A process inspector for your Mac, built into your activity monitor.
Click any process and its drawer shows the app it belongs to, its code signature and Team ID, its entitlements, its parent process and launch agent, its full command line, and the CPU time, memory, open files and listening ports it has used since it started. An app adds its version, bundle ID and Info.plist. Save it as CSV, or get the same from vitals process in Terminal.
- Version
- 156.0.8078.74
- Bundle ID
- com.google.Chrome
- Architecture
- Universal · x86_64 · arm64
- Signature
- Google LLC · Team ID EQHXZ8M8AV
- Protection
- Hardened RuntimeNot Sandboxed
- User
- me
- Running For
- 6h 14m
- Location
- /Applications/Google Chrome.app
- Version
- 2.15
- Bundle ID
- com.apple.Terminal
- Architecture
- Apple silicon · arm64e
- Signature
- Apple
- Protection
- No Hardened RuntimeNot Sandboxed
- User
- me
- Running For
- 2d 6h
- Location
- /System/Applications/Utilities/Terminal.app
- Version
- 4.88.1
- Bundle ID
- com.docker.docker
- Architecture
- Apple silicon · arm64
- Signature
- Docker Inc · Team ID 9BNSXJN65R
- Protection
- Hardened RuntimeNot Sandboxed
- User
- me
- Running For
- 3d 1h
- Location
- /Applications/Docker.app
- Process ID
- 48190
- Parent Process
- launchd (1)
- Running For
- 6h 14m
- Bundle ID
- com.google.Chrome
- Version
- 156.0.8078.74
- Architecture
- Universal · x86_64 · arm64
- Signature
- Google LLC · Team ID EQHXZ8M8AV
- Hardened Runtime
- Yes
- Sandbox
- No
- Entitlements
- 1
- CPU Time
- 42m 10s User 32m 54s · 78%System 9m 16s · 22%
- Memory
- 412 MB · 61% of its 672 MB peak
- Threads
- 64
- Open Files
- 318
- Process ID
- 48211
- Parent Process
- Google Chrome (48190)
- Launched By
- Google Chrome (48190)
- Running For
- 6h 12m
- Version
- 156.0.8078.74
- Architecture
- Universal · x86_64 · arm64
- Arguments
- --type=renderer --lang=en-US --num-raster-threads=4 --enable-zero-copy
- Signature
- Google LLC · Team ID EQHXZ8M8AV
- Hardened Runtime
- Yes
- Sandbox
- No
- Entitlements
- 1
- CPU Time
- 12m 40s User 10m 23s · 82%System 2m 17s · 18%
- Memory
- 1.92 GB · 88% of its 2.18 GB peak
- Threads
- 23
- Open Files
- 96
- Process ID
- 48193
- Parent Process
- Google Chrome (48190)
- Launched By
- Google Chrome (48190)
- Running For
- 6h 14m
- Version
- 156.0.8078.74
- Architecture
- Universal · x86_64 · arm64
- Arguments
- --type=gpu-process --lang=en-US --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAAA
- Signature
- Google LLC · Team ID EQHXZ8M8AV
- Hardened Runtime
- Yes
- Sandbox
- No
- Entitlements
- 1
- CPU Time
- 18m 2s User 12m 37s · 70%System 5m 25s · 30%
- GPU
- 3%
- Memory
- 842 MB · 93% of its 904 MB peak
- Threads
- 31
- Open Files
- 142
- Process ID
- 48377
- Parent Process
- Google Chrome (48190)
- Launched By
- Google Chrome (48190)
- Running For
- 3h 40m
- Version
- 156.0.8078.74
- Architecture
- Universal · x86_64 · arm64
- Arguments
- --type=renderer --lang=en-US --num-raster-threads=4 --enable-zero-copy
- Signature
- Google LLC · Team ID EQHXZ8M8AV
- Hardened Runtime
- Yes
- Sandbox
- No
- Entitlements
- 1
- CPU Time
- 4m 51s User 4m 2s · 83%System 49s · 17%
- Memory
- 1.31 GB · 96% of its 1.36 GB peak
- Threads
- 21
- Open Files
- 88
- Process ID
- 581
- Parent Process
- launchd (1)
- Running For
- 2d 6h
- Bundle ID
- com.apple.Terminal
- Version
- 2.15
- Architecture
- Apple silicon · arm64e
- Signature
- Apple
- Hardened Runtime
- No
- Sandbox
- No
- Entitlements
- 6
- CPU Time
- 3m 12s User 2m 2s · 64%System 1m 10s · 36%
