GitHub - djadmin/fort: macOS CLI: endpoint security audit...

Know your Mac's security posture. Fix gaps. Prove compliance. One command.

fort runs 15 security checks on your Mac, remediates what it can, and produces an auditor-ready report. No agent, no signup, no MDM enrollment — just a single binary.

Good for anyone who wants to harden their Mac. Essential for teams preparing for SOC 2 or ISO 27001.

djadmin.github.io/fort

Install

Homebrew (recommended)

brew install djadmin/tap/fort

Direct download (macOS — Apple Silicon + Intel)

curl -fsSL https://github.com/djadmin/fort/releases/latest/download/fort_darwin_all.tar.gz | tar xz && sudo mv fort /usr/local/bin/

go install github.com/djadmin/fort/cmd/fort@latest

Build from source

git clone https://github.com/djadmin/fort.git
cd fort && make install

Update

brew upgrade djadmin/tap/fort

Usage

fort                          # audit your Mac
fort --dry-run                # preview what --fix would change — nothing is applied
fort --fix                    # audit, show confirmation prompt, apply selected fixes
fort --fix --yes              # skip prompt — for scripts, MDM push, or cron
fort --json                   # structured JSON output for automation
fort --report                 # write fort-report-YYYY-MM-DD.html (print to PDF)
fort --only filevault,firewall  # run only the specified checks (comma-separated IDs)

Exit codes: 0 all pass · 1 any fail · 2 any warn

What It Checks

15 macOS checks across five groups, each mapped to SOC 2, ISO 27001, NIST CSF, and CIS v8:

Group	Checks
Core security	password manager, FileVault, screen lock, antivirus / EDR
System hardening	firewall, Gatekeeper, SIP, SSH
Access controls	local admin rights, guest account, automatic login
Exposure reduction	sharing services, AirDrop
Patching	automatic OS updates, OS patch status

JSON output

{
  "tool": "fort", "version": "0.2.0", "hostname": "alice-mbp",
  "os_version": "15.5", "timestamp": "2026-05-28T10:00:00Z",
  "summary": { "total": 15, "pass": 11, "fail": 2, "warn": 2, "score": "11/15" },
  "policies": [{ "id": "filevault", "status": "pass", "current": "on",
    "evidence": "$ fdesetup status\nFileVault is On.",
    "frameworks": { "SOC 2": ["CC6.1", "CC6.7"], "ISO 27001": ["A.8.3"] } }]
}

fort --report writes a self-contained HTML evidence report — machine identity, serial number, OS version, timestamp, per-check results with the exact commands run and their verbatim output, and framework control references. Opens locally or prints to PDF. See a sample report.

Contributing

PRs welcome. To add a check:

Create internal/checks/yourcheck_darwin.go — implement the Check interface
Register in internal/checks/registry_darwin.go
Add framework mappings in internal/checks/frameworks.go
go test ./... — existing tests enforce interface contracts

License

MIT

推荐订阅源

Show HN