Is Stat Space safe?
Short version: it’s signed and notarized by Apple, runs as you without root, has no analytics, and keeps what it measures on your Mac. Here’s exactly what it can touch and how to check for yourself.
Signed, notarized, hardened
- Developer ID signed and notarized by Apple. macOS Gatekeeper checks the signature and Apple’s notarization ticket before the app first opens.
- Hardened runtime. Code injection, unsigned libraries and debugger attachment are blocked by macOS.
- Signed updates. Updates come through Sparkle over HTTPS, and each one is checked against Stat Space’s EdDSA signing key before it installs. An update that isn’t signed with that key is refused.
- Apple Silicon only. One arm64 binary, no Rosetta.
What it can access
Stat Space runs as your user. It reads the same process, network and sensor information Activity Monitor shows, through public APIs plus three private Apple frameworks (for per-app network, sensors and power) that are only read from, never written to.
| Permission | When it’s asked |
|---|---|
| Microphone | Only if you turn on the live input level meter in the Volume tab, or run the microphone test in the Mac health report |
| Camera | Only when you run the camera test in the Mac health report (a live preview, never recorded) |
| System Audio Recording | Only when you first move a per-app volume slider |
| Location | Only if you pick “Current location” for weather |
| Calendars | Only if you turn on calendar events in the Time tab |
| Bluetooth | Only for device battery levels that need it |
Nothing is asked for up front. If you never use a feature, its permission is never requested.
No root, with one opt-in exception
Stat Space doesn’t install anything that runs as root. The only exception is fan control: if you turn it on, macOS asks you to approve a small helper in System Settings, because writing fan speeds needs root. That helper only accepts connections from Stat Space itself, checked by its code signature, only sets fan speeds, returns the fans to automatic when it exits, and is removed when you turn fan control off.
It won’t stop anything important
- Stop and cleanup only work on your own processes. System processes, root-owned processes, other users’ processes and core apps like Finder and the Dock are refused before any signal is sent.
- The one exception is opt-in: with Settings › General › System ports on, a third-party launch daemon (from
/Library/LaunchDaemons) gets a Stop button. It asks first, then asks for your password and runslaunchctl bootout system/<label>. Apple’s own processes are always view-only, and nothing is ever killed directly or uninstalled. - Every stop shows you what will be stopped and asks first, in the app and in the
statspaceCLI. - MCP tools for AI agents can’t stop anything on their own: without an explicit confirmation they only report what would be stopped.
- The CLI talks to the app through a socket in your Library folder that only your user can open (file mode
0600).
What leaves your Mac
The app has no analytics, no tracking and no account. History, settings and everything it measures stay in local files. It makes these network requests, and no others:
- Updates: the Sparkle update feed on statspace.app.
- Public IP: ip.statspace.app, for the Network tab.
- License (Pro only): license checks with Polar, the store. The key itself is kept in your login Keychain, not in a preferences file.
- Weather (while you use it): coordinates rounded to about 5 km, sent to statspace.app, which asks Apple Weather.
- Speed test (when you start one): Apple’s servers.
- Latency monitor (if you turn it on): a ping to 1.1.1.1 every 10 seconds, or a host you choose.
- Claude Code usage limits (if you turn them on): Anthropic’s usage endpoint, using the sign-in Claude Code already stored. The token is held in memory only, never written to disk or logged.
- Remote monitoring (Pro, if you turn it on): metrics streamed to statspace.app. Device tokens and viewer codes are stored only as SHA-256 hashes.
Verify your copy
Check the signature and Apple’s notarization yourself in Terminal:
codesign --verify --deep --strict --verbose=2 /Applications/StatSpace.app
spctl --assess --type execute --verbose /Applications/StatSpace.appThe second command should say accepted and source=Notarized Developer ID. To see who signed it:
codesign -dv --verbose=4 /Applications/StatSpace.app 2>&1 | grep -E "Authority|TeamIdentifier"A genuine copy is signed by Developer ID Application: J146 LLC (H2TW767676), Team ID H2TW767676. If you see anything else, don’t open it. Only download Stat Space from statspace.app.
Report a security issue
Email [email protected] with “Security” in the subject. Fixes ship as signed updates through the app.
Questions
Is Stat Space safe to install?
Yes. It’s signed with an Apple Developer ID, notarized by Apple and built with the hardened runtime, so macOS checks it before it runs. It runs as your user with no root access, has no analytics, and keeps everything it measures on your Mac.
Why does it need to run outside the App Store sandbox?
Per-process CPU and memory, sensors, power and per-app network all use APIs the App Store sandbox blocks. That’s the same reason Stats, iStat Menus and Activity Monitor-style tools are direct downloads. Unsandboxed doesn’t mean root: Stat Space still runs with your user’s permissions.
Is it open source?
No. You can still verify what you run: the signature and notarization checks below work on any copy, and the Pro and Free builds are the same signed app.
Can an AI agent use Stat Space to kill my processes?
Not without you. The MCP tools that stop something return what would be stopped and nothing else; the agent has to ask you and call again with an explicit confirmation. System, root-owned and other users’ processes are always refused.
Know what your Mac is doing, without adding to it.
Free, no account. Pro is $9.99 once for the first 100 buyers.