███████╗██╗   ██╗ ██████╗██╗  ██╗ █████╗ ███████╗██╗     ██████╗
██╔════╝██║   ██║██╔════╝██║ ██╔╝██╔══██╗██╔════╝██║     ██╔══██╗
█████╗  ██║   ██║██║     █████╔╝ ███████║███████╗██║     ██████╔╝
██╔══╝  ██║   ██║██║     ██╔═██╗ ██╔══██║╚════██║██║     ██╔══██╗
██║     ╚██████╔╝╚██████╗██║  ██╗██║  ██║███████║███████╗██║  ██║
╚═╝      ╚═════╝  ╚═════╝╚═╝  ╚═╝╚═╝  ╚═╝╚══════╝╚══════╝╚═╝  ╚═╝

Fuck off the macOS services you don't use. Fuck all of em, or just the safe ones — your call, from a menu.

One script. No daemon, no account, no telemetry. It turns services off the same way launchctl disable does, and it can undo everything it does.

---

What this shit does?

macOS starts roughly 200 background services on every boot. Plenty of them exist to phone home, sync, index, or just sit around waiting for a feature you never open. This script turns off the ones you pick, by writing the same launchd disabled database that launchctl disable writes. Nothing under /System gets touched. No plist gets deleted. Every change is one command away from being undone.

It also applies the optimization tweaks that are safe enough to ship: window and dock animations off, transparency off, Spotlight indexing off, power nap and wake-on-LAN off. The aggressive modes add kernel and network settings that are documented, revertible, and labeled with what they can cost you.

It is not a "cleaner," a "booster," or anything that claims to make your Mac 10x faster. It turns services off. Some of those services are things you actually use — that's the trade, and the menu says so before you apply.

---

Modes

Mode	Services disabled	Always-resident	What you lose	Risk
1 · Safe	64	3	Telemetry, analytics, diagnostics, Siri and Apple Intelligence backends	Nothing user-facing. Reversible.
2 · Balanced	107	4	Mode 1 + iCloud extras, Maps, media extras, App Store, network-sharing services	Some features. Reversible.
3 · Aggressive	153	6	Mode 2 + Spotlight, Find My, Messages, FaceTime, AirDrop/AirPlay, Screen Sharing, Time Machine, Photos, Wallet, Screen Time	Many features. Reversible.
4 · Dangerous	199	7	Mode 3 + the thermal daemon, App Store, Mail, Contacts, crash reporting, live transcription	Real. Double-confirmed before applying.

The counts are the resolved plan on macOS Sequoia (15.x), measured by the script itself on a real install. They shift a bit by OS version, because every entry has to resolve to a plist that actually exists on your macOS before it gets touched.

"Services disabled" is not the same as "memory reclaimed." Most launchd jobs have no KeepAlive key and are started on demand — at idle they hold nothing, so disabling one prevents a future launch rather than freeing RAM. Only jobs with KeepAlive=true sit in memory for the whole session. The script reads that from each installed plist and badges every entry in the List view and the plan printout:

Badge	Meaning
RAM	KeepAlive=true — resident; disabling it reclaims memory
cond	KeepAlive is a dict — resident while its conditions hold
-	On demand — disabling it frees ~0 at idle

On a stock Sequoia install only 7 of the 200 resolved entries are always resident, and the plan printout reports how many of those your chosen mode actually touches.

The catalog has 204 entries across four risk tiers. Every entry is a real launchd label with a description.

---

How you use it

Everything lives in one menu. No flags, no arguments, nothing to remember:

• Pick a mode — Safe through Dangerous. It prints the full plan before anything happens.
• Dry-run — flip it on and every command is shown without being run. This works even with SIP enabled.
• Pick — browse the whole catalog and mark services by hand (space to mark, Enter to apply). Same safety gates as the modes, so you can't sneak a boot-critical service through.
• Custom — type specific labels (com.apple.weatherd com.apple.newsd) and only those get turned off.
• List — browse the whole catalog for your exact macOS version, scrollable and color-coded by tier.
• Restore — undo the last run, restore the defaults/pmset/Spotlight tweaks, or re-enable every catalog entry. Restore needs no network and no account.

