A diagnostic agent for macOS that combines deep static inspection of installed apps with live process state, JVM toolchain awareness, and engineer-to-engineer remote debugging over Tailscale.
git clone https://github.com/kaeawc/spectra.git
cd spectra
make build
./spectra /Applications/Slack.appAPP UI RUNTIME PACKAGING CONFIDENCE
------------------------------------------------------------------------------------------------
Slack Electron Node+Chromium high
Spectra answers questions Activity Monitor structurally cannot:
- What framework is this app built with — Electron, Tauri, Compose Desktop, Mac Catalyst, custom Swift+WebKit?
- What entitlements has it declared, what permissions has the user granted, and which is it actively using right now?
- What is its real on-disk storage footprint, accounting for sparse files like Docker's VM disk?
- What hosts does its code reference?
The full inspection picks up: bundle ID, app version, Electron version,
architectures, code-sign team, hardened runtime, sandbox status, declared
entitlements, declared privacy purposes, granted privacy permissions
(from TCC.db), third-party frameworks, embedded npm packages, helper apps,
XPC services, plugins, login items, running processes with RSS, and the
storage footprint across eight ~/Library locations. With --network,
also extracts every URL host referenced in the binary and app.asar.
Today: a Go CLI plus optional daemon and privileged helper. Spectra does
deep .app inspection, live process/network/storage/power inventory,
JVM and toolchain diagnostics, SQLite-backed snapshots and diffs,
recommendation rules, issue tracking, JSON-RPC over Unix socket or
explicit TCP, and optional Tailscale tsnet daemon exposure.
Implemented code with passing tests is treated as complete in the docs. Code whose tests are failing or absent is documented as partial until the test suite catches up.
Full living docs at docs/:
- Quickstart — common commands and outputs
- Architecture — daemon, helper, and clients
- Distribution — why MAS is out, why Homebrew
- Storage stack — SQLite + sharded blob store
- Detection model — the three-layer classifier
- Result schema — JSON output contract
Local docs preview:
make docs-install # mkdocs + lychee
make docs-serve # http://127.0.0.1:8080- macOS (detection shells out to
plutil,otool,codesign,file,sqlite3— all preinstalled) - Go 1.26+ for source builds
MIT.