APP SANDBOXING FOR MACOS

Apps see only
what you allow.

ScopeShelf runs your Mac apps under the macOS Seatbelt sandbox. Each launcher grants exactly the folders you choose — everything else in your home directory stays invisible.

Try free for 7 days See what's inside

No credit card, no account. Then €19 once — no subscription.

  • Grant folders per app: writable, read-only or invisible.
  • SSH keys, keychains and cloud credentials are blocked by default.
  • Cut an app's network access with one switch.
  • Watch blocked accesses live in the audit log.

sandbox-exec · Seatbelt profiles · macOS 14+ · Apple Silicon & Intel

ScopeShelf — Übersicht
ScopeShelf showing the launcher overview with protection status

macOS 14+ · Apple Silicon & Intel · runs sandboxed apps even when closed

Every app you open can read your whole life.

Most Mac apps run with your full user rights. That fact is invisible — until it isn't.

Your home folder is open to every binary.

Any app you double-click can read your SSH keys, browser profiles, client work and tax documents. macOS asks for your consent for the camera — not for your files.

Network filters only see half the story.

Connection-level tools watch what leaves your Mac. What an app reads from disk before it ever phones home stays invisible to them.

Real sandboxing means writing profiles by hand.

sandbox-exec ships with every Mac, but Seatbelt profiles are an arcane dialect nobody wants to maintain per app. So almost nobody does.

ScopeShelf writes and maintains those profiles for you — per app, in plain sight.

Try free for 7 days

The sandbox is built into macOS.
We made it usable.

Why ScopeShelf exists

It started with an app I didn't trust.

A while back I downloaded a small utility — closed source, from a vendor I'd never heard of, solving exactly my problem. Before double-clicking, I caught myself thinking: the moment this thing launches, it can read my entire home folder. SSH keys, cloud credentials, client projects. With my full user rights, no questions asked.

The irony is that macOS has shipped the answer since 2007: Seatbelt, the same kernel sandbox Apple uses for its own apps. sandbox-exec sits in /usr/bin on every Mac. But writing Seatbelt profiles by hand is tedious, the syntax is unforgiving, and one rule in the wrong order silently breaks the whole thing. So I wrote one profile, then a generator, then a GUI.

That became ScopeShelf. My apps live on a shelf now, each with exactly the folders I granted — and when one of them tries something I didn't allow, macOS blocks it and my audit log shows me it tried. I still use that little utility. It just can't read my life anymore.

— Christof, builder of ScopeShelf

Features

One job, done properly.

ScopeShelf does exactly one thing: it decides what each app can reach. Everything below serves that.

🗂

Three protection zones

Writable, read-only, invisible — per launcher, per folder. Read-only is enforced by real deny file-write* rules, not by politeness.

🔑

Credentials blocked by default

~/.ssh, ~/.gnupg, ~/Library/Keychains, ~/.aws and ~/.config/gcloud are invisible to every launcher before you grant anything.

🌐

Network off, per app

One switch adds deny network-outbound. The app keeps running — it just can't send anything anywhere.

📜

Live audit log

Start a recording and watch macOS work: which operation, which path, how often. Proof beats promises.

🚀

Dock starters

Turn any launcher into a small clickable app for your Dock. Double-click, sandboxed — ScopeShelf doesn't need to be open.

🛡

Menu bar status

The menu bar extra shows which watched apps are running protected — and warns you when one is running without its sandbox.

⌨️

CLI and project configs

scopeshelf run, dry, add, presets — plus a .scopeshelf file per project directory. Scriptable, diffable, yours.

📦

Curated app presets

VS Code, Cursor, Windsurf, WebStorm and iTerm ship with their known data folders. One command, sensible sandbox.

How it works

Built on the sandbox Apple ships.

No kernel extension, no helper daemon, no cloud. ScopeShelf renders a Seatbelt profile per launcher and starts the app through sandbox-exec — the enforcement is macOS itself, and it keeps working when ScopeShelf is closed.

Terminal — scopeshelf dry 
$ scopeshelf dry "VS Code"
(version 1)
(allow default)                          ; system paths stay usable
(deny file-read* file-write* (subpath "/Users/christof"))   ; your home: invisible
(allow file-read* file-write* (subpath "/Users/christof/Projects/work"))  ; granted: writable
(allow file-read* (subpath "/Users/christof/Documents"))
(deny file-write* (subpath "/Users/christof/Documents"))    ; granted: read-only
(deny file-read* (subpath "/Users/christof/.ssh"))          ; always blocked
(deny network-outbound)                  ; no network for this app

This is the actual profile, abridged. Rule order matters — ScopeShelf's renderer gets it right every time.

Try free for 7 days

Security

Enforced by the kernel, not by us.

ScopeShelf doesn't intercept anything itself. It writes rules; macOS enforces them. That distinction is the whole point.

Kernel-enforced rules

Seatbelt rules are evaluated by the macOS kernel. The sandboxed app cannot switch them off — and neither can a bug inside it.

Invisible means denied

„Invisible" folders get real deny rules. The app can't read them, can't write them, can't even see they exist.

Read-only means read-only

Read-only folders receive explicit deny file-write* rules. Open them, yes. Modify them, no.

Verified protection

The live status checks each running process with the system's own sandbox_check. If ScopeShelf says „protected", macOS confirmed it.

Honest about what it sees

If the protection state of a process can't be determined, ScopeShelf says exactly that — it never claims a protection it can't verify.

