What’s running on port 9229 on my Mac?

Check what’s on port 9229

lsof -nP -iTCP:9229 -sTCP:LISTEN
ps -o pid,ppid,command -p <PID>

The command line shows --inspect or --inspect-brk, or nothing at all if it came from NODE_OPTIONS. To check that:

ps eww -o command -p <PID> | tr ' ' '\n' | grep NODE_OPTIONS

The inspector also describes itself:

curl -s http://127.0.0.1:9229/json/list

That returns the script path and a webSocketDebuggerUrl for each debuggable target.

With Stat Space: statspace port 9229.

Free it or change it

Stop the process with kill <PID>, or restart it without --inspect. To keep debugging but avoid collisions:

Situation	Fix
Two Node apps	node --inspect=9230 app.js for the second
Many children (test runners, monorepos)	--inspect=0 for a random free port each
NODE_OPTIONS set in your shell	unset NODE_OPTIONS, or remove it from ~/.zshrc
Wrangler vs Node	wrangler dev --inspector-port 9230

Security: never expose 9229

The inspector speaks the Chrome DevTools Protocol, which can evaluate any JavaScript inside the process. That means reading files, spawning shells and reading environment secrets, with no password. Exposing it is remote code execution on your Mac.

• The default 127.0.0.1:9229 is local only. Keep it.
• --inspect=0.0.0.0:9229, often copied from Docker guides, puts it on every network you join. Use it only inside a container whose port you publish as -p 127.0.0.1:9229:9229.
• To debug a remote machine, tunnel instead: ssh -L 9229:localhost:9229 server.

Even on localhost, any web page can try to talk to it, which is why Node checks the Host header. Don’t leave --inspect on in long-running services. More in dev server exposed to the network.

Seeing it live

Stat Space lists 9229 next to the app port of the same Node process, with its project folder and launcher, and flags it if it’s bound to 0.0.0.0. A debugger that’s been open for days is hard to miss.