MacSentinel

A modern, native macOS antivirus / anti-spyware built in pure Swift and driven by ClamAV virus definitions. There is no native Swift ClamAV library, so MacSentinel downloads and parses the official ClamAV signature databases itself — no libclamav, zero third-party runtime dependencies.

Detections are report-only by default. MacSentinel never deletes or quarantines anything automatically. It shows you where a threat lives and lets you decide. Quarantine and Delete are available per-item, and can be enabled as automatic actions in Settings.

Features

Detection engine (pure Swift, zero third-party runtime deps)

• Parses ClamAV .cvd/.cld containers (512-byte header → gzip → tar) at runtime.
• Hash signatures (.hdb/.hsb, algorithm inferred by hash length) via an in-memory index.
• Byte-pattern signatures (.ndb) with the wildcard grammar (??, *, {n}/{n-m}, (a|b)), a scalable sparse Aho-Corasick anchor pre-filter, and PE/ELF/Mach-O target-type filtering.
• Logical signatures (.ldb) — boolean subsignature expressions.
• Scans inside ZIP archives (dependency-free reader, zip-bomb bounded).
• Multithreaded: files are hashed and content-scanned in parallel across all cores; an immutable Sendable snapshot is shared lock-free. Loads ~204k signatures from a live daily.cvd.

Scanning & protection

• On-demand Quick / Full / Custom scans with live progress.
• Real-time protection (FSEvents) — auto-scans new/changed files in watched folders.
• Endpoint Security extension — optional kernel-level on-access scanning of every process launch, with report-only or blocking modes.
• Scheduled scans (6h / 12h / daily / weekly) and a menu-bar extra.
• System Inspection — heuristic checks for suspicious processes, persistence items (LaunchAgents/Daemons), and browser extensions, with SecStaticCode signature validation.
• Inert quarantine vault (XOR-obfuscated, exact restore) — but report-only by default.
• Definition updates with remote version checking (download only when newer); auto + manual.
• Full Disk Access detection with one-click guidance.

Project status

Official Public product name: MacSentinel. internal name "AnotherAntivirus". v1.0 — universal (Intel + Apple Silicon), macOS 15 (Sequoia)+. Proprietary, internal-use license

There are currently no public releases yet. The project is intended primarily for testing purposes for now, although it could be adapted for specific user groups, corporations, or individual users. It is not a consumer-grade product; therefore, it would be offered under an individual licensing model rather than as a mass-market application.