M.A.C.E. (macOS Advanced Compliance Editor)

Build, customize, audit, and deploy macOS security baselines. No command line required.

Join us in #mace-app on Mac Admins Slack

🌟 Explore the M.A.C.E. Website 🌟	⭐ Support the Project: Give it a Star! ⭐
🌐 Visit: getmace.com 🌐 Guides, docs, and screenshots for every feature	Stars help other Mac admins find M.A.C.E.

• About
• Why MACE?
• Installation
• Quick Start
• Features
  • Build Targets
  • Output Examples
  • Staying Current
• Status
• Community & Feedback
• Share the Project
• About the Developer
• Credits

M.A.C.E. (macOS Advanced Compliance Editor) is a GUI for the macOS Security Compliance Project (mSCP), the open source project hosted by NIST. MACE reads the mSCP rule library and uses it to generate the frameworks, baselines, profiles, and scripts that bring your devices into compliance.

Built in Swift and SwiftUI, it's a native macOS app that lets you create, customize, audit, and export compliance configurations without touching the command line.

MACE started from a simple frustration. As a Mac admin using mSCP day-to-day, the project was incredible, but the workflow wasn't. Bouncing between terminal windows, editing YAML files by hand, and running Python scripts just to see what changed got old fast.

I wanted something I could actually see. Browse the rules, change a setting without looking up the syntax, hit build. Something I could hand to a newer admin without walking them through Git first. So I built my own, with the Mac admin in mind the whole way through.

There's no company behind this. I'm a Mac admin building a tool for other Mac admins, trying to do my job with something that actually works for me.

Who it's for. Three groups kept coming up:

• The ones who don't code. They have a mandate, a fleet, and a deadline. What they don't have is the Python, Ruby, Git, and terminal background the project assumes.
• The ones who need more than the current tools give them. They know exactly what they want out of their build, and the existing apps stop short of it.
• The ones already running mSCP who want it simpler. No trouble with it at all. They just want to get there faster, without the setup and the scripts every time.

The macOS Security Compliance Project is the gold standard for Apple security baselines, a collaboration between NIST, NASA, DISA, and LANL, documented by Apple in their own platform certifications guide.

Every rule, framework, and piece of compliance logic in MACE comes straight from mSCP. The expertise stays with the experts. MACE is the front end: it takes what mSCP already does well and puts a real interface on it, so an admin can get to a working baseline without learning a toolchain first.

That split is the point. mSCP keeps doing what it does best: more rules, more frameworks, more baselines. MACE brings more people to it.

The full introduction lives on the website at getmace.com/docs/intro, including how the two build engines differ and why MACE exists alongside Jamf Compliance Editor and WOMBAT.

Requires macOS 14 (Sonoma) or later. All three methods install the same signed build.

Direct download

Grab the latest .dmg from the Releases page and drag M.A.C.E. to your Applications folder. The app updates itself from here on out (see Staying Current).

Homebrew

brew install --cask mace

Installomator

For MDM-driven deployment, use the mace label. Installomator must run as root:

sudo ./Installomator.sh mace

It pulls the latest release straight from this repo and verifies the Developer ID Team ID 7U624389H9.

1. Install M.A.C.E. using any of the methods above
2. Create a new project and select your compliance framework
3. Customize rules to fit your organization's needs
4. Build scripts and configuration profiles for deployment
5. Audit your Mac and export compliance reports

Full instructions live on the website. Step-by-step tutorials, usage guides, and walkthroughs for every hub are at getmace.com. Start there if you want more than the five-step version above.

Main menu & project dashboard

Build hub: pick a target, choose which artifacts to generate, and customize output names and branding

Build locally, or upload straight to any of six MDM platforms:

More MDM targets are always on the table. The Build Hub has a Your MDM Here? Suggest button for exactly that. Adding one isn't purely up to M.A.C.E., though: the vendor has to expose the right API options before direct upload is possible, and demand from users of that platform is what decides which ones get built first. If you'd like to see your MDM supported, suggest it in the app or open an issue. Asking your vendor for the API access it needs helps just as much.

Click any preview to download the sample and open it locally. GitHub limits in-browser viewing of HTML and Excel files, so downloading is the best way to see the full output.

Documentation builder: switch formats, toggle content, and watch the rendered preview update live

Documentation: AsciiDoc · CSV · JSON

PDF document

HTML document

Excel document

Markdown document

Audit hub: pass rate, section-by-section breakdown, and per-rule results with DISA STIG checklist export

Audit reports: Markdown · AsciiDoc · JSON

PDF report

HTML report

CSV report

Excel report

Rule updates: what changed upstream, which rules it touches, and what's about to be written

Rules follow mSCP. M.A.C.E. checks the project for changes and shows you exactly what moved before anything is applied: how many rules were updated or removed, how many are relevant to your framework, and a per-file list of what's about to change. Your customizations and exported baselines are preserved through the update.

