signalgrid_launch_items
Lists third-party launchd persistence items (LaunchDaemons/Agents) to identify potentially malicious or suspicious software installed for automatic execution at boot or login.
Instructions
Third-party launchd persistence: plists installed in /Library/LaunchDaemons, /Library/LaunchAgents, and ~/Library/LaunchAgents.
These are the standard macOS persistence mechanisms -- anything here runs automatically at boot or login. Apple's own sealed /System items are excluded, so every row is software someone installed. A recently-modified, oddly-named plist is a prime malware-persistence signal.
Args: name_contains: substring filter on the launchd label (filename). limit/offset: pagination (default 50 per page). response_format: markdown table (default) or JSON envelope; items have label, scope (system_daemon | system_agent | user_agent | user_daemon_nonstandard), path, modified (ISO timestamp).
Returns: str: rendered table or JSON string.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum results to return | |
| offset | No | Results to skip for pagination | |
| name_contains | No | Case-insensitive substring filter on the launchd label, e.g. 'docker' | |
| response_format | No | 'markdown' for a human-readable table, 'json' for machine-readable data | markdown |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |