Mac Sai

The open-source Mac cleaner, optimizer, and malware scanner.
A free, Apple-notarized alternative to CleanMyMac, built with Swift 6 and SwiftUI.
_{Downloaded 100,000+ times. Free forever, with zero telemetry.}

English | 简体中文 | 繁體中文 | Deutsch | Français | Русский

Install in one command:

brew install --cask mac-sai

Or grab the latest DMG. It is notarized by Apple, so it just opens, no right-click, no warnings, no Terminal.

_{No ads in the app, ever. This page has one vetted sponsor slot, and it is open.}

Why Mac Sai?

A full-featured Mac cleaner should not cost a yearly subscription or ask you to trust a black box with deep access to your files. Mac Sai gives you the whole toolkit, in the open.

• Free, forever. No subscription, no in-app purchases, no "upgrade to Pro", no nag screens. BSD-3 licensed.
• Zero telemetry. No analytics, no crash reporter, no trackers, no server to phone home to. And you do not have to take our word for it, verify it yourself in two commands.
• Every major CleanMyMac tool, in one app. 22 modules across cleanup, protection, performance, applications, and disk insight, plus a menu-bar widget.
• Safe by design. Trash-first deletion, a protected-paths blocklist, symlink and TOCTOU guards, and a SafetyGuard that validates every path. It is built to never lose your data.
• Apple-notarized and fully open source. Your Mac verifies the signature every launch, and every line is here to read.

Features at a glance

Features in detail

🧹 Cleanup

🛡️ Protection

⚡ Performance

📦 Applications

🗂️ Files

📊 Menu Bar Widget

A glassmorphism menu-bar widget that puts your Mac's vitals one click away. It is an independent process that launches at login and is toggled from the app's sidebar, so you never have to open the main window just to check in.

• Live stat rings: CPU load, memory pressure, disk usage, and battery in a 2x2 ring grid (host_processor_info, vm_statistics64, APFS capacity, IOKit power source), color-graded green to amber to red
• Configurable readout: show free disk, GPU usage, memory usage, or battery temperature; the choice persists, and unavailable sensors show --
• Network, uptime, and swap: real-time up/down throughput, system uptime, swap usage
• Recommendations: actionable, dismissible tips ("User caches grew to 2.52 GB, run System Junk"), one tap to act, suppressed for 30 days once dismissed
• Protection status: last malware-scan time and threat count, color-coded by freshness
• Connected devices: external volumes (with free space) and displays at a glance
• Health alerts: throttled, opt-in notifications when the disk runs critically low or memory pressure stays high

⌨️ Keyboard shortcuts

How Mac Sai compares

CleanMyMac is a great product, and the people who want a polished, supported experience should happily pay for it. Mac Sai is for everyone who would rather have transparent source code and zero subscription.

Interface languages

Choose System, Deutsch, Français, Русский, 简体中文, 繁體中文, or English in Settings → Interface Language. German, French, and Traditional Chinese translate static interface strings; interpolated messages retain the English wording and plural rules for now (Traditional Chinese falls back to Simplified). The main window and menu-bar widget share the language preference.

Installation

Homebrew (recommended)

Mac Sai is in the official Homebrew cask, so no tap is needed:

brew install --cask mac-sai

It is notarized by Apple, so it launches from Spotlight or Applications with no warnings and no extra steps.

curl -fsSL https://raw.githubusercontent.com/iliyami/MacSai/main/scripts/install.sh | bash

git clone https://github.com/iliyami/MacSai.git
cd MacSai
swift build
swift test                     # run the full 1,048-test suite
bash scripts/build-dmg.sh      # build a local DMG (unsigned)

Granting Full Disk Access

A few modules (Mail Attachments, Privacy, Malware) need Full Disk Access to scan protected areas:

1. Open System Settings, Privacy & Security, Full Disk Access
2. Click + and add Mac Sai.app
3. Restart Mac Sai

Uninstalling

Homebrew install:

brew uninstall --zap --cask mac-sai

DMG or manual install (also handles a Homebrew install):

curl -fsSL https://raw.githubusercontent.com/iliyami/MacSai/main/scripts/uninstall.sh | bash

Both remove Mac Sai plus its preferences, caches, logs, and database under ~/Library.

Signed, notarized, and yours to trust

Mac Sai is code-signed with an Apple Developer ID and notarized by Apple. That matters more for a cleaning app than for almost anything else you install, because you are about to give it deep access to your files, and you deserve to know that what runs on your Mac is genuinely ours and untampered with. All of this is enforced by your own Mac, not just promised by us:

• Apple has scanned it. Every release is submitted to Apple and checked for malware before it ships.
• It cannot be tampered with. The signature is a cryptographic seal over every file; change a single byte and macOS refuses to open it.
• It is provably from us. The signature is tied to our Apple Developer identity, so no one else can ship something your Mac accepts as Mac Sai.
• It just works. No Gatekeeper warnings, no right-click-to-open, no Terminal.

Put together with a fully open source, this is a chain of trust you do not take on faith: the code is public, we sign every release, Apple verifies it, and your Mac re-checks the seal every time you open the app.

Verify no telemetry yourself

Do not take our word for it. Both the source and the running process are checkable.

1. Search the source for networking APIs

rg -n 'URLSession|NSURLConnection' Sources --glob '*.swift'

You should only ever see three network paths, all optional and all read-only:

• Sources/MacCleanKit/UpdateChecker.swift: the optional Mac Sai update check (turn it off in Settings)
• Sources/MacClean/Modules/Updater/UpdaterModule.swift: the user-driven check of other apps' Sparkle feeds when you open the Updater
• Sources/MacCleanKit/MalwareBazaarFeed.swift: the opt-in MalwareBazaar hash download. It only runs when you add your own abuse.ch Auth-Key and press Update Now in Settings > Malware Databases. Each request sends only your Auth-Key and the query, never file hashes or paths. When a downloaded hash matches a signed file, macOS asks Apple whether its signing certificate was revoked, the same check Gatekeeper makes; that request is about the certificate, not your files

There is no analytics, crash reporter, or tracker SDK anywhere in the codebase.

2. Watch the live process

lsof -i -P -n | grep -i 'MacClean\|Mac Sai\|MacSai' || echo "no network sockets"

Expected: no established connections while you are only cleaning locally. Little Snitch or LuLu make the same check visual.

3. Inspect the binary you actually installed

The source and the signed binary are different artifacts, so the strongest check runs against the app on your disk, not this repo. After brew install --cask mac-sai:

APP="/Applications/Mac Sai.app/Contents/MacOS/MacClean"

# Networking classes the binary imports (only URLSession appears):
nm -u "$APP" | grep -iE 'URLSession|NWConnection|CFSocket' | sort -u

# Every URL compiled into the binary (only the three disclosed endpoints are fetched):
strings -a "$APP" | grep -iE 'https?://' | sort -u

Expected: the only networking class is _OBJC_CLASS_$_NSURLSession, and the only fetch endpoints are api.github.com/repos/iliyami/MacSai/releases/latest, formulae.brew.sh/api/cask/mac-sai.json, and mb-api.abuse.ch/api/v1/ (contacted only after you add a MalwareBazaar key and press Update Now). The other github.com/iliyami/MacSai links, the auth.abuse.ch sign-up link, and the buymeacoffee.com/iliyami support link just open in your browser. No trackers, no analytics hosts, nothing else. Re-run it after any update; it always describes the exact build you are running.

Note: on a non-sandboxed Developer ID app like this one, network access is not gated by an entitlement, so this symbol and string inspection, not codesign --entitlements, is the real check. The same guard runs in CI on every change (scripts/check-network-surface.sh).

Architecture

Mac Sai
├── MacClean          Main SwiftUI app (22 modules)
├── MacCleanKit       Shared framework (models, constants, protocols)
├── MacCleanHelper    XPC privileged helper (LaunchDaemon for root ops)
└── MacCleanMenu      Menu-bar monitor (independent process)

Tech stack

Safety model

Mac Sai is designed to never cause data loss:

• Protected-paths blocklist: /System, /usr, /bin, /sbin, and Apple system apps are untouchable, with macOS firmlinks canonicalized so symlink-redirect detection does not false-positive on legitimate system paths
• Pre-scan cleanability filter: items the current process could not trash (root-owned children of system caches, data-vaulted ~/Library/Caches/com.apple.* dirs) are dropped at scan time so they never appear as cleanable
• Trash-first deletion: every removal goes to the Trash by default, and a dry-run mode previews without touching anything
• TOCTOU prevention: symlinks are re-resolved immediately before deletion
• Excluded Folders: pick folders in Settings that scans skip entirely, and SafetyGuard additionally refuses to delete anything under them
• Chunked, cancellable cleanup: large selections split into 5k-item chunks honoring cancellation between chunks, and scans return to idle within about a second when you hit Cancel
• In-app activity log: every error during a clean is logged with its full path, viewable and copyable from the post-clean screen, auto-pruned after 30 days
• Kernel-enforced XPC gate: the privileged helper uses NSXPCListener.setCodeSigningRequirement so the kernel itself rejects any connection whose code signature does not match the app's identifier and team

Tests

swift test

The XCTest suite has 1,048 tests and treats SafetyGuard and CleaningEngine (the death-and-life files) as must-be-perfect: adversarial coverage of symlinks, path traversal, NULL bytes, SIP, protected apps, file-count caps, TOCTOU, and idempotence, plus integration coverage of dry-run / trash / permanent cleaning, the scan state machine, every System Junk category, the treemap math, the uninstaller matching engine, duplicate detection, appcast parsing, and full end-to-end fixture-to-clean cycles. Fixtures (withTempHome, withFakeApp, withFakePlist) keep every test off your real home directory.

Contributing

Contributions are very welcome. Read the Contributing Guidelines, then:

1. Fork the repo and create a feature branch
2. Make your change (one focused change per PR keeps review easy)
3. Run swift test
4. Open a Pull Request

There is also an open feature vote: 👍 the tools you want built next.

License

BSD 3-Clause. See LICENSE. You may use, modify, and redistribute the code, provided you keep the copyright and license text and do not use the "Mac Sai" name or contributors' names to endorse derived products without permission.

Acknowledgments

Inspired by the open-source Mac utility community:

• Pearcleaner: app uninstaller patterns
• Mole: cleanup categories
• Tencent Lemon Cleaner: modular architecture
• Squarified Treemap algorithm by Bruls, Huizing, and van Wijk (2000)

Support and sponsors

Mac Sai is free and stays free: no paid tier, no ads, no tracking. If it saved you from a cleaner subscription, you can buy me a coffee ☕. It keeps the releases signed, notarized, and coming.

Sponsor slot

Mac Sai has one sponsor slot, shown here and at the top of this page, in every language of this README.

Most visitors are developers and Mac power users, arriving mostly from Google search, then YouTube, GitHub and Reddit.

• One sponsor at a time, so your name is not lost in a wall of logos.
• Vetted. Developer tools, privacy and security products, and Mac apps that respect their users. No cleaners or "optimizers", no crypto, no affiliate VPN deals, nothing that tracks people.
• Never inside the app. Mac Sai has no ads and no telemetry, and no sponsor changes that.

This spot is open. Become the sponsor →
_{Audience details and how to apply: SPONSORS.md}

Star History

Mac Sai is free software built by the community, for the community.
If it saved you from a subscription, a ⭐ helps others find it, and a coffee ☕ keeps it going.