- Memory
- 148 MB · 71% of its 208 MB peak
- Threads
- 12
- Open Files
- 58
- Process ID
- 60120
- Parent Process
- login (60118)
- Launched By
- Terminal (581)
- Running For
- 2d 5h
- Architecture
- Apple silicon · arm64e
- Arguments
- -zsh
- Signature
- Apple
- Hardened Runtime
- No
- Sandbox
- No
- CPU Time
- 1.2s User 0.7s · 58%System 0.5s · 42%
- Memory
- 12 MB · 60% of its 20 MB peak
- Threads
- 1
- Open Files
- 8
- Process ID
- 60412
- Parent Process
- zsh (60120)
- Launched By
- Terminal (581)
- Running For
- 2d 4h
- Architecture
- Apple silicon · arm64
- Arguments
- node_modules/.bin/next dev --port 3000
- Signature
- Node.js Foundation · Team ID HX7739G8FX
- Hardened Runtime
- Yes
- Sandbox
- No
- CPU Time
- 1h 52m User 1h 42m · 91%System 10m 5s · 9%
- Memory
- 486 MB · 61% of its 797 MB peak
- Threads
- 19
- Open Files
- 203
- Listening Ports
- 3000
- Process ID
- 60533
- Parent Process
- zsh (60120)
- Launched By
- Terminal (581)
- Running For
- 14s
- Architecture
- Apple silicon · arm64
- Arguments
- node_modules/.bin/vitest run --coverage
- Signature
- Node.js Foundation · Team ID HX7739G8FX
- Hardened Runtime
- Yes
- Sandbox
- No
- CPU Time
- 9.1s User 8.0s · 88%System 1.1s · 12%
- Memory
- 391 MB · 100% of its 391 MB peak
- Threads
- 27
- Open Files
- 412
- Process ID
- 20288
- Parent Process
- launchd (1)
- Running For
- 3d 1h
- Bundle ID
- com.docker.docker
- Version
- 4.88.1
- Architecture
- Apple silicon · arm64
- Signature
- Docker Inc · Team ID 9BNSXJN65R
- Hardened Runtime
- Yes
- Sandbox
- No
- Entitlements
- 7
- CPU Time
- 6m 4s User 4m 31s · 74%System 1m 33s · 26%
- Memory
- 112 MB · 48% of its 233 MB peak
- Threads
- 22
- Open Files
- 74
- Process ID
- 20311
- Parent Process
- Docker (20288)
- Launched By
- Docker (20288)
- Running For
- 3d 1h
- Version
- 4.88.1
- Architecture
- Apple silicon · arm64
- Arguments
- -watchdog -max-restarts 5
- Signature
- Docker Inc · Team ID 9BNSXJN65R
- Hardened Runtime
- Yes
- Sandbox
- No
- Entitlements
- 7
- CPU Time
- 3h 8m User 2h 0m · 64%System 1h 8m · 36%
- Memory
- 1.57 GB · 77% of its 2.04 GB peak
- Threads
- 48
- Open Files
- 241
- Process ID
- 20340
- Parent Process
- com.docker.backend (20311)
- Launched By
- Docker (20288)
- Running For
- 12s
- Version
- 4.88.1
- Architecture
- Apple silicon · arm64
- Signature
- Docker Inc · Team ID 9BNSXJN65R
- Hardened Runtime
- Yes
- Sandbox
- No
- Entitlements
- 1
- CPU Time
- 2.0s User 1.6s · 80%System 0.4s · 20%
- Memory
- 64 MB · 100% of its 64 MB peak
- Threads
- 9
- Open Files
- 31
- Process ID
- 20318
- Parent Process
- com.docker.backend (20311)
- Launched By
- Docker (20288)
- Running For
- 3d 1h
- Version
- 4.88.1
- Architecture
- Apple silicon · arm64
- Signature
- Docker Inc · Team ID 9BNSXJN65R
- Hardened Runtime
- Yes
- Sandbox
- No
- Entitlements
- 3
- CPU Time
- 1h 4m User 31m 12s · 49%System 32m 48s · 51%
- Memory
- 38 MB · 73% of its 52 MB peak
- Threads
- 14
- Open Files
- 46
The numbers are simulated: a web page cannot read your Mac, and should not.
The app behind a process, its code signature and its entitlements.
The drawer opens with the app a process belongs to and what kind of process it is: a browser tab, an extension, a GPU process, a dev server. Then its code signature, with the developer's name and Team ID, whether it uses the hardened runtime and a sandbox, every entitlement it holds, and whether it was built for Apple silicon, Intel or both and is running through Rosetta.
