Santa
brew install --cask santa
v2026.5
Binary authorization system
46
30-day installs · #2075
141
90-day · #2089
515
365-day · #2104
665
★ GitHub stars · updated 2mo ago
GitHub topics
allowlist
authorization
blocklist
endpoint-security
macos
santa
security
system-extension
Links
- https://github.com/northpolesec/santa
- GitHub: northpolesec/santa
- Brew formula source: Casks/s/santa.rb
Raw metadata
{
"alternatives": [],
"artifacts": [
{
"uninstall": [
{
"delete": [
"/Applications/Santa.app",
"/usr/local/bin/santactl"
],
"early_script": {
"args": [
"--unload-system-extension"
],
"executable": "/Applications/Santa.app/Contents/MacOS/Santa",
"must_succeed": false,
"sudo": true
},
"launchctl": [
"com.northpolesec.santa",
"com.northpolesec.santa.bundleservice",
"com.northpolesec.santa.metricservice",
"com.northpolesec.santa.syncservice",
"com.northpolesec.santad"
],
"pkgutil": "com.northpolesec.santa"
}
]
},
{
"pkg": [
"santa-2026.5.pkg"
]
},
{
"zap": [
{
"delete": [
"/var/db/santa",
"/var/log/santa*"
],
"trash": [
"/private/etc/asl/com.northpolesec.santa.asl.conf",
"/private/etc/newsyslog.d/com.northpolesec.santa.newsyslog.conf"
]
}
]
}
],
"auto_updates": null,
"categories": [],
"deprecated": 0,
"deprecation_reason": null,
"desc": "Binary authorization system",
"disable_reason": null,
"disabled": 0,
"display_name": "Santa",
"enrichment_fetched_at": "2026-06-20T22:49:09+00:00",
"first_seen": "2026-06-20T00:47:34+00:00",
"full_token": "santa",
"github_default_branch": "main",
"github_last_commit_at": "2026-06-20T15:50:23Z",
"github_readme_excerpt": "# Santa\n\n[](https://github.com/northpolesec/santa/blob/main/LICENSE)\n[](https://github.com/northpolesec/santa/actions/workflows/ci.yml)\n[](https://github.com/northpolesec/santa/releases/latest)\n[](https://github.com/northpolesec/santa/releases/latest)\n[](https://github.com/northpolesec/santa/releases/latest)\n\n\u003cp align=\"center\"\u003e\n \u003cimg src=\"./docs/static/img/nps-logo-256.png\" height=\"128\" alt=\"Santa Icon\" /\u003e\n\u003c/p\u003e\n\nSanta is a binary and file access authorization system for macOS. It consists\nof a system extension that monitors for executions \u0026 file access, and makes\ndecisions based on the contents of a local database, a GUI agent that notifies\nthe user in case of a block decision, a background service for synchronizing\nthe configuration with a remote server, and a command-line utility for managing\nthe system.\n\nIt is named Santa because it keeps track of binaries that are naughty or nice.\n\n# Docs\n\nThe Santa docs are stored in the\n[Docs](https://github.com/northpolesec/santa/blob/main/docs) directory and are published\nat https://northpole.dev.\n\nThe docs include deployment options, details on how parts of Santa work and\ninstructions for developing Santa itself.\n\n# Get Help\n\nIf you have questions or otherwise need help getting started,\nthe [#santa channel on the macadmins slack](https://app.slack.com/client/T04QVKUQG/C0E1VRBGW) is a great place to start.\n\nIf you believe you have a bug, feel free to report [an",
"github_repo": "northpolesec/santa",
"github_stars": 665,
"github_topics": [
"allowlist",
"authorization",
"blocklist",
"endpoint-security",
"macos",
"santa",
"security",
"system-extension"
],
"homepage": "https://github.com/northpolesec/santa",
"homepage_og_description": null,
"homepage_og_image": null,
"homepage_title": null,
"installs_30d": 46,
"installs_365d": 515,
"installs_90d": 141,
"last_seen": "2026-06-20T00:47:34+00:00",
"llm_generated_at": null,
"llm_model": null,
"names": [
"Santa"
],
"one_liner": null,
"rank_30d": 2075,
"rank_365d": 2104,
"rank_90d": 2089,
"raw_hash": "6efe222b8e81bdd6",
"ruby_source_path": "Casks/s/santa.rb",
"tap": "homebrew/cask",
"token": "santa",
"version": "2026.5",
"why_use_this": null
}