: str: rendered table or JSON string; "Error: ..." if system_profiler failed.

Time Machine posture: automatic backups on/off, configured destinations, and the most recent completed backup.

A device with no recent backup carries higher data-loss risk; a stale latest_backup date on a machine that should back up daily is a drift signal.

Returns: dict with keys: auto_backup (bool | None; null = could not read), destinations (str), latest_backup (str; a snapshot path on success or error text), _note.

Inspect the code signature, signature validity, and Gatekeeper assessment of a bundle or binary on this Mac.

Use to answer "is this app properly signed and notarized, and by whom?". Reads only; never executes the target.

Args: path: Absolute path to the .app or binary to inspect.

Returns: dict with keys: - path: the inspected path - signature: codesign -dv --verbose=4 output (authority chain, team identifier, hashes) - verify: codesign --verify --deep --strict result ("valid on disk" style output, or the specific failure) - assessment: spctl --assess --verbose=4 Gatekeeper verdict (accepted/rejected and the source, e.g. "Notarized Developer ID")

A missing path yields codesign/spctl error text in those fields rather
than an exception.

Hardware identity: serial number, model, hardware UUID, chip, activation lock.

The stable anchor for a device trust record. Serial number + hardware UUID uniquely identify the physical machine across OS reinstalls.

Returns: dict with keys: model_name, model_identifier, chip, serial_number, hardware_uuid, provisioning_udid, memory, activation_lock — or {"error": str} if system_profiler could not run.

macOS product/build version, kernel, hostnames, uptime, and current users.

Use to establish OS patch level (compare product_version against Apple's latest release) and which user is on the console.

Returns: dict with keys: product_name, product_version, build_version, kernel, computer_name, local_hostname, uptime, console_user, process_user. Individual values read "unavailable"/error text when a probe fails.

Third-party launchd persistence: plists installed in /Library/LaunchDaemons, /Library/LaunchAgents, and ~/Library/LaunchAgents.

These are the standard macOS persistence mechanisms -- anything here runs automatically at boot or login. Apple's own sealed /System items are excluded, so every row is software someone installed. A recently-modified, oddly-named plist is a prime malware-persistence signal.

Args: name_contains: substring filter on the launchd label (filename). limit/offset: pagination (default 50 per page). response_format: markdown table (default) or JSON envelope; items have label, scope (system_daemon | system_agent | user_agent | user_daemon_nonstandard), path, modified (ISO timestamp).

Returns: str: rendered table or JSON string.

Loaded kernel extensions, with third-party (non-Apple) kexts singled out.

Modern macOS strongly discourages kexts; any third-party kext is a significant trust signal (legacy security tools, virtualization, or something worse). Tries kmutil showloaded first, falls back to kextstat.

Returns: dict with keys: third_party (list[str] of loaded non-Apple kext lines, ideally empty), raw (full loader output), source ('kmutil' or 'kextstat'), or {"error": str} if neither tool ran.

MDM enrollment state (including DEP/Automated Device Enrollment) and installed configuration profiles.

Key managed-device signal: an unenrolled corporate Mac is a trust gap. Profile listing may require elevation; the raw output is returned either way.

Returns: dict with keys: enrollment_raw (str), mdm_enrolled (bool | None), dep_enrolled (bool | None), profiles_raw (str), _note. null booleans mean the state could not be determined.

Network configuration snapshot: hardware ports, active interface state, DNS nameservers, proxy settings, and configured VPNs.

Use to spot rogue DNS, unexpected proxies, or missing corporate VPN -- all classic device-trust red flags.

Returns: dict with keys: hardware_ports (str), active_state (str, from scutil --nwi), dns_nameservers (list[str]), proxies (str), vpn_configurations (str), _note.

Processes listening on TCP ports (via lsof -iTCP -sTCP:LISTEN).

The live map of this Mac's inbound network exposure. Note: without elevation, lsof only sees processes owned by the current user; system daemons may be missing from the list -- absence of a listener here is weaker evidence than presence.

Args: name_contains: substring filter on the listening process's command. limit/offset: pagination (default 50 per page). response_format: markdown table (default) or JSON envelope; items have command, pid, user, address (e.g. '*:22', '127.0.0.1:8021').

Returns: str: rendered table or JSON string; "Error: ..." if lsof could not run.

Point-in-time snapshot of running processes (pid, parent, user, %CPU, %MEM, command path).

Use to confirm an agent/daemon is actually running (filter by name) or to spot suspicious processes. Full executable paths are included -- feed a suspicious one to signalgrid_codesign_inspect.

Args: name_contains: substring filter on the command path. sort_by: cpu (default) | memory | pid. limit/offset: pagination (default 25 per page). response_format: markdown table (default) or JSON envelope; items have pid, ppid, user, cpu_pct, mem_pct, command.

Returns: str: rendered table or JSON string; "Error: ..." if ps failed.

Connected USB / removable-media devices, flagging MASS-STORAGE — the data-egress channel a shared or plant-floor device manager cares about. Read-only; needs no elevation.

mass_storage_connected: true means removable storage is physically present. available: false means the USB tree could not be read (never "nothing connected"). SignalGrid reports this; it does not block the device.

Returns: dict with available (bool), device_count, mass_storage_count, mass_storage_connected (bool | None), and devices[] each with name, vendor, serial, kind (mass_storage | other), volumes.

Screen-lock / auto-lock hygiene: does this Mac lock itself when left idle? The walk-up risk on a shared or plant-floor device. Read-only; no elevation.

