Mac Sai

The open-source Mac cleaner, optimizer, and malware scanner.
A feature-complete, free alternative to CleanMyMac, built with Swift 6 and SwiftUI.

English | 简体中文 | Русский

Install in one command:

brew install --cask mac-sai

Or grab the latest DMG from Releases.

---

What is Mac Sai?

Mac Sai is a free, open-source macOS app that cleans junk files, removes malware, optimizes performance, uninstalls apps completely, and visualizes disk usage — all from a single, beautiful interface. It replicates every major feature of CleanMyMac while being fully transparent and community-driven.

No subscriptions. No telemetry. No ads. Just a clean Mac.

Available in English, Simplified Chinese (简体中文), and Russian (Русский). Switch anytime in Settings → Interface Language; by default it follows your system language.

How Mac Sai compares

CleanMyMac is a great product — they deserve the revenue from users who want a polished, supported experience. Mac Sai is for everyone who'd rather have transparent source code and zero subscription.

Features

Cleanup

Protection

Performance

Applications

Files

Menu Bar Widget

A glassmorphism menu bar widget that puts your Mac's vitals one click away — an independent process that launches at login and is toggled from the app's sidebar. No need to open the main window just to check in.

• Live stat rings — CPU load, memory pressure, disk usage, and battery in a 2×2 ring grid (host_processor_info, vm_statistics64, APFS capacity, IOKit power source), color-graded green → amber → red
• Configurable menu-bar readout — choose free disk space, GPU usage, memory usage, or battery temperature; the selection persists, and unavailable sensors display --
• Network, uptime & swap — real-time up/down throughput, system uptime, and swap usage
• Recommendations — actionable, dismissible tips ("User caches grew to 2.52 GB — run System Junk") with one-tap actions, suppressed for 30 days once dismissed
• Protection status — last malware-scan time and threat count, color-coded by freshness
• Connected devices — external volumes (with free space) and external displays at a glance
• Health alerts — background notifications when disk runs critically low or memory pressure stays high (throttled, opt-in)
• One click to the app — jump straight into Mac Sai

Keyboard shortcuts

Architecture

Mac Sai
├── MacClean          — Main SwiftUI app (14 modules, 15 views)
├── MacCleanKit       — Shared framework (models, constants, protocols)
├── MacCleanHelper    — XPC privileged helper (LaunchDaemon for root ops)
└── MacCleanMenu      — Menu bar monitor (independent process)

Tech Stack

Safety Model

Mac Sai is designed to never cause data loss:

• Protected paths blocklist — /System, /usr, /bin, /sbin, Apple system apps are untouchable
• macOS firmlink canonicalization — /var↔/private/var, /tmp↔/private/tmp, /etc↔/private/etc resolved to a single canonical form so symlink-redirect detection doesn't false-positive on legitimate system paths
• Pre-scan cleanability filter — items the current process couldn't trash (root-owned children of system caches, macOS data-vaulted dirs under ~/Library/Caches/com.apple.*) are dropped at scan time so they never reach the UI as cleanable
• Trash-first deletion — all removals go to Trash by default
• Dry-run mode — preview what would be deleted without touching anything
• TOCTOU prevention — symlinks re-resolved immediately before deletion
• Chunked cleanup — large selections (50k+) prompt a confirmation modal; the engine splits the work into 5k-item chunks honoring Task.isCancelled between chunks so cancellation is responsive
• Cancellable scans — Smart Scan and Duplicates show a Cancel button while scanning; ScanCoordinator.cancel() returns the UI to idle within about a second without orphan tasks
• Duplicate consolidation (reclaim space without deleting): on APFS, redundant copies are replaced with copy-on-write clones of a kept master, so every path keeps working and identical files stop costing N times their size
• Recursive byte accounting — directory size is walked instead of stat'd, so the "X freed" count on the completion screen reflects reality
• Orphan safety policy — orphan cleanup restricted to caches/logs only
• In-app activity log viewer — every error during clean is logged with full path; the post-clean screen has a "View Log" button that opens an in-app sheet with errors-only filter and copy-to-clipboard so you can paste a bug report verbatim. Logs auto-prune after 30 days
• Kernel-enforced XPC privilege gate — the privileged helper uses NSXPCListener.setCodeSigningRequirement (macOS 13+) so the kernel itself rejects connections from any process whose code signature doesn't match the main app's identifier and team

Installation

Homebrew (recommended — one command, no warnings)

Mac Sai is in the official Homebrew cask repository, so no tap is needed:

brew install --cask mac-sai

Mac Sai is notarized by Apple, so it launches from Spotlight or Applications with no warnings, no right-clicks, and no commands.

