# A process inspector for your Mac, built into your activity monitor.

Canonical page: https://vitalsmac.com/features/process-inspector

Click any process and its drawer shows the app it belongs to, its code signature and Team ID, its entitlements, its parent process and launch agent, its full command line, and the CPU time, memory, open files and listening ports it has used since it started. An app adds its version, bundle ID and Info.plist. Save it as CSV, or get the same from `vitals process` in Terminal.

## Identity: The app behind a process, its code signature and its entitlements.

The drawer opens with the app a process belongs to and what kind of process it is: a browser tab, an extension, a GPU process, a dev server. Then its code signature, with the developer's name and Team ID, whether it uses the hardened runtime and a sandbox, every entitlement it holds, and whether it was built for Apple silicon, Intel or both and is running through Rosetta.

- The app it belongs to, and whether it is a tab, an extension or a helper
- The code signature, with the Team ID; Apple’s own say Apple
- Hardened runtime, sandbox, and every entitlement
- Built for Apple silicon, Intel or both, and whether Rosetta runs it

## Launch: The parent process, the launch agent and the full command line.

Every process has a parent, and Vitals names it, with the app that launched it and, for a background process, the launchd agent or daemon that starts it at login. The full command line turns a bare `node` or `python` into the dev server for a project you know. Under it, the child processes it started, each a click away.

- Parent process and the app that launched it, each a link
- The launch agent or daemon that starts it at login
- The full command line, and its environment when you open it
- Child processes, each with its own numbers

## Usage: CPU time, memory peak, open files and listening ports since it started.

A percentage is about this second. The drawer covers the process's whole life: CPU time since it started, split into its own work and the kernel's work for it; memory now against the most it has ever held; threads, open files, page-ins, bytes read and written, and the ports it listens on, with a live chart of CPU and memory while the drawer is open.

- CPU time, split into user and system
- Memory now, as a share of its lifetime peak
- Threads, open files, page-ins, disk read and written
- Listening ports, and live charts while the drawer is open

## Apps: An app’s version, bundle ID and Info.plist, with every process under it.

Open an app and its Details card gives the version, bundle ID, location, code signature and what starts it, with the whole Info.plist one click away. Its processes are listed underneath, each a click from its details. One that just started carries a New mark, and the ones that ended in the last ten minutes stay listed, so a crash or a helper that came and went is not lost.

- Version, bundle ID and the whole Info.plist
- Every process, with a New mark on one that just started
- Ended Recently: what closed in the last ten minutes
- Pick the table’s columns, and filter with `/a regex/`

## Export: Export a process as CSV, or run vitals process in Terminal.

Every drawer has an export menu: Copy as Text for a message or a bug report, Save as CSV for a spreadsheet, Info.plist and entitlements included. In Terminal, `vitals process` gives the same for any process by name or PID, and an AI assistant gets it over MCP through the `process_details` tool.

- Copy as Text, or Save as CSV
- `vitals process node`, or by PID, with `--json` for scripts
- `--env` adds the environment, `--plist` the Info.plist
- The `process_details` tool for Claude, Codex and Cursor over MCP

## Why it matters: process inspector on a Mac

Activity Monitor's Inspect window gives a process its parent, its user, CPU time, memory, open files and ports, and a sample. It does not say who signed it, which app a bare `node` belongs to, what starts it at login, or what the whole command line was. For those you open Terminal: `codesign` for the signature, `ps` for the arguments, `launchctl` for what starts it, `lsof` for the ports, and `plutil` for the Info.plist.

The question is usually simpler than that. What is this? A process called Helper, a `python` nobody remembers starting, something with a name like `com.apple.something` using half a core. Is it part of an app I installed, is it Apple's, and should it be running?

Vitals answers in one drawer: the app the process belongs to and what kind of process it is, its code signature and entitlements, its parent and its command line, the processes it started, and the CPU time, memory, files and ports it has used since it launched, with the version, Info.plist and entitlements folded underneath. The same answer comes as CSV, as `vitals process` in Terminal, and as a tool for an AI assistant.

## How to use it

1. **Click any process to open its drawer.** In any tab, click an app and then one of its processes, or hover over a process in an app's drawer and click the ⓘ. The drawer opens on it. ⌘F finds a process by name, and `/a pattern/` searches with a regular expression.
2. **Read the drawer section by section.** Identity, then App or Executable, Security, Resource Usage, Disk, Network and Child Processes. Info.plist, Entitlements and Environment are folded until you open them. The parent, the launcher and each child are links: click one to jump to it.
3. **Choose the columns of the process table.** The Columns button in the toolbar adds or removes a tab's columns: PID, user, path, version, start time, idle wake-ups and the readings. Each tab keeps its own choice.
4. **Copy it, save it as CSV, or ask in Terminal.** The share button in the drawer's header offers Copy as Text and Save as CSV. In Terminal, `vitals process <name>` or `vitals process <pid>`, with `--json`, `--env` or `--plist`. Over MCP, the `process_details` tool.

