# google/santa

A binary authorization and monitoring system for macOS

Repository: https://github.com/google/santa
Canonical: https://ross.abutalabs.com/products/santa
Homepage: https://santa.dev
Language: Objective-C++
License: Apache-2.0
License Family: permissive
Topics: santa, security, macos, authorization, allowlist, blocklist, system-extension, endpoint-security
Archived: true
Last push: 2025-02-05T13:23:36+00:00

## Health v2 (maintenance only)
Score: 10/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 5, release rhythm 40, longevity 100
- inputs: {"age_days": 4346, "days_push": 574, "days_rel": 708, "gap_med": 13, "n_releases_24m": 2}
- flags: archived
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 4511, forks 288 (observed 2026-08-28T04:08:52.603023+00:00)

## What it is
Santa is a binary and file access authorization system for macOS, consisting of a system extension that monitors executions, a daemon that makes allow/block decisions from a local rules database, a GUI agent, and a CLI utility. It supports MONITOR and LOCKDOWN modes with rules based on binary hashes, certificates, Signing IDs, Team IDs, and path patterns. Note: no longer maintained by Google as of 2025; users should migrate to a fork such as northpolesec/santa.

## Use cases
- block unauthorized binaries from running on macOS
- allowlist approved applications across an organization
- log all binary executions on macOS endpoints
- enforce application lockdown mode on managed Macs
- allow or block software by signing certificate or Team ID
- monitor unknown or denied executables for later analysis

## When to choose
- you need endpoint execution control (allowlisting/blocklisting) on macOS
- you want certificate- or Team ID-based rules that survive version updates
- you need centralized rule syncing with a sync server across a Mac fleet
- you want detailed execution logging for security auditing

## When to avoid
- you need actively maintained software - Google stopped maintaining it in 2025, use northpolesec/santa instead
- you need binary authorization on Linux or Windows
- you only need simple antivirus/malware scanning rather than policy-based execution control

## Facets
- artifact type: application
- maturity: abandoned
- function: security, authorization, monitoring, logging
- domain: security, operating-systems, developer-tools
- platform: -
- tags: endpoint-security, binary-allowlist, blocklist, system-extension, macos-security, application-whitelisting, macos

## Member repositories
- google/santa (main) score 10

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:08:52.603023+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-29T18:20:20.720062+00:00, confidence not recorded.
  - readme: https://github.com/google/santa (fetched 2026-08-28T04:08:52.603023+00:00, sha e201f3b4434d)
  - homepage: https://santa.dev (fetched 2026-08-29T09:06:15.707838+00:00, sha c19a294ff3f1)
  - site_page: https://santa.dev/deployment/getting-started.html (fetched 2026-08-29T09:06:15.716989+00:00, sha 9832d1c791d8)
- Data as of 2026-08-30T08:39:29.467469+00:00.