What’s running on port 7000 on my Mac?

Confirm it

lsof -nP -iTCP:7000 -sTCP:LISTEN

COMMAND    PID  USER   FD   TYPE  DEVICE SIZE/OFF NODE NAME
ControlCe  612   you   11u  IPv4  0x...       0t0  TCP *:7000 (LISTEN)
ControlCe  612   you   12u  IPv6  0x...       0t0  TCP *:7000 (LISTEN)

lsof truncates command names to nine characters, so ControlCe is ControlCenter. To see the full path:

ps -o pid,command -p 612

It should be /System/Library/CoreServices/ControlCenter.app/.... That’s the real Apple process, not malware; see what is ControlCenter.

With Stat Space: statspace port 7000.

Free port 7000

System Settings › General › AirDrop & Handoff › turn off AirPlay Receiver. Run the lsof command again: 7000 and 5000 are both free. Turning it back on later reclaims them, so a server you start on 7000 meanwhile will block AirPlay rather than the other way round.

If you need AirPlay to your Mac regularly, leave it on and move your app instead. Ports like 7070, 7100 or 8000 are rarely taken on a Mac.

If it’s something else

If lsof shows java, it’s probably Cassandra (cassandra.yaml has storage_port: 7000) or another JVM service. If it’s node, python or ruby, it’s one of your own servers; find its folder with lsof -a -p <PID> -d cwd -Fn | tail -1 and stop it with kill <PID>.

Is AirPlay Receiver exposed?

It listens on all interfaces (*:7000) because other devices need to find it. Who may connect is controlled by “Allow AirPlay for”: Current User, Anyone on the Same Network, or Everyone. On shared networks, Current User or turning it off is the safer choice, and “Require password” adds a code.

Seeing it live

Stat Space lists every listening port with its full process name and path, so ControlCenter on 7000 doesn’t get confused with one of your dev servers, and your own servers show their project folder next to it.