Oxid Inspect vs Apparency and Suspicious Package

If you have ever wondered who signed an app, whether Apple notarized it, or what an installer package will do to your Mac before you run it, you have probably met Mothers’ Ruin Software’s two free tools: Apparency for apps and Suspicious Package for packages. They are careful, mature and free. This page sets out what each one does, what Oxid Inspect does differently, and when you would pick which.

Apparency: inside Mac apps

Apparency opens app bundles, frameworks, plug-ins, executables and whole folders (how to use it). Its home page sums it up: “What did Gatekeeper say? Was it notarized? Is App Sandbox enabled? Inspect the code signature, Browse entitlements”, plus linked frameworks and the Info.plist (Apparency). It also shows launch constraints.

• Price: no charge. Its FAQ puts it as “we make the same $0 whether you use it or not” (FAQ).
• Command line: yes, a tool called appy (how to use it).
• Quick Look: yes, a preview extension for Finder (FAQ).
• Comparing: selecting several components shows only what they have in common; there is no side-by-side comparison of two versions (how to use it).
• Current version: 3.4 for macOS 14 through 27, notarized 16 September 2026 (download page).

Suspicious Package: inside installer packages

Suspicious Package opens .pkg files and installer receipts and shows “who signed it”, the installed files, the scripts it will run, whether Apple notarized it, and a review of potential issues sorted into critical, warning and info, while saying plainly that it “is not a malware detector” (Suspicious Package, how to use it).

• Price: free (“our zero-revenue model”, FAQ).
• Comparing packages: File > Compare Packages hands two packages to an external diff tool such as Kaleidoscope, BBEdit or Araxis, and it can export plain-text manifests for diffing (FAQ).
• Command line: yes, spkg (how to use it). Quick Look: yes.
• Scope: packages and receipts; disk images only where they are embedded in macOS installers (FAQ).
• Current version: 4.8 for macOS 14 through 27, Intel or Apple silicon, notarized 16 September 2026 (download page).

Oxid Inspect: apps, packages, disk images and archives in one place

Oxid Inspect covers what both tools look at, in one app, and adds a few things neither does:

• Apps and binaries: code signatures judged by Apple’s own Security framework (strict and standard), the certificate chain, entitlements with the risky ones explained, architectures, linked libraries, nested helpers, login items and privileged tools.
• Notarization: stapled tickets read offline. Gatekeeper’s assessment and Apple’s ticket lookup run only when you ask; the lookup sends a hash of the code, never the file.
• Installer packages: what each component installs (from its bill of materials, without unpacking the payload), set-uid and world-writable files, the scripts that run as root, the Distribution file’s JavaScript checks, and whether the signature still matches the package.
• Disk images: format, signature, the licence text before you agree to it, and the contents through a hidden, read-only mount.
• Comparing two versions of an app, package or disk image, built in: a different signer, new entitlements, version changes and new findings first, then every changed file.
• Audits and release checks: run rule presets (installed apps, security, release) or your own rules over a folder, or check one build in CI with SARIF output.
• Archives of every common kind, nested ones too, with safe extraction, free.
• Reports as PDF, HTML, Markdown, JSON or SARIF; a command-line tool; and an MCP server for coding agents.

Everything is read on your Mac in a separate helper process locked down by macOS’s sandbox, and nothing inside a file is ever run.

Which to choose

• You want to look at an app or a package now and then, and pay nothing: Apparency and Suspicious Package are the right tools, and they are free. Inspect’s free plan covers archives, not apps or packages.
• You ship Mac software, or look after many Macs: comparing builds, release checks in CI, folder audits and reports are where Inspect Pro earns its $29.
• You want one tool for apps, packages, disk images and archives, including from the command line or an AI agent: that is what Inspect is for.

Mothers’ Ruin’s own FAQ makes a fair point that applies to Inspect too: much of this information is available from Terminal tools such as codesign and spctl. These apps collect it, explain it, and save you the typing.

At a glance

Questions

Is Apparency free?

Yes. Apparency is no charge; its FAQ says 'we make the same $0 whether you use it or not'. Version 3.4 runs on macOS 14 through 27 and includes a command-line tool, appy, and a Quick Look extension.

How can I check a Mac app before installing it?

Apparency shows what Gatekeeper said, whether the app was notarized, whether App Sandbox is on, the code signature and entitlements. Oxid Inspect Pro also shows the certificate chain and explains risky entitlements, reading everything in a sandboxed helper without running anything inside the file.

How do I see what a .pkg installer will do before I run it?

Suspicious Package, which is free, shows who signed a package, the files it installs, the scripts it will run, whether Apple notarized it, and a review of potential issues. It says plainly that it is not a malware detector.

Can I compare two versions of an app or installer package?

Suspicious Package hands two packages to an external diff tool such as Kaleidoscope, BBEdit or Araxis. Apparency has no side-by-side comparison. Oxid Inspect Pro compares two versions of an app, package or disk image built in, showing signer, entitlement and version changes first.

Do I need Oxid Inspect if I already use Apparency and Suspicious Package?

Not if you only look at an app or package now and then: those two are the right tools, and they are free. Inspect's free plan covers archives, not apps or packages. Inspect Pro, $29, is for comparing builds, release checks in CI, folder audits and reports.