Paste protection
When you press ⌘V to paste a suspicious “download and run” command into a terminal, OpenNavo pauses and asks first. The check runs locally, and nothing you paste is stored.
Security
Free, open-source antivirus for Mac, from the moment you install.
OpenNavo scans your Mac with the ClamAV engine and its official database, then adds pre-install scans, download checks, startup item reviews and signature check-ups. Everything runs on your Mac: no uploads, no account.
Free · macOS 13 or later · Apple silicon and Intel
Layers
Six checks, each with its own job.
The virus database recognizes known malicious files. Signature, notarization and startup item checks cover what a database can’t see.
Quick, full and scheduled scans
A quick scan checks Downloads, the Desktop and startup items in minutes and can run every day or week. A full scan covers the whole Mac.
Scanned before install
After Homebrew downloads an app and before it installs, the download is scanned. A threat stops the install.
New downloads, checked
OpenNavo watches your Downloads folder and scans each file when it finishes. Installers also get a signature and notarization check.
Startup items
Twenty kinds, from background services and login items to browser extensions, each with its signature and owning app. New ones trigger an alert right away.
Signature check-up
Checks the signature and notarization of every installed app, and warns you when an app’s developer signature suddenly changes, a sign it may have been replaced.
System check-up
SIP, Gatekeeper, FileVault, the firewall, XProtect and six more settings, so you can see at a glance what’s switched off.
Malware scans
The usual hiding spots in minutes, or the whole Mac.
The engine uses about 1.1 GB of memory while scanning and quits after 5 idle minutes. Threats can be quarantined, deleted or trusted, and anything in quarantine can be restored.
- Usually a few minutes
Quick Scan
Programs that startup items run, Downloads, Desktop, temporary folders and apps installed in the last 7 days
- Can take over an hour
Full Scan
The whole Mac, except the system volume, iCloud files not downloaded, Time Machine and network volumes
- Depends on what you choose
Custom Scan
Choose folders or an external drive
- Daily or weekly
Scheduled scans
A quick scan at the time you set. It runs only while OpenNavo is open, skips when on battery and never wakes your Mac
Startup items
Everything that starts on its own, in one list.
Twenty kinds of startup items, grouped by app, with signature, notarization and owner shown. New items trigger an alert right away, and anything you disable or remove can be restored.
- Apple, known developers and unsigned programs are told apart, so suspicious items stand out
- An alert the moment a new startup item, login item or background service appears
- Items are backed up before they’re disabled or removed, so you can always restore them
The 20 kinds of startup items it checks
- Background service
- Background item
- Login item
- Scheduled task
- Browser extension
- Kernel extension
- System extension
- App extension
- Authorization plug-in
- Directory services plug-in
- Spotlight importer
- Quick Look plug-in
- Dock tile plug-in
- Library injection
- Library proxy
- Login hook
- Periodic script
- Startup script
- Shell configuration
- Event rule
System check-up
Is macOS’s own protection switched on?
A read-only check of 11 system settings that changes nothing. When something needs fixing, OpenNavo opens the right pane in System Settings.
Optional extras
Off by default, there when you want them.
VirusTotal lookup
Look up a file’s SHA-256 on VirusTotal with your own API key. Only the hash is sent; the file never leaves your Mac.
Your files stay on your Mac.
Scanned locally
Scans run on your Mac, and results are stored only there.
Official database
The database comes straight from ClamAV’s official servers, not through OpenNavo.
No uploads
The optional VirusTotal lookup sends only a file’s SHA-256, and only if you turn it on.
Questions
Does a Mac need antivirus?
macOS ships with Gatekeeper, notarization and XProtect, which stop many known threats. Cracked software, installers from unknown sites and commands pasted into Terminal are still common ways in. OpenNavo adds a check at each of those points. It complements the protection in macOS rather than replacing it.
Where does the virus database come from, and how often is it updated?
It’s ClamAV’s official database, downloaded straight from ClamAV’s servers rather than through OpenNavo. The first download is about 113 MB (about 170 MB on disk). After that, OpenNavo checks every 4 hours by default and downloads only the changes.
Will it slow my Mac down?
The engine uses about 1.1 GB of memory while scanning and quits after 5 idle minutes, so it uses nothing the rest of the time. Scheduled scans run only while OpenNavo is open, skip when on battery and never wake your Mac.
Does it upload my files?
No. Scans run on your Mac and results stay there. The optional VirusTotal lookup has to be turned on with your own API key, and even then it sends only the file’s SHA-256.
Does it block malware in real time?
New downloads and new startup items are checked as soon as they appear, and you’re alerted right away, but OpenNavo can’t yet stop a program before its first run. Real-time blocking needs Apple’s Endpoint Security entitlement and will come once it’s granted.
Will it catch every piece of Mac malware?
No antivirus can promise that. ClamAV’s coverage of Mac-specific malware is limited, which is why OpenNavo also checks signatures, notarization and startup items, and shows the status of XProtect. Ordinary files over 100 MB, and installers over 1 GB or over 2 GB once unpacked, aren’t fully scanned.
Is it really free?
Yes, and it needs no account. OpenNavo is open source under GPL-3.0, with its code on GitHub.
Give your Mac one more check.
OpenNavo is free, open source and runs on macOS 13 or later. The first time you scan, it asks before downloading the official database.
Or install with Homebrew (Not yet available)
$ brew install --cask opennavo