- The app it belongs to, and whether it is a tab, an extension or a helper
- The code signature, with the Team ID; Apple’s own say Apple
- Hardened runtime, sandbox, and every entitlement
- Built for Apple silicon, Intel or both, and whether Rosetta runs it
The parent process, the launch agent and the full command line.
Every process has a parent, and Vitals names it, with the app that launched it and, for a background process, the launchd agent or daemon that starts it at login. The full command line turns a bare node or python into the dev server for a project you know. Under it, the child processes it started, each a click away.
- Parent process and the app that launched it, each a link
- The launch agent or daemon that starts it at login
- The full command line, and its environment when you open it
- Child processes, each with its own numbers
CPU time, memory peak, open files and listening ports since it started.
A percentage is about this second. The drawer covers the process's whole life: CPU time since it started, split into its own work and the kernel's work for it; memory now against the most it has ever held; threads, open files, page-ins, bytes read and written, and the ports it listens on, with a live chart of CPU and memory while the drawer is open.
- CPU time, split into user and system
- Memory now, as a share of its lifetime peak
- Threads, open files, page-ins, disk read and written
- Listening ports, and live charts while the drawer is open
An app’s version, bundle ID and Info.plist, with every process under it.
Open an app and its Details card gives the version, bundle ID, location, code signature and what starts it, with the whole Info.plist one click away. Its processes are listed underneath, each a click from its details. One that just started carries a New mark, and the ones that ended in the last ten minutes stay listed, so a crash or a helper that came and went is not lost.
- Version, bundle ID and the whole Info.plist
- Every process, with a New mark on one that just started
- Ended Recently: what closed in the last ten minutes
- Pick the table’s columns, and filter with
/a regex/
Export a process as CSV, or run vitals process in Terminal.
Every drawer has an export menu: Copy as Text for a message or a bug report, Save as CSV for a spreadsheet, Info.plist and entitlements included. In Terminal, vitals process gives the same for any process by name or PID, and an AI assistant gets it over MCP through the process_details tool.
- Copy as Text, or Save as CSV
vitals process node, or by PID, with--jsonfor scripts--envadds the environment,--plistthe Info.plist- The
process_detailstool for Claude, Codex and Cursor over MCP
Process Inspector, before and after
Activity Monitor's Inspect window gives a process its parent, its user, CPU time, memory, open files and ports, and a sample. It does not say who signed it, which app a bare node belongs to, what starts it at login, or what the whole command line was. For those you open Terminal: codesign for the signature, ps for the arguments, launchctl for what starts it, lsof for the ports, and plutil for the Info.plist.
The question is usually simpler than that. What is this? A process called Helper, a python nobody remembers starting, something with a name like com.apple.something using half a core. Is it part of an app I installed, is it Apple's, and should it be running?
Vitals answers in one drawer: the app the process belongs to and what kind of process it is, its code signature and entitlements, its parent and its command line, the processes it started, and the CPU time, memory, files and ports it has used since it launched, with the version, Info.plist and entitlements folded underneath. The same answer comes as CSV, as vitals process in Terminal, and as a tool for an AI assistant.
Where it is in Vitals
The tab, the menu bar item and the setting, in the order you would reach for them.
- 01
Click any process to open its drawer
In any tab, click an app and then one of its processes, or hover over a process in an app's drawer and click the ⓘ. The drawer opens on it. ⌘F finds a process by name, and
/a pattern/searches with a regular expression. - 02
Read the drawer section by section
Identity, then App or Executable, Security, Resource Usage, Disk, Network and Child Processes. Info.plist, Entitlements and Environment are folded until you open them. The parent, the launcher and each child are links: click one to jump to it.
- 03
Choose the columns of the process table
The Columns button in the toolbar adds or removes a tab's columns: PID, user, path, version, start time, idle wake-ups and the readings. Each tab keeps its own choice.
- 04
Copy it, save it as CSV, or ask in Terminal
The share button in the drawer's header offers Copy as Text and Save as CSV. In Terminal,
vitals process <name>orvitals process <pid>, with--json,--envor--plist. Over MCP, theprocess_detailstool.
Process Inspector: Activity Monitor and Vitals
The whole comparison is row by row. These are the rows about process Inspector.
Activity Monitor 
Vitals codesign in Terminalvitals process --jsonThe words behind it
What the numbers mean, from the Activity Monitor glossary.
- PID
A PID, or process ID, is a number macOS assigns to each running process to identify it.
- launchd
launchd is the first process macOS starts at boot, with process ID 1.
- Helper processes
Helper processes are separate processes an app starts to do part of its work, such as rendering web pages, running extensions, or handling graphics.