Composes three facts — password required on wake, the grace delay before it, and whether the display ever sleeps — into a fail-safe locks_when_idle verdict. true only when all three read healthy; false on a real gap; null when it could not be confirmed (unknown is never graded as locking).

Returns: dict with locks_when_idle (bool | None), password_on_wake (bool | None), password_delay_seconds (int | None), display_sleep_minutes (int | None), concerns (list), unknowns (list), and a _note.

Core security posture: SIP, FileVault, Gatekeeper, and application firewall (global state, stealth mode, block-all).

Each control reports {raw, enabled}. enabled is null when the check could not be completed -- null means UNKNOWN, never "off". Treat null as a signal to investigate (often the check needs elevation), not as a grade.

Returns: dict mapping control name -> {"raw": str, "enabled": bool | None}, plus "_unknown" (list of controls that could not be evaluated) and "_note" explaining the null semantics.

Remote-access exposure: SSH remote login, remote Apple events, Screen Sharing, SMB file sharing, and Apple Remote Desktop.

An enabled sharing service widens the device's attack surface; on a managed endpoint most of these should be off. Same null-means-unknown semantics as signalgrid_security_posture (systemsetup checks in particular often need elevation and will report null without it).

Returns: dict mapping service name -> {"raw": str, "enabled": bool | None}, plus "_unknown" and "_note".

Software update posture: auto-update settings, last successful check, cached count of available updates, and optionally a live check.

LastUpdatesAvailable > 0 or a stale LastSuccessfulDate is a patch-hygiene red flag. Values are null when a preference is unset or unreadable.

Args: check_online: run a live softwareupdate -l (slow) in addition to the cached state.

Returns: dict with keys: settings (dict of SoftwareUpdate preferences incl. AutomaticCheckEnabled, AutomaticallyInstallMacOSUpdates, CriticalUpdateInstall, LastSuccessfulDate, LastUpdatesAvailable, AppStoreAutoUpdate), and live_check (str, only when check_online=true).

Versions of Apple's built-in anti-malware: XProtect definitions, XProtect Remediator, and MRT (Malware Removal Tool).

Stale definitions indicate the Mac is not receiving Apple security content updates (often caused by ConfigDataInstall being disabled).

Returns: dict with keys: xprotect_definitions, xprotect_remediator, mrt. Each is a version string, or "unavailable: " text.

Software install history (OS updates, security content, packages), newest first — the audit trail of what changed on this Mac and when.

Use to verify security updates actually landed (e.g. filter name_contains='XProtect') or to spot unexpected installs.

Args: name_contains: substring filter on the package name. limit/offset: pagination (default 25 per page). response_format: markdown table (default) or JSON envelope {total, count, offset, items, has_more, next_offset}; items have name, version, source, install_date.

Returns: str: rendered table or JSON string; "Error: ..." if the underlying system_profiler query failed.

Installed system extensions (endpoint-security / network) and whether any is STRANDED — still registered after its app is gone (state activated enabled (removed) or terminated waiting to uninstall), which blocks its own reinstall. Read-only; needs no elevation.

Fail-safe: available: false means the state could not be read (never "none installed"); reliable: false means the parsed list may be incomplete (a residual one could be missing — raise the assurance bar); an unrecognized state is unknown, never active.

Returns: dict with available (bool), reliable (bool), count, declared_count, residual_count, active_count, unparsed_rows, and extensions[] each with teamID, bundleID, version, name, enabled, active, state, status (active | pending | residual | unknown).

Full device trust snapshot in a single round-trip: identity + OS + security + MDM + patch state by default, with optional extra sections.

Use this first. One call instead of six, which matters when every tool call is a network round-trip. Drill into the focused tools afterward for anything that looks off. A failed section reports {"error": ...} instead of sinking the whole snapshot.

Set include_verdict=True to also get the on-device SignalGrid decision as a 'verdict' summary alongside the raw facts — the same fail-safe fold as signalgrid_trust_verdict (unknown is never 'allow'). The verdict is a derived summary, never a collected signal, so it is absent unless explicitly asked for.

Args: sections: optional list from {identity, os, security, sharing, mdm, updates, xprotect, network, persistence, time_machine, system_extensions, screen_lock}. include_verdict: attach the folded allow/step_up/restrict/deny verdict.

Returns: dict keyed by section name; each value is that section's collector output (same shapes as the corresponding focused tools). With include_verdict, an extra 'verdict' key holds the folded decision.

Local user accounts, admin-group membership, and the current console user.

Unexpected accounts -- especially unexpected admins -- are a core device trust signal. Cross-check admin_group against your expected owner list.

Args: include_system: include uid < 500 daemon accounts (default false).

Returns: dict with keys: users (list of {username, uid, is_admin}), admin_group (list[str] of admin usernames), console_user (str), _note — or {"error": str} if directory services could not be queried.

The SignalGrid decision for THIS Mac, computed on-device: one fail-safe verdict — allow / step_up / restrict / deny — plus the reasons.

Read-only. Composes security posture, MDM enrollment, update settings, XProtect currency, and stranded system extensions. Unknown is never 'allow': a control that could not be read raises the bar to step_up; a disabled hardening control or a stranded security extension restricts (two or more deny).

Returns: dict with verdict (str), reasons (list), criticals, unknowns, controls, mdm_enrolled, and a _note. This is a single-device verdict; the fabric fuses it with other signals for the final decision.