ClamAV on your Mac, without the Terminal.
ClamAV is a widely used open-source antivirus engine. OpenNavo runs it with the official virus database and adds quick, full and scheduled scans, plus a check before you install. It’s free, and your files never leave your Mac.
Free · macOS 13 or later · Apple silicon and Intel
What ClamAV is
ClamAV is an open-source antivirus engine maintained by Cisco Talos and released under GPL-2.0. It recognizes known malicious files by matching them against its signature database, which keeps being updated. On its own it’s a set of command-line tools: after installing it with Homebrew (brew install clamav), freshclam downloads the database and clamscan scans files.
How OpenNavo uses it
The official database
Downloaded straight from ClamAV’s official servers, not through OpenNavo: about 113 MB the first time, then only what changed. Updates are checked every 4 hours by default.
Quick, full, custom and scheduled scans
A quick scan covers what startup items run, Downloads, the Desktop, temporary folders and apps installed in the last 7 days. A full scan covers the whole Mac except the system volume, iCloud files that aren’t downloaded, Time Machine and network volumes.
Scans before installing
Apps installed through OpenNavo are scanned after Homebrew downloads them and before they’re installed. If a threat is found, the install stops.
A quarantine you can undo
Threats go to quarantine by default, so you can restore a file if it turns out to be a false alarm.
Memory only while scanning
The engine uses about 1.1 GB of memory while scanning and quits after 5 idle minutes.
Where ClamAV falls short on a Mac
- Its database covers Mac-specific malware only partly, so a scan that finds nothing doesn’t prove a Mac is clean.
- It recognizes known threats by their signatures. New or changed malware can go unnoticed until signatures for it are added.
- OpenNavo can’t stop a program before its first run yet: that needs Apple’s Endpoint Security entitlement. New downloads and new startup items are checked as soon as they appear.
- Ordinary files over 100 MB, and installers over 1 GB or over 2 GB unpacked, aren’t scanned in full.
What OpenNavo checks besides ClamAV
These checks cover what a virus database can’t see:
Signatures and notarization
Installed apps’ signatures and notarization are checked, with an alert if an app’s developer signature changes.
Startup items
20 kinds of startup items, from launch agents to browser extensions, with who signed each one and which app it belongs to.
System check-up
11 macOS settings, including Gatekeeper, FileVault and the state of Apple’s XProtect, so you see at a glance what’s off.
Optional VirusTotal lookup
With your own API key, look up a file’s SHA-256 on VirusTotal. Only the hash is sent; files are never uploaded.
Other Mac security apps in the catalog
These apps are listed in OpenNavo’s catalog too, if you want to compare. Each comes from its own developer and has no partnership with OpenNavo.
Questions
Is ClamAV the same as XProtect?
No. XProtect is the malware protection Apple builds into macOS, with Apple’s own rules. ClamAV is a separate open-source engine with its own database. OpenNavo scans with ClamAV and also shows whether XProtect is up to date.
Is it free?
Yes. ClamAV is open source, its database is free, and OpenNavo is open source under GPL-3.0, with no account needed.
Are my files uploaded?
No. Scans run on your Mac and the results stay there. The optional VirusTotal lookup only sends a file’s SHA-256, and only after you turn it on.
Can I use ClamAV without OpenNavo?
Yes. Install it with Homebrew (brew install clamav), set up freshclam to download the database, then scan with clamscan. OpenNavo does the same in a window, with scheduled scans and a quarantine.
More on Mac security
Scan your Mac with ClamAV.
OpenNavo is free and open source for macOS 13 and later. The first time you scan, it asks before downloading the official virus database.
brew install --cask opennavo