KnockKnock review
A free, open-source utility for inspecting Mac persistence—not full antivirus protection.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
KnockKnock is a free, open-source macOS utility for examining software configured to run persistently at startup, login, or when other applications launch. It is intended for people investigating Mac persistence, reviewing unfamiliar software, or building repeatable inspection workflows. The utility scans startup items, login items, browser extensions, and other persistence locations, then presents file paths, code-signing details, and related file information. It can also reveal detected items in Finder and inspect property lists.
Its strongest capability is investigative depth rather than continuous defense. KnockKnock can query VirusTotal using file hashes, save scan results as JSON, and compare current results with previous scans. A command-line interface supports scripted or scheduled scans, while optional automatic launch and scanning at login can make recurring checks easier to run. These features suit technical users who want visibility into changes over time or need results in a format suitable for further review.
KnockKnock should not be treated as a complete antivirus replacement. The vendor describes it as a persistence-enumeration utility and states that it does not independently determine whether every detected item is malware; VirusTotal can flag known malware results. It also lacks verified real-time protection and is limited to macOS. Choose KnockKnock for focused forensic inspection and persistence auditing. Choose a different type of security product when continuous, independently classified malware protection is the primary requirement.
KnockKnock pros and cons
- Where it wins
- Scans startup, login, browser-extension, and other persistence locations
- Queries VirusTotal with file hashes and displays signing information
- Saves JSON results, compares scans, and supports command-line use
- Where it doesn't
- Does not independently classify every detected item as malware
- No verified real-time protection
- Available only for macOS
KnockKnock fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update