Two safety rails sit under the whole thing:

1. A hard deny list. Boot-critical services — com.apple.WindowServer, com.apple.loginwindow, and friends — are refused even if you type them by hand.
2. Snapshot before change. Every run saves the current disabled database and the old value of every tweak to /Library/Application Support/macos-debloater/backups/ before touching anything.

Requirements

• Root. The script auto-elevates with sudo. State is system-wide and one run covers every user account on the machine.
• SIP filesystem protection off for real runs. csrutil enable --without fs is enough and is what you should prefer — a full csrutil disable also works but gives up kext-signing enforcement, debugging and DTrace restrictions, NVRAM protections and BaseSystem verification for no benefit. Dry-run, list, and restore all work with SIP fully on. The menu has a SIP help item with the Recovery-mode steps and a video link.
• macOS 12, 13, 14, 15, 26, or 27. Anything else is refused at startup.

---

Enterprise / fleets

Same script, fleet use. IT pre-seeds a config file and the script applies silently — no menu, no prompts:

# /Library/Application Support/macos-debloater/config
MODE=2
DRY_RUN=0
AUTO_APPLY=1

Deploy with MDM: push the config, run macos-debloater once per machine. The config file is the authorization — its contents replace every confirmation prompt. That's exactly why the dangerous keys (HIBERNATE_OFF, FILEVAULT_DISABLE, NETWORK_TUNING, ASK_THERMAL) default to off and have to be set deliberately.

Key	Default	Effect
MODE	—	1–4, required with AUTO_APPLY
DRY_RUN	0	1 = preview only
AUTO_APPLY	0	1 = silent run, no TUI
ASK_THERMAL	0	1 = include the thermal daemon in Modes 1–3
HIBERNATE_OFF	0	Mode 4: hibernatemode 0 + delete sleepimage
FILEVAULT_DISABLE	0	Mode 4: turn FileVault off (security loss, ~no speed gain on Apple Silicon)
NETWORK_TUNING	0	Mode 4: ESnet TCP buffers (wired 1Gbps+ only, degrades Wi-Fi)
MANUAL_LABELS	—	Comma-separated labels, overrides mode

Run as root and one run covers every user account: gui-domain services get turned off per-uid for each account, snapshots capture every user's disabled database, and the generated restore script re-enables all of them.

---

The bits that need a warning label

These are in the script, they work, and they each print a warning before they run. Read them once:

• Thermal daemon (Mode 4, and only Mode 4 by default). com.apple.thermalmonitord on Apple Silicon, com.apple.thermald on Intel. Turning it off removes the CPU's thermal throttling. The machine still boots — it can also overheat. On a laptop, that's permanent hardware damage territory. You have to type YES, not just y, to include it.
• Hibernation off (Mode 4, opt-in). hibernatemode 0 stops writing the RAM-sized sleepimage on sleep. Saves SSD space and write wear. If the battery drains completely while asleep, unsaved work is gone — there's no disk fallback.
• FileVault off (Mode 4, opt-in). On Apple Silicon the encryption is hardware-accelerated, so the speed gain is roughly zero and you lose whole-disk encryption. There's also a documented FileVault boot-loop bug on 12.3 multi-volume setups. The script tells you this, then asks again.
• Network buffer tuning (Mode 4, opt-in). The ESnet values (win_scale_factor 8, 32 MB autotune buffers) are for wired 1Gbps+ links. On Wi-Fi they can reduce throughput.
• debug.lowpri_throttle_enabled=0 (Mode 3+). Removes the background-task CPU throttle. Real latency win; costs some heat. It's a sysctl — it reverts on reboot, and the script also records and restores the old value.

Kernel settings applied in a run are re-applied at boot by a generated LaunchDaemon (/Library/LaunchDaemons/com.macos-debloater.sysctl.plist) and removed on restore. That's the persistence mechanism, and it's the reason the script doesn't use /etc/sysctl.conf — macOS 15+ (SIP intact) doesn't reliably load it.

