Vitals 1.9: the Process Inspector, for any process on your Mac

Activity Monitor gives a process a name and a number. In Vitals, click any process and a drawer opens beside the table with everything macOS will say about it, section by section.

1. 01 Click a process in the table, or click an app and then any process in its drawer.
2. 02 Under the pointer, a process in an app’s drawer shows an ⓘ beside its close mark. That opens the same details.
3. 03 Click a parent or a child in the drawer to follow it.

The whole tour is on the Process Inspector page.

A process called Helper tells you nothing, so start with who built it. The Security section gives the developer’s name and Team ID, says whether the process uses the hardened runtime and runs in a sandbox, and lists every entitlement it holds, with its value.

A name with a Team ID is a developer Apple has identified. “Signed, with no certificate” is normal for Homebrew and for what you compile yourself. “Not signed” means no signature at all.

Identity names the parent process and the app that launched it. For a background process, Startup names the launch agent or daemon behind it, so this postgres turns out to be the Homebrew service sh.brew.postgresql@17. The executable’s path and the full command line sit underneath, and the environment is folded at the end of the drawer.

A percentage only tells you about this second. The drawer covers the process’s whole life: CPU time split into user and system, memory now against the most it has ever held, threads, open files, page-ins and bytes read and written. Below that are the ports it listens on and the child processes it started, each a click away. A chart of its CPU and memory runs while the drawer is open.

Open an app and its Details card gives the version, bundle ID, architecture, code signature, protection, what starts it and where it is installed, with the whole Info.plist one click away.

Its processes are listed underneath, and each opens its own drawer. One that started seconds ago carries a New mark, and Ended Recently keeps what ended in the last ten minutes, so a helper that crashed or a build that finished while you were away is still there to see.

The share button in a drawer’s header offers Save as CSV and Copy as Text, with the Info.plist, entitlements, environment and processes included. vitals process gives the same details by name or PID. vitals top can now look back too: give it a time, and it tells you which apps used the most then.

Vitals keeps apps by the hour for two days and by the day after that, and the answer says which span it covers.

Claude, Codex and Cursor can ask Vitals about any process through the process_details tool, and see the apps behind each peak in your history. The environment is never passed to them, since it can hold keys.

• What is this process called node, and which app does it belong to?
• Is the process using port 3000 signed, and what launched it?
• Which apps were behind the CPU spike at 14:02?

A new Columns menu in the toolbar adds PID, User, Start Time, Version and Path to the app table. The filter also takes a regular expression between slashes, such as /helper|agent/.