google/santa

Health v2 · maintenance only

Flags: archived

Adoption not part of the score

4511 stars · 288 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

Santa is a binary and file access authorization system for macOS, consisting of a system extension that monitors executions, a daemon that makes allow/block decisions from a local rules database, a GUI agent, and a CLI utility. It supports MONITOR and LOCKDOWN modes with rules based on binary hashes, certificates, Signing IDs, Team IDs, and path patterns. Note: no longer maintained by Google as of 2025; users should migrate to a fork such as northpolesec/santa.

Use cases

• block unauthorized binaries from running on macOS
• allowlist approved applications across an organization
• log all binary executions on macOS endpoints
• enforce application lockdown mode on managed Macs
• allow or block software by signing certificate or Team ID
• monitor unknown or denied executables for later analysis

When to choose

• you need endpoint execution control (allowlisting/blocklisting) on macOS
• you want certificate- or Team ID-based rules that survive version updates
• you need centralized rule syncing with a sync server across a Mac fleet
• you want detailed execution logging for security auditing

When to avoid

• you need actively maintained software - Google stopped maintaining it in 2025, use northpolesec/santa instead
• you need binary authorization on Linux or Windows
• you only need simple antivirus/malware scanning rather than policy-based execution control

Facets

application · maturity abandoned

security authorization monitoring logging security operating-systems developer-tools endpoint-security binary-allowlist blocklist system-extension macos-security application-whitelisting macos

Member repositories

For agents

markdown · JSON · MCP: product_card(name="google/santa")