Inspect execution
Read real process and selected file events, inspect signing identity and CDHash, and hold a selected record while collection continues.
Live monitoring testedOrbitus Robotics / macOS security
ROB ViperKnow what runs.
Decide what connects.
Bring execution events, explicit rules, and managed policy into one native Mac interface. Built around Apple’s Endpoint Security and Network Extension frameworks, with a clear path from personal inspection to a managed fleet.
Version 0.7 development preview · Public installer pending
macOS 13+ · Publisher rules & lockdown on macOS 26+ · MDM profile export
A useful security control should explain itself
From an event to an informed decision.
Control which apps run
Allow or deny an exact build, one signing identity across updates, or a production publisher’s Team ID. Rehearse default-deny application lockdown in Audit, where every launch remains allowed. A guided tour explains rules and recovery.
Live publisher and app-rule Audit verifiedManage the authority
Export device configuration profiles with exact extension approvals and managed preferences. The service locks local policy changes when a forced MDM policy controls the Mac.
Built · Fleet rollout pendingDecide what connects
Set per-app Allow, Deny or Ask rules with signing identity, exact builds, ports, protocols, IP networks and available hostnames. Review a held connection before answering. Audit rehearses the same policy while allowing traffic.
Scoped live Audit, deny and approval testedUnderstand a connection
Hold a selected record, inspect its app and executable identity, search local history, and review reported traffic totals. Request a cached reverse-DNS lookup for an IP; the returned name is an inspection label, never an allow rule.
Live identity, history and PTR lookup checkedAdapt your rules
Use manual or network-location profiles, timed decisions and bounded HTTPS blocklist updates. An offline destination map uses a locally imported GeoIP database, with approximate locations and no destination-IP upload.
Regression tested · GeoIP data imported separatelyScan a defined scope
Run ClamAV malware signatures, Trivy dependency vulnerability checks, and reviewed local YARA-X rules. Read severity, fix guidance and coverage gaps, then export JSON or SARIF. Files stay on your Mac.
Harmless end-to-end scanner fixtures verifiedInvestigate behavior
Review execution from writable staging folders, persistence-location activity and rapid rename bursts. Signals explain their evidence and possible benign causes. Separate analysis continues while you inspect the event table.
Bounded heuristics · Required subscriptions shownChoose the right time
Start manually or save a daily/weekly scoped scan that waits for idle time and AC power. Thermal pressure defers a scheduled start. Scheduling runs while Viper is open; a reusable CLI supports separately managed jobs.
Manual by default · No background job installedYour MDM. Your policy.
Central administration.
Local decisions.
The management server owns enrollment, administrator accounts, groups, and profile delivery. ROB Viper applies supported execution rules locally. A network callback never waits for a web dashboard or an AI model.
Start with a pilot group in Audit. Verify outcomes, publish a higher policy revision, and then expand. Removing a managed profile restores local controls while retaining the last execution policy until it is changed.
- 1Administrator console
Choose devices and approve a policy.
- 2Apple MDM enrollment
Deliver approvals and forced settings.
- 3ROB Viper on the Mac
Evaluate supported rules on device.
- 4Verify before expanding
Inspect actual state, rule matches, and losses.
A subscription is not required for the evaluation.
A local, self-hosted Fleet Free evaluation is running; device enrollment and live profile delivery remain to be tested. Fleet’s paid capabilities, including its built-in app deployment and detailed administrator roles, are separate. ROB Viper exports standard Apple profiles so an organization can also evaluate Jamf Pro, Zentral, or another compatible MDM.
Designed for honest visibility
Less mystery.
More evidence.
Review a code identity, a policy revision, and a recorded result together. Collection state, permissions, queue losses, response errors, and configuration drafts have separate indicators.
Private by default
Local, bounded event logs, optional connection history and private scan reports. Scanners read files only within a selected scope; they do not upload contents or reports. Official database downloads contact their publishers. Event logging excludes command arguments and environment values; network filtering excludes payloads.
Explicit scope
Execution rules use kernel signing metadata: exact CDHash overrides app identity, which overrides publisher. Lockdown denies unknown identities and deadline-pressure cases in Enforce; Audit always allows. macOS platform binaries and verified Viper recovery components remain protected. Publisher trust requires macOS 26 signing categories. Network hostname rules need macOS metadata; a shared IP or PTR name is not an exclusive website identity.
Complement existing defenses
The preview combines policy controls, local scanning and explainable investigation signals. It is not a certified antivirus product, a universal threat feed, a cleanup service or a replacement for Apple’s built-in protections. Allowed interpreters can still run scripts; this policy does not inspect script contents.
Free illustrated handbook
Learn to investigate.
Build a repeatable practice.
The ROB Viper Security Operations Handbook expands the user manual into 30 chapters and 24 UI figures: malware triage, ClamAV, YARA-X, dependency CVEs, Trivy, FileVault, MDM pilots, incident decisions and organizational workflows. Includes harmless exercises and case templates.
Release status / November 2026
Built to earn a place on your Mac.
Verified in development
Version 0.7 passes 181 Swift tests. New scanner regressions cover command injection, output floods, cancellation, stale databases, scope limits, rule mutation and behavior-analysis load. Real ClamAV, Trivy and YARA-X fixtures verify signatures, CVEs and pattern matches without executing malware. Earlier execution tests cover publisher impersonation, rule precedence, policy persistence and GUI/native agreement. All 37 scanner and behavior tests also pass Address Sanitizer. Earlier native bridge checks passed Address, Undefined Behavior and Thread Sanitizers. A 128-rule load test returns all 30,000 mocked authorization replies despite a stalled logger. Live Audit verified a production publisher, a more specific app override and an ad hoc impostor. No live executions were blocked. Earlier scoped network tests verified Audit, deny, answered approval and reverse DNS.
Required before public installation
Developer ID distribution approval, production signing, notarization, live managed-device delivery, execution blocking, broader VPN/multi-user network tests, and completed recovery exercises. Public downloads will appear here after those checks pass.
Publisher, signing-identity and lockdown rules share concepts with Santa’s application control. Viper does not implement Santa’s certificate or full-binary SHA-256 rules, compiler/transitive trust, or sync protocol. Monitor never blocks, Audit rehearses, and Enforce requires an explicit choice. This is not a claim of full Santa parity.
Scanner engines are installed separately. The tested baseline is ClamAV 1.5.4, Trivy 0.76.2 and YARA-X 1.23.0; keep them updated. Trivy checks supported dependency manifests, not every installed Mac app or macOS CVE. YARA needs operator-reviewed rules. Heuristics do not automatically block or quarantine, and incomplete scans remain visibly incomplete.
Traffic accounting uses macOS reports and can miss totals for short flows. This preview does not promise full feature parity with other firewalls, complete DNS association, malware cleanup or tamper resistance.
The full Endpoint Security agent will use a direct website/MDM installer. Apple does not accept Endpoint Security clients in the Mac App Store. An optional store companion is a future separate product, not a substitute for the agent.
Apple’s distribution guidance ↗Fleet Free feature boundaries ↗Privacy and security scope →
Talk to Orbitus about a pilot