macbonk

an interactive macOS security and privacy hardening CLI tool, built on top of drduh/macos-security-and-privacy-guide

This automation script operationalizes a curated set of hardening techniques for macOS security and privacy. The guide is targeted to power users who wish to adopt enterprise-standard security, but is also suitable for novice users with an interest in improving their privacy and security on a Mac.

curl -fsSL https://raw.githubusercontent.com/0xhsn/macbonk/main/install.sh | bash

This installs Bun (if missing), clones the repo, and creates the macbonk command.

Or from source:

git clone https://github.com/0xhsn/macbonk.git
cd macbonk
bun install
bun bin/macbonk.ts

# Interactive mode - walk through each category and step
macbonk

# Preview what would change without executing anything
macbonk --dry-run

# Run everything without prompting
macbonk --yolo

# Run everything in dry-run (audit mode)
macbonk --yolo --dry-run

# Run a single category
macbonk --category firewall

# List all categories and steps
macbonk --list

Each hardening recommendation from the drduh guide is defined as a declarative step:

{
  id: 'fw.enable-stealth',
  title: 'Enable Stealth Mode',
  description: "Don't respond to ping or connection attempts from closed ports",
  commands: ['sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setstealthmode on'],
  dangerLevel: 'low',
  requiresSudo: true,
}

Steps are grouped into categories. In interactive mode, you see each step with its description, danger level, and the actual command - then choose to apply, skip, info, or quit. A summary report is shown at the end.

• 62 hardening steps across 11 categories
• Interactive step-by-step walkthrough with apply/skip per item
• --yolo flag to run everything without prompting
• --dry-run mode to preview changes without touching anything
• Built with Ink (React for CLIs) and Bun

Steps marked HIGH or CRITICAL include a warning explaining the risk.

• macOS (any version)
• That's it - the install script handles everything else

PRs welcome. To add a new hardening step, create an entry in the appropriate file under src/steps/. Each step is just a TypeScript object - no code to write, just data.

What makes a good step:

• Has a clear security or privacy benefit
• Can be automated via a shell command
• Is documented in the drduh guide or similar reputable source

Running tests:

bun test