Nothing new in your system

No kext, no launchd daemon, no root privileges. ScopeShelf composes tools your Mac already has — and removes nothing when you uninstall it.

Try free for 7 days

Privacy

All local. No account. No telemetry.

We don't know who you are, and we like it that way.

🚫 No telemetry, ever

No analytics SDK, no crash reporting you didn't ask for, no usage metrics. The app makes no network connections of its own.

🗄 Local-first by design

Launchers, profiles and audit logs live in your user folder. There is no ScopeShelf cloud to leak, breach or subpoena.

👤 No account

You download the app and it runs. No sign-up, no email verification, no password to forget.

🧾 Sold by Polar, not by data

Polar.sh is our merchant of record. They process the payment; we receive an email address for your license. Nothing else changes hands.

Pricing

Buy once. Own it.

One payment, no subscription. Sold by Christof Müller (Switzerland) via Polar.sh as merchant of record — VAT handled properly, invoice included.

Personal

€19 once

For developers, freelancers and anyone who installs software they don't fully trust.

  • ✓ Unlimited launchers & sandboxed apps
  • ✓ GUI, menu bar agent & Dock starters
  • ✓ CLI with presets & .scopeshelf project configs
  • ✓ Live audit log & verified protection status
  • ✓ 1 user, install on all your own Macs
  • ✓ Every 1.x update included — a future v2 would be an optional upgrade
  • ✓ 7-day free trial, no credit card, no account
  • ✓ 14-day money-back guarantee
Buy now for €19 Download free 7-day trial

Before you buy: ScopeShelf is currently ad-hoc signed — no Apple Developer ID, no notarization yet. Gatekeeper will warn on first launch; you open the app via right-click → Open (or System Settings → Privacy & Security). The app runs perfectly fine on macOS 14+ — we just want you to know before checkout, not after. Also good to know: apps that already ship Apple's own App Sandbox can't be wrapped; ScopeShelf detects them and tells you.

Honest expectations

What ScopeShelf is and isn't.

Please read this before you buy. It saves both of us a refund.

✓ What it is

  • A launcher that runs your Mac apps under the macOS Seatbelt sandbox.
  • Per-app control over which folders are writable, read-only or invisible.
  • A way to cut an app's outbound network access entirely.
  • A live log of the accesses macOS blocked.
  • A GUI plus a scriptable CLI with per-project config files.
  • Built entirely on macOS built-ins: sandbox-exec and Seatbelt profiles.

✗ What it isn't

  • Not an antivirus: it doesn't scan, detect or remove malware.
  • Not a connection filter like Little Snitch: the network switch is all-or-nothing per app, not per-host rules.
  • Not for apps that ship Apple's own App Sandbox — macOS won't nest sandboxes, and ScopeShelf says so when it detects one.
  • Not a container or VM: sandboxed apps share your kernel and filesystem semantics — and the performance of your real Mac.
  • Not a guarantee against malicious software: Seatbelt shrinks what an app can reach; it can't make hostile code safe.
  • Not cloud-managed: no account, no dashboard, no sync, nothing to log into.

Frequently asked

Questions, answered.

Is there a free trial?

Yes: 7 days, full features, no credit card, no account. Download, sandbox your first app, decide.

Refund policy?

14 days, money-back, no questions asked. Email hello@scopeshelf.app from the address you bought with.

How do updates work?

Every 1.x update is free, for as long as the OS allows. A future v2 would be an optional paid upgrade — your v1 keeps working either way.

Gatekeeper warns me on first launch. Is the app safe?

The warning is about us, not about the app: ScopeShelf is ad-hoc signed, without an Apple Developer ID so far. Open it via right-click → Open. It's a warning about a missing certificate fee, not about hidden behavior — the app makes no network connections of its own, sandboxed or not.

Why can't ScopeShelf sandbox some of my apps?

Apps signed with Apple's own App Sandbox can't be nested inside another sandbox — macOS simply refuses. ScopeShelf detects this when you pick the app and tells you before you buy a launcher for nothing.

Do Electron apps work?

Yes. ScopeShelf handles their helper processes and the inner Chromium sandbox (--no-sandbox), so the outer Seatbelt rules apply cleanly to the whole app.

Is there a command-line interface?

Yes — scopeshelf with list, run, dry, add, remove, init and presets. Extras: --env for environment variables, a :ro suffix for read-only folders, and .scopeshelf config files per project.

Which macOS versions are supported?

macOS 14 Sonoma or later, on Apple Silicon and Intel.

What exactly does the network block cover?

deny network-outbound blocks all outbound connections for the app and its child processes — TCP, UDP, the lot. It's deliberately all-or-nothing per launcher, not per-host filtering; for that, a connection-level firewall remains the right tool.

What if an app needs a folder I didn't grant?

It simply doesn't see it — as if the folder didn't exist. Most apps cope fine. If one misbehaves, the audit log shows exactly which access was blocked, and granting that folder takes one click.

Talk to us

Bug, feature wish, or question before buying?

We read every message and usually reply within a working day.

Or email hello@scopeshelf.app directly.

From the same workshop

Two more tools from the shelf.

DeviceShelf

Map your network, with DeviceShelf

Our local-first network scanner: every device on your LAN, open ports, a security report and presence alerts. Same principles: one-time purchase, no account, no telemetry.

Discover DeviceShelf ↗
ServerShelf

Know your servers, with ServerShelf

Our local-first server cockpit: SSH inventory, Docker, TLS and uptime monitoring, AI log triage — with your own key. Same principles: one-time purchase, no account, no telemetry.

Discover ServerShelf ↗