Installed via the old iliyami/macsai tap? You can drop it now that Mac Sai is in the official cask: brew untap iliyami/macsai (your installed app and future brew upgrade are unaffected).

One-line installer

curl -fsSL https://raw.githubusercontent.com/iliyami/MacSai/main/scripts/install.sh | bash

This downloads the latest DMG and installs the app to /Applications.

DMG download

Download the latest DMG from Releases and drag Mac Sai to your Applications folder. Mac Sai is notarized by Apple, so it launches normally with no Gatekeeper warning and no extra commands.

Build from source

git clone https://github.com/iliyami/MacSai.git
cd MacSai
swift build
swift test                     # run 486 tests
bash scripts/build-dmg.sh      # build local DMG (unsigned)

Granting Full Disk Access

Some modules (Mail Attachments, Privacy, Malware) need Full Disk Access to scan protected areas:

1. Open System Settings → Privacy & Security → Full Disk Access
2. Click + and add Mac Sai.app from Applications
3. Restart Mac Sai

Uninstalling

If you installed with Homebrew, remove the app and all of its support files in one command:

brew uninstall --zap --cask mac-sai

For a DMG or manual install, run the uninstaller (it also handles a Homebrew install):

curl -fsSL https://raw.githubusercontent.com/iliyami/MacSai/main/scripts/uninstall.sh | bash

Both remove Mac Sai plus its preferences, caches, logs, and database under ~/Library. If a leftover entry remains under System Settings → General → Login Items, remove it there; macOS clears it once the app is gone.

Signed & notarized: why you can trust it

Mac Sai is code-signed with an Apple Developer ID and notarized by Apple. That matters more for a cleaning app than for almost anything else you install, because you are about to give it deep access to your files. You deserve to know that what runs on your Mac is genuinely ours and has not been tampered with.

Here is what that gives you, enforced by your own Mac and not just promised by us:

• Apple has scanned it. Every release is submitted to Apple and checked for malware before it ships. Notarization is Apple vouching that this exact build came back clean.
• It cannot be tampered with. The signature is a cryptographic seal over every file in the app. If a single byte changes after we sign it, whether from a corrupted download, a network attacker, or malware trying to ride on our name, macOS refuses to open it.
• It is provably from us. The signature is tied to our Apple Developer identity, so no one else can ship something your Mac will accept as Mac Sai.
• It just works. No Gatekeeper warnings, no right-click-to-open, no Terminal commands. Install it and launch it like any app you trust.

Put together with the fact that the entire source is open for you to read, this is a chain of trust you do not have to take on faith: the code is public, we sign every release, Apple verifies it, and your Mac re-checks that seal every single time you open the app.

Maintainers: see docs/RELEASING.md for how releases are built, signed, and notarized.

Requirements

• macOS 14 (Sonoma) or later
• For building from source: Swift 6 toolchain (Xcode 16+)

Project Structure

Sources/
├── MacClean/
│   ├── App/                    # App entry point, state, content view
│   ├── Core/
│   │   ├── Scanner/            # FileTreeScanner, TargetedScanner, ScanCoordinator
│   │   ├── Cleaner/            # CleaningEngine, SafetyGuard
│   │   ├── Cache/              # GRDB database layer
│   │   └── FSMonitor/          # FSEvents incremental watcher
│   ├── Modules/                # 13 scan modules
│   │   ├── SystemJunk/         # 16 junk categories
│   │   ├── Malware/            # Signature scanner + real-time monitor
│   │   ├── Uninstaller/        # 10-level app matching engine
│   │   ├── SpaceLens/          # Squarified treemap algorithm
│   │   ├── Duplicates/         # Progressive hash pipeline
│   │   └── ...
│   ├── Views/                  # SwiftUI views (14 module views + shared components)
│   ├── ViewModels/             # @Observable view models
│   ├── Services/               # PermissionManager, XPCClient
│   └── Utilities/              # SuperEllipse shape, extensions
├── MacCleanKit/                # Shared models, constants, protocols
├── MacCleanHelper/             # XPC privileged helper (root operations)
└── MacCleanMenu/               # Menu bar system monitor

Tests/                          # XCTest suite — 486 tests
├── MacCleanTests/              # app-target tests
├── MacCleanKitTests/           # framework tests
└── MacCleanTestSupport/        # fixtures (withTempHome, withFakeApp, …)

Tests

swift test

XCTest-based suite covering:

