fort

Key Features

• •One-Command Audit: Run `fort` to scan over 15 macOS security controls including disk encryption, firewall, screen lock, SSH, and Gatekeeper in under three seconds. View a clear pass/fail status, current state, and expected state for each check — no interpretation needed. Benefit: Instant visibility into your Mac's security posture.
• •Automatic Remediation: Use `fort --fix` to automatically apply secure settings for fixable controls like screen lock delay, AirDrop restrictions, and Touch ID for sudo. The `--dry-run` flag shows all proposed changes before execution, ensuring transparency and preventing unwanted modifications.
• •Audit-Ready HTML Reports: Generate a self-contained HTML report with `fort --report` that includes machine identity, per-check results, exact commands run, and compliance mappings to SOC 2, ISO 27001, NIST CSF, and CIS v8. Print to PDF in one click for auditor evidence.
• •Claude Code Integration: Install the fort plugin for Claude Code and ask conversational questions like 'Is my Mac secure?' The AI runs the audit, explains each finding, and fixes only what you approve. Read-only until you say otherwise, giving you full control.
• •Zero Network Calls: Fort reads local system state using stable macOS APIs and performs no network calls. No account, no telemetry, no data upload. Every check prints the exact command it ran, so you can verify the tool's behavior instead of trusting it blindly.
• •Comprehensive Security Checks: Over 15 controls verified using documented APIs: FileVault, firewall, Gatekeeper, SIP, SSH, sharing services, automatic updates, guest account, automatic login, Touch ID for sudo, password manager detection, antivirus/EDR detection, and more. No private frameworks or guesswork.
• •Compliance Framework Mapping: Each check references relevant controls in SOC 2, ISO 27001, NIST CSF, and CIS v8. The report provides context for compliance teams tracking their security benchmarks, making it easy to demonstrate adherence during audits.

Use Cases

• •Developer workstation hardening: A developer runs `fort` on their Mac before starting sensitive work. It finds that SSH is enabled and the guest account is active. They run `fort --fix` to disable both, then `fort --report` to keep a record. Outcome: A hardened workstation with disabled services and an audit trail.
• •Small team compliance checks: A consulting team without MDM needs to verify security baselines across multiple Macs. They install fort on each machine via Homebrew, run `fort` to audit, fix issues with `--fix`, and generate HTML reports for each. Outcome: Consistent security checks and evidence for client compliance.
• •Security audit evidence for SOC 2: A security lead runs `fort --report` on a Mac to collect evidence for a SOC 2 audit. The report automatically maps each check to SOC 2 controls, includes the exact command output, and prints to PDF. Outcome: Auditor-ready evidence with no extra effort.
• •Privacy audit from a conversation: A Mac user installs the fort plugin for Claude Code and asks 'Is my Mac secure?' Claude runs the audit, explains that AirDrop is set to Everyone and screen lock is off, then fixes only those after user approval. Outcome: A secure Mac without learning terminal commands.
• •Immediate fix for known vulnerabilities: After a security advisory, a system administrator runs `fort` across their fleet to check if automatic updates and Gatekeeper are enabled. They find several Macs with outdated settings and use `fort --fix` to remediate. Outcome: Rapid mitigation of vulnerabilities across Macs.

Who is this for?

Fort is designed for developers who need to quickly verify and harden their workstation security using a terminal-based tool; privacy-conscious individuals who want a zero-telemetry, no-account security scanner they can inspect and trust; small teams and consultants who need a repeatable, command-line-driven method to assess and lock down Macs without enrolling in mobile device management; and security professionals or compliance officers who require auditable evidence for frameworks like SOC 2, ISO 27001, NIST CSF, and CIS v8. System administrators managing a small fleet of Macs can also benefit from its fast, scriptable audit and fix capabilities.