## Compared with Activity Monitor

| | Activity Monitor | Vitals |
| --- | --- | --- |
| Details for one process | An Inspect window: parent, user, CPU time, memory, open files and ports | Those, and its app, signature, entitlements, command line, what starts it, lifetime peak and children |
| Code signature | Not shown; `codesign` in Terminal | Signer, Team ID, hardened runtime, sandbox and entitlements |
| Parent process and command line | The parent PID | Parent, the app that launched it, the launchd job, and the command line |
| An app’s version and Info.plist | Not shown | Version, bundle ID and the whole Info.plist |
| A process that ended | Gone from the list | Ended Recently, for ten minutes |
| Export | A sample or a spindump, as text | Copy as Text, Save as CSV, `vitals process --json` |
| Sampling and spindumps | Yes | No |

## The words behind it

- [PID](https://vitalsmac.com/glossary/pid): A PID, or process ID, is a number macOS assigns to each running process to identify it.
- [launchd](https://vitalsmac.com/glossary/launchd): launchd is the first process macOS starts at boot, with process ID 1.
- [Helper processes](https://vitalsmac.com/glossary/helper-processes): Helper processes are separate processes an app starts to do part of its work, such as rendering web pages, running extensions, or handling graphics.
- [Threads](https://vitalsmac.com/glossary/threads): A thread is a separate line of execution inside a process, and a process can run several threads at the same time on different CPU cores.
- [Listening port](https://vitalsmac.com/glossary/listening-port): A listening port is a network port where a process is waiting for incoming connections, such as a web server on port 3000.
- [WindowServer](https://vitalsmac.com/glossary/windowserver): WindowServer is the macOS system process that manages windows, composites what apps draw into the final image on your displays, and routes input events such as clicks and key presses to the right app.
- [Sample Process](https://vitalsmac.com/glossary/sample-process): Sample Process is an Activity Monitor tool that records what a selected process is doing over a few seconds and produces a text report of where its threads spend their time.
- [Force Quit](https://vitalsmac.com/glossary/force-quit): Force Quit ends an app or process immediately, without letting it save or clean up.

## Questions

### How do I open the Process Inspector?

Click a process in any list and its drawer opens. In an app's drawer, every process is a row: click one, or the ⓘ that appears beside it when you hover. Press ⌘F to find a process by name, and type `/a pattern/` to search with a regular expression.

### What does a process’s code signature tell me?

Who built the code. A name with a Team ID is a developer Apple has identified, such as Google LLC or Docker Inc. Apple's own processes say Apple. "Signed, with no certificate" is a tool built on a Mac and signed by nobody in particular, which is normal for Homebrew and for what you compile yourself. "Not signed" means no signature at all. Under it: whether it uses the hardened runtime, whether it runs in a sandbox, and every entitlement it was granted.

### Can Vitals tell me whether a process is safe, or malware?

It gives you the facts to judge: the code signature, the parent process, where it lives, and what it is doing. A known maker with a Team ID, a sandbox, and a parent you recognize is what you want to see. No signature, a path in a hidden folder, and a launch agent you never installed deserve a closer look. Vitals does not scan for malware; it tells you what is there.

### What is CPU time, and why is it split into user and system?

CPU time is how long the process has kept a core busy since it launched, added up: a process at 50% of one core for two hours has used an hour. User time is the process's own work; system time is work the kernel did for it, like reading files or talking to the network. A high system share on a process that does little usually means it is busy asking macOS for things.

### Why do some processes show fewer details than others?

macOS shows a process's command line, environment and lifetime totals only to the user it runs as. A process that belongs to macOS or to another account keeps those to itself; its identity, signature and figures still show, the figures through Vitals' optional helper. Turn on Full System Metrics in Settings → General to get them.

### Does it show macOS processes like WindowServer and kernel_task?

Yes. Their app is macOS, their signature is Apple's, and their parent is launchd. With the helper on, their CPU and memory show as well, and the drawer's charts run while it is open.

### Can I see a process's environment variables?

Yes, in the Environment section at the end of the drawer, folded until you open it, and in Terminal with `vitals process --env`. They are never passed to an AI assistant, since environments often hold keys.

### How long does Vitals keep a process after it has ended?

Ten minutes, in the app's drawer, with its name, when it started and ended, and the memory it held. So a helper that crashed, or a build that finished while you were away, is still there to see.

### Can I get a process’s details in Terminal, or from an AI assistant?

Yes. `vitals process node` or `vitals process 60412` gives the same details, as text or with `--json` for a script; `--env` adds the environment and `--plist` the app's Info.plist. An assistant such as Claude, Codex or Cursor gets it through the `process_details` tool of Vitals' MCP server, Info.plist included when it asks.

### Can it sample a process or take a spindump?

No. Those are Activity Monitor's, and Vitals does not copy them. Vitals answers what a process is, with its code signature, its parent and its resource use; for a stack trace of a hung app, open Activity Monitor and press Sample.

## Read on

- [Process Explorer for Mac: the built‑in tools, and the 5 best apps](https://vitalsmac.com/process-explorer-for-mac)
- [How to check CPU and memory usage on a Mac, app by app](https://vitalsmac.com/check-cpu-memory-usage-mac)
- [Why is my Mac so slow? How to find the cause, and fix it](https://vitalsmac.com/why-is-my-mac-so-slow)
- [Claude Code using too much memory or CPU on a Mac? How to find it, and get it back](https://vitalsmac.com/claude-code-memory-usage-mac)
- [The 12 best Activity Monitor alternatives for Mac](https://vitalsmac.com/best-activity-monitor-alternatives)
- [Vitals vs Activity Monitor](https://vitalsmac.com/vs/activity-monitor)
- [Vitals vs ProcessSpy](https://vitalsmac.com/vs/processspy)
- [Vitals vs ProcXray](https://vitalsmac.com/vs/procxray)

## More of Vitals

Every feature is at [vitalsmac.com/features](https://vitalsmac.com/features). Vitals is paid once, with a year of updates or every update for life: [pricing](https://vitalsmac.com/pricing).