• SafetyGuard — 24 adversarial tests (symlinks, traversal, NULL bytes, SIP, protected apps, file caps, idempotence)
• CleaningEngine — 9 integration tests (dry-run, trash, permanent, error handling, operation log)
• PlistJunkFilter — 9 tests including Apple-system-domain safety contract
• ScanCoordinator state machine — scan/cancel/category-filter/include-heavy
• TargetedScanner integration — runs against synthetic temp directory fixtures
• All 16 system junk categories — pure target declarations + the filter logic on the procedural ones (BrokenPreferences, BrokenLoginItems, UniversalBinaries, DeletedUsers)
• SquarifiedTreemap — empty, single, multi-node, area conservation, aspect-ratio properties
• AppMatching — all 10 levels of the uninstaller pattern engine
• DuplicateDetection — size groups, partial/full hash groups, inode dedup
• MalwareSignatures — name patterns + suspicious launch agent payloads
• MaintenanceTask — all 10 tasks have descriptions, icons, executable paths
• FileGroup — by-size / by-type / by-age grouping
• AppcastParser — Sparkle XML parsing
• VolumeInfo — usage math, equality
• AppDatabase — GRDB cache CRUD, migrations, invalidation
• FSEventMonitor — invalidated-path computation
• AppDiscovery, AppPathFinder — smoke tests
• End-to-end — synthetic fixture → scan → results → clean cycle

Test infrastructure (Tests/MacCleanTestSupport/) provides withTempHome, withFakeApp, withFakePlist, and other fixture helpers so tests stay deterministic and never touch the user's real home.

Coverage target: 85%+ overall, 100% on SafetyGuard and CleaningEngine (the death-and-life files). See docs/TESTING.md for the full roadmap.

Security

Mac Sai takes security seriously:

• No telemetry or analytics. The only network call is an optional update check (one request to the GitHub Releases API), which you can turn off in Settings
• No elevated privileges by default — XPC helper only activated for maintenance tasks
• Code signature verification — XPC helper validates caller identity
• Protected paths — 27+ Apple system apps and all SIP-protected paths are blocklisted
• Open source — every line of code is auditable

Verify no telemetry yourself

Don't take our word for it — the source and the running process are both checkable.

1. Search the source for networking APIs

# Network client APIs used by the app (update check + optional Sparkle appcast fetches
# for the Updater module). There is no analytics, crash reporter, or tracker SDK.
rg -n 'URLSession|NSURLConnection' Sources --glob '*.swift'

You should only see networking in:

• Sources/MacCleanKit/UpdateChecker.swift — optional Mac Sai update check (Settings → turn off Automatic update checks, or never press Check for Updates)
• Sources/MacClean/Modules/Updater/UpdaterModule.swift — user-driven scan of other apps' Sparkle feeds when you open the Updater module

URL(string:) also appears for local deep links (macclean://…), System Settings panes, and constant GitHub URLs in Constants.swift — those are not outbound telemetry.

2. Watch the live process

# While Mac Sai is running (and you are not checking for updates / using Updater):
lsof -i -P -n | grep -i 'MacClean\|Mac Sai\|MacSai' || echo "no network sockets"

Expected: no established connections from the main app when you are only cleaning locally. If Automatic update checks are on, you may briefly see one HTTPS request to api.github.com after launch — disable that toggle in Settings to silence it.

Third-party tools like Little Snitch or LuLu make the same check visual: allowlist nothing for Mac Sai except the optional GitHub Releases call you choose to enable.

Security Audit Checklist

• No command injection vectors (all Process args are hardcoded constants)
• No arbitrary file deletion (SafetyGuard validates every path)
• TOCTOU race condition prevention (symlink re-resolution before delete)
• File operation caps (10,000 file limit per operation)
• XPC caller validation (code signature check)
• No secrets or credentials in source
• Trash-first policy (recoverable by default)
• Operation audit log (every action recorded)

Contributing

We welcome contributions! Please read our Contributing Guidelines before submitting a PR.

Quick Start

1. Fork the repo
2. Create a feature branch (git checkout -b feature/amazing-feature)
3. Make your changes
4. Run tests (swift test)
5. Commit (git commit -m 'Add amazing feature')
6. Push (git push origin feature/amazing-feature)
7. Open a Pull Request

License

This project is licensed under the BSD 3-Clause License — see the LICENSE file for details.

This means you can use, modify, and redistribute this code, but you must:

• Include the original copyright notice
• Include the license text
• Not use the name "Mac Sai" or contributors' names to endorse derived products without permission

Acknowledgments

Inspired by the open-source Mac utility community:

• Pearcleaner — app uninstaller patterns
• Mole — cleanup categories
• Tencent Lemon Cleaner — modular architecture
• Squarified Treemap algorithm by Bruls, Huizing & van Wijk (2000)

Star History

If Mac Sai saved you from a subscription, a ⭐ helps others find it.

---

Mac Sai is free software built by the community, for the community.
If you find it useful, please star the repo and share it with others.