- Threads
A thread is a separate line of execution inside a process, and a process can run several threads at the same time on different CPU cores.
- Listening port
A listening port is a network port where a process is waiting for incoming connections, such as a web server on port 3000.
- WindowServer
WindowServer is the macOS system process that manages windows, composites what apps draw into the final image on your displays, and routes input events such as clicks and key presses to the right app.
- Sample Process
Sample Process is an Activity Monitor tool that records what a selected process is doing over a few seconds and produces a text report of where its threads spend their time.
- Force Quit
Force Quit ends an app or process immediately, without letting it save or clean up.
Questions
The ones people ask about process Inspector before they buy.
How do I open the Process Inspector?
Click a process in any list and its drawer opens. In an app's drawer, every process is a row: click one, or the ⓘ that appears beside it when you hover. Press ⌘F to find a process by name, and type /a pattern/ to search with a regular expression.
What does a process’s code signature tell me?
Who built the code. A name with a Team ID is a developer Apple has identified, such as Google LLC or Docker Inc. Apple's own processes say Apple. "Signed, with no certificate" is a tool built on a Mac and signed by nobody in particular, which is normal for Homebrew and for what you compile yourself. "Not signed" means no signature at all. Under it: whether it uses the hardened runtime, whether it runs in a sandbox, and every entitlement it was granted.
Can Vitals tell me whether a process is safe, or malware?
It gives you the facts to judge: the code signature, the parent process, where it lives, and what it is doing. A known maker with a Team ID, a sandbox, and a parent you recognize is what you want to see. No signature, a path in a hidden folder, and a launch agent you never installed deserve a closer look. Vitals does not scan for malware; it tells you what is there.
What is CPU time, and why is it split into user and system?
CPU time is how long the process has kept a core busy since it launched, added up: a process at 50% of one core for two hours has used an hour. User time is the process's own work; system time is work the kernel did for it, like reading files or talking to the network. A high system share on a process that does little usually means it is busy asking macOS for things.
Why do some processes show fewer details than others?
macOS shows a process's command line, environment and lifetime totals only to the user it runs as. A process that belongs to macOS or to another account keeps those to itself; its identity, signature and figures still show, the figures through Vitals' optional helper. Turn on Full System Metrics in Settings → General to get them.
Does it show macOS processes like WindowServer and kernel_task?
Yes. Their app is macOS, their signature is Apple's, and their parent is launchd. With the helper on, their CPU and memory show as well, and the drawer's charts run while it is open.
Can I see a process's environment variables?
Yes, in the Environment section at the end of the drawer, folded until you open it, and in Terminal with vitals process --env. They are never passed to an AI assistant, since environments often hold keys.
How long does Vitals keep a process after it has ended?
Ten minutes, in the app's drawer, with its name, when it started and ended, and the memory it held. So a helper that crashed, or a build that finished while you were away, is still there to see.
Can I get a process’s details in Terminal, or from an AI assistant?
Yes. vitals process node or vitals process 60412 gives the same details, as text or with --json for a script; --env adds the environment and --plist the app's Info.plist. An assistant such as Claude, Codex or Cursor gets it through the process_details tool of Vitals' MCP server, Info.plist included when it asks.
Can it sample a process or take a spindump?
No. Those are Activity Monitor's, and Vitals does not copy them. Vitals answers what a process is, with its code signature, its parent and its resource use; for a stack trace of a hung app, open Activity Monitor and press Sample.
Read on
Guides that use this, and how Vitals compares with the apps people buy for it.
- Ranked Process Explorer for Mac: the built‑in tools, and the 5 best apps
- Guide How to check CPU and memory usage on a Mac, app by app
- Guide Why is my Mac so slow? How to find the cause, and fix it
- Guide Claude Code using too much memory or CPU on a Mac? How to find it, and get it back
- Ranked The 12 best Activity Monitor alternatives for Mac
- Comparison Vitals vs Activity Monitor
- Comparison Vitals vs ProcessSpy
- Comparison Vitals vs ProcXray
More of Vitals
All featuresCoding agents
Claude Code, Codex, Gemini CLI and the rest: each session with its project, what it is doing, and what it started.
AI usage limits
How much is left of Claude, Codex, Copilot and the rest, when each resets, and whether you will make it there.
MCP server
Your assistant asks what is running, which app is behind a number and what is on a port, instead of reading a process list.
Lifetime for $15 while the launch price lasts
50 left at this price. Then $39, or $9 for a year of updates. One payment, 14-day refund.
Get Vitals for $15