---

What you should not do

The research behind the risky modes turned up a short list of "optimizations" that break machines. They are deliberately not in the script:

• Disabling swap or memory compression. vm.compressor_mode / swap-off causes kernel panics under memory pressure. The "you can reclaim GBs of RAM" claim is the single most dangerous piece of debloat lore on the internet. Not in here.
• kern.maxfiles sysctls. Already ~300k on modern macOS. The real fix for "too many open files" is per-process via launchctl limit maxfiles, which the script does (65536/131072).
• Deleting launchd plists. The script never deletes a plist. Deleting plists is what actually bricks boot; launchctl disable is the reversible path.

---

Install

curl -fsSL https://raw.githubusercontent.com/blessed0x/macos-debloater/main/install.sh | bash

The installer prints the banner, downloads macos-debloater.sh from this repo with a spinner, verifies it's a valid bash script, and installs it to /usr/local/bin (auto-elevating with sudo when needed). It doesn't run the debloater, doesn't phone home, and doesn't leave anything behind except the script.

Uninstall is deleting one file:

sudo rm /usr/local/bin/macos-debloater

---

What's in the repo

macos-debloater/
├── macos-debloater.sh      the whole tool: catalog, TUI, apply, restore
├── install.sh              curl one-liner installer (banner + progress)
└── README.md               this file

Inside macos-debloater.sh

A single bash script, sections in order:

macos-debloater.sh
├── env                    OS/CPU/RAM detection, system-wide state paths
├── config                 enterprise presets loaded before the TUI
├── OS support + SIP       refuses unsupported macOS; SIP gate + Recovery help
├── deny list              boot/critical services that are never disabled
├── CATALOG                204 service entries: label|hint|tier|group|since|desc
├── residency              KeepAlive -> RAM / cond / on-demand, per entry
├── resolve                matches every label to a real plist on this macOS
├── service actions        launchctl disable/enable, per-user gui domain
├── snapshot + restore     disabled-DB snapshot, manifest, generated restore.sh
├── optimization tweaks    defaults / pmset / sysctl / mdutil, old values saved
├── output                 catalog listing, header, mode notes
├── TUI                    the menu: 14 items, mouse + keyboard
├── prompts + gates        thermal YES-gate, double-confirm, reboot prompt
├── silent fleet run       AUTO_APPLY: config replaces the TUI, no prompts
└── main                   load_config -> TUI (or silent) -> SIP gate -> apply

Runtime state (written when you run it)

/Library/Application Support/macos-debloater/
├── config                 your presets (MODE, AUTO_APPLY, ...)
├── manifest.txt           what the last run disabled
├── restore.sh             generated: re-enables everything in the manifest
├── backups/<timestamp>/   one directory per run
│   ├── disabled.plist.bak        system disabled DB
│   ├── disabled.<uid>.plist.bak  per-user disabled DBs (every account)
│   ├── disabled-print.txt        launchctl print-disabled for all domains
│   ├── opts-backup.txt           old defaults/pmset/sysctl values
│   ├── mdutil-backup.txt         Spotlight index state
│   └── sysctl-applied.txt        sysctls to re-apply at boot
└── ...and the boot plist:
    /Library/LaunchDaemons/com.macos-debloater.sysctl.plist

The catalog format

Each line in CATALOG:

com.apple.somethingd|gui|2|cloud|12|What it does, honestly

Field	Meaning
label	launchd label, e.g. com.apple.somethingd
hint	gui or system domain hint
tier	risk tier: 1 safe, 2 aggressive, 3 thermal, 4 dangerous
group	cloud / maps / media / store / network / access / misc
since	first macOS this entry applies to (older ignored)
desc	one-line description shown in the plan and catalog

The script only acts on an entry if the plist resolves on the running macOS — a wrong guess degrades to "skipped," never to "disabled something important."

---

DIY

git clone https://github.com/blessed0x/macos-debloater.git
cd macos-debloater
bash -n macos-debloater.sh        # syntax
shellcheck macos-debloater.sh     # lint, clean at warning level

To add a catalog entry, add a line to CATALOG in the script per the format above.

---

No affiliation with Apple. macOS is a trademark of Apple Inc. This tool modifies your system; test in dry-run first, and keep the restore script it writes.