Santa

Vorssaint is a free, open-source Swift/SwiftUI macOS menu bar toolkit that combines utilities including per-application volume and audio controls, output and microphone switching, system monitoring, network statistics, app and window switching, window snapping, Dock previews, clipboard history, text snippets, file staging, screen capture, display and energy controls, media tools, cleaning, and app removal. It is modular: users can install or remove complete features, with removed features stopping loading while retaining their settings for later reinstallation. The toolkit also provides configurable shortcuts, panels, a command bar, and optional bundles for common setups. Vorssaint runs locally without an account, analytics, tracking, subscription, or required network service; its volume mixer requires no audio driver or setup, and selected features request only the relevant macOS permissions, including accessibility, screen recording, audio recording, microphone, camera, calendars, notifications, and disk access.

System Data Unpacked is a macOS menu bar and windowed app that inventories the contents of macOS System Data and lets users review or delete items individually. It uses category-specific storage probes to measure simulator runtimes and devices, Xcode data, package-manager stores, developer tools, logs, virtual machines, Docker data, snapshots, application data, project build folders, and other large folders; a final catch-all probe reports large paths not claimed by another category. Each result includes its measured size, category, safety level, and available reclaim action. Safe items can be deleted, review items are moved to the Trash first, and manual items show the relevant command or settings path. Before deletion, the app displays the exact operations and can batch compatible root actions through macOS authorization prompts. It records scan and deletion history locally, provides filtering, age and growth information, optional low-space and growth notifications, a JSON command-line inventory, and an opt-in weekly automatic cleanup for Safe items. The app makes no network requests except an optional daily GitHub update check, requires macOS 14 or later, and is distributed as a signed and notarized macOS app or through Homebrew. Current versions are proprietary; versions through 0.3.7 remain MIT-licensed.

OpenShell is an open-source runtime from NVIDIA for running fleets of autonomous AI agents in isolated sandboxes. It lets agents read files, install packages, call APIs, and use credentials while enforcing declared filesystem, process, and network policies. Each agent runs in a sandbox where kernel-level controls govern file access, system calls, and network connections. OpenShell also uses formal verification to review policy changes before approval, flagging newly permitted access such as connections to additional hosts with credentials or calls to new API methods. Credentials are withheld from agents and added only to requests bound for approved endpoints. The project provides a CLI, local gateway, sandbox lifecycle management, policy tooling, inference-provider routing, Kubernetes deployment, extensibility APIs, and Python, TypeScript, Go, and Rust SDKs. OpenShell supports Linux, macOS on Apple Silicon, and experimentally Windows through WSL 2, with Docker, Podman, or host virtualization. It is licensed under the Apache License 2.0 and collects configurable anonymous operational telemetry.

numbat is an open-source endpoint security tool for monitoring AI-agent activity across supported desktop, CLI, IDE, and gateway agents. It combines local hooks and plugins, OTLP/HTTP logs, and on-disk session artifacts, normalizes live and stored activity into a common event model, and evaluates it locally with built-in, sequence-based, or custom YAML CEL rules. The tool can produce NDJSON events, findings, enforcement decisions, indicators, and scan summaries for alerting and forensic reconstruction, including read-only artifact scans, per-session timelines, and portable case bundles with SHA-256 manifests. Optional pre-action blocking is disabled by default and is limited to supported synchronous hooks and explicitly enforced rules. It is distributed as a single cgo-free binary for macOS, Linux, and Windows, with read-only inventory and scanning commands.