The app updates itself in the background. Pick Beta or Stable in Settings ▸ Updates, and downloads are signature-verified and installed through a privileged helper.

Fully Released M.A.C.E. is fully released and in daily use across many organizations. At this stage the thing the project needs most is feedback. Real-world reports on what works, what breaks, and what's missing are what drive development forward.

Two release trains:

• Beta: cutting-edge features and the newest fixes, shipped early so they can be put through real use. Choose this if you want the latest capabilities first and are willing to report back on what you find.
• Stable: the settled build for production and regulated environments. Choose this if you'd rather receive changes only after they've been proven on the beta train.

Both trains are fully supported. Switch between them any time in Settings ▸ Updates.

Source Code Availability The full source code for M.A.C.E. is not public. This repository hosts releases, documentation, and issue tracking only. Development is limited to a smaller group involved with the macOS Security Compliance Project while mSCP 2.0 is still evolving. Keeping things more controlled helps avoid introducing issues while the tooling and underlying data are still changing. Security is also the priority from the start given how closely the tool interacts with compliance workflows.

Open sourcing is not planned, and that comes from user demand. Many high compliance environments (federal, defense, and other regulated sectors) operate under policies that restrict or prohibit open source software for security-critical workflows. Those organizations make up a significant portion of M.A.C.E.'s user base and are precisely the audience the tool was built to serve. Releasing the source publicly would cut off access for the very users who need it most, so as things stand it isn't going to happen.

That position follows the people using the app. If that changes, this README will change with it.

M.A.C.E. is a community-driven project. Your input directly shapes what gets built next. Whether you work from STIG, CIS, NIST 800-53, CMMC, or something else entirely, the goal is for this to fit your framework rather than just one of them.

Note: While community feedback drives the roadmap, the source code is not public and isn't planned to be. See Status for context. Bug reports, feature requests, and discussion are still very welcome via the channels below.

Especially useful is how a build behaves in your environment, above all on the beta train, where new features and fixes land first. That feedback is what decides when something is ready to promote to stable.

You don't have to write code to help. Starring the repo, telling other Mac admins, and sharing it at meetups or with your team are how the project knows it's making a difference.

Every bug report, feature idea, and question makes M.A.C.E. better. See the roadmap for what's in focus now, and getmace.com for the latest news.

The app ships with 75+ icons that shuffle between the seasons and the calendar. A small thing, but it keeps M.A.C.E. feeling fun and lively for the people who live in it week to week.

Feel free to use these images whenever you talk about the project. They're here for fun. You can download the whole set from Settings ▸ Appearance inside the app and use them however you like.

These are purely for fun. My goal was never to offend anyone; it was to make sure everyone felt included, at a fun level. We all come from different walks of life and work all over the world. The Mac community is a worldwide team.

Want to see a logo that isn't here? Tell me. I always love adding more, and the gap I'd most like to close is holidays and celebrations outside the US. If something is a big deal where you are, I probably don't know about it yet, and I'd rather hear it from you than guess. Suggest a logo and it goes on the list.

Hey, I'm Cody Keats (@cocopuff2u), the solo developer behind M.A.C.E. Former Navy Mac admin, mSCP contributor, and also the one behind the MOFA project.

M.A.C.E. started as something I wanted for myself. The Jamf Compliance Editor deserves the credit for getting here first, and it's a great tool, but it wasn't cutting it for the way I work. I wanted to customize more. I wanted it to be simple to use. I wanted it to feel welcoming and creative instead of like a chore. So I built my own.

It's built with the Mac admin in mind, and with mSCP, which I'm a part of. The goal was an app that works hand in hand with the project rather than alongside it: when mSCP changes, M.A.C.E. can adopt it quickly instead of leaving you waiting.

I know M.A.C.E. is doing well when I see the stars go up, when it gets mentioned on some site, and when people tell me it works. Most of what's in here started as your ideas. I just put them together. Don't be a stranger!

Website · GitHub · LinkedIn · Contact

Powered by NIST mSCP 2.0. Built on the macOS Security Compliance Project, a collaboration between NIST, NASA, DISA, and LANL. Every rule in M.A.C.E. starts there.

Website • Download Latest Release • Report an Issue • Discussions • #mace-app on Mac Admins Slack