Systems · Developer Tools

ProcessPilot

Understand what is using your Mac — without invasive access.

two-language pipeline
read-only by design
MIT

Repository

ProcessPilot's overview page asking 'Why is my Mac slow?' — memory, CPU, swap and a deterministic ELEVATED pressure verdict over a table of top applications with stopping-risk labels, under a banner reading 'Demo data: these numbers are deterministic examples, not telemetry from this Mac' — Demo mode — deterministic example data, and the banner says so

Observes

Process names and sanitized executable identity
PID relationships and application grouping
CPU, resident memory, physical memory, swap, load
Documented spikes, sustained CPU, monotonic growth

Cannot see, by construction

Passwords, keychain, file contents, emails
Browser history and process-memory contents
Keystrokes, clipboard, screen, microphone, camera
Network packet contents

Runs as an ordinary user — no admin access, no Full Disk Access, no Accessibility, no privileged helpers

01The problem

“What is eating my Mac?” shouldn’t cost your privacy.

The tools that answer that question usually want administrator rights, kernel extensions, or full-disk access — far more than the question requires. ProcessPilot uses ordinary unprivileged macOS telemetry to show what is consuming CPU and memory and explain it in plain language.

It observes and explains. It never controls processes — there is no kill button, no process-control endpoint, and no arbitrary-command endpoint anywhere in the codebase. The dashboard binds to 127.0.0.1, telemetry is never uploaded, and history keeps only one-minute aggregates.

02Two languages, one one-way pipe

Rust

Collector

Narrow, unprivileged telemetry collection from ordinary macOS APIs — normalization and edge redaction before anything leaves the process.

bounded JSONL stdout, one-way

Validator + service

Strict protocol validation, the fixed child-process supervisor, deterministic analysis, SQLite history, localhost HTTP/SSE, CLI, and optional explanations.

In-memory evidence

current process snapshots never touch disk

Bounded SQLite history

one-minute aggregates, seven days by default

Localhost UI + read-only CLI

fixed GET routes on 127.0.0.1

03The interface

$ processpilot status

$ processpilot top

$ processpilot inspect 95707

$ processpilot explain 95707

# deliberately absent:

# kill · stop · restart · exec

The whole CLI — fixed GET routes, nothing that mutates

The web dashboard serves Overview, Applications, Processes, History, Anomalies, Privacy and Settings pages. Every V1 API endpoint is a read-only GET below 127.0.0.1:

/api/v1/system GET
/api/v1/applications?page=1 GET
/api/v1/processes?page=1 GET
/api/v1/processes/{pid} GET
/api/v1/history?application=… GET
/api/v1/anomalies GET
/api/v1/events (SSE) GET

Unknown query parameters and unsupported methods fail closed. There is no CORS opt-in, no command body, and no remote bind option.

ProcessPilot's Applications page grouping helper processes under identified applications, each with purpose, CPU, memory, and a conservative stopping-risk label — Grouped evidence — helpers roll up under the application, with conservative stopping risk

04Engineering decisions

Why two languages: Rust owns the narrow, security-sensitive edge: raw telemetry, normalization, redaction. Go owns everything stateful and networked: supervision, validation, analysis, storage, HTTP. The boundary between them is a versioned, one-way JSON Lines pipe — the collector cannot be commanded, only read.
Separating evidence from interpretation: Observed facts, deterministic classification, conservative stopping risk, and optional explanation text are separate fields with separate rules. Applications are grouped without guessing unknown ownership.
Optional AI, fenced in: Explanations can come from a local Ollama model over a loopback-only, allowlisted payload — non-loopback endpoints, credentials in URLs, and redirects are rejected. If Ollama is unavailable, the deterministic explanation provider answers instead.
Honest about signing: V1 release archives are checksummed but not notarized — the project has no Apple Developer signing credentials, and the README says exactly that, recommending a from-source build over weakening Gatekeeper.

05Verification

The release gate runs the paranoid checks.

make check coordinates both languages; release CI additionally runs pinned cargo audit, govulncheck, and npm audit. Browser tests include automated WCAG 2.1 AA checks in desktop and mobile Chromium, and measured overhead is recorded in the repository rather than claimed.

06Stack and links

Rust · Go · SQLite · Server-Sent Events · Playwright · GitHub Actions — with a Makefile coordinating the two toolchains into sibling binaries.

Repository · Privacy model · Threat model · Collector protocol · Releases