Check Gatekeeper State with spctl --status

See whether Gatekeeper assessments are enabled, and control the master policy switch from the Terminal.

macOSGatekeeperspctlsecurityMedium risk

Run `spctl --status` to show Gatekeeper state; `sudo spctl --master-enable` re-enables assessments after disabling.

01Command

Command

$ spctl --status

02What it does

spctl --status prints 'assessments enabled' or 'disabled', which explains behavior that looks like a bug: a Mac with assessments off silently runs unsigned apps. `spctl --add <path>` can whitelist a specific blocked app without touching the global switch, which is far safer. Apple Silicon Macs additionally require every native binary to be signed, so a disabled Gatekeeper does not remove that check.

03Risk

RiskMedium risk

!Warning: Avoid --master-disable: it lowers protection for every app, not just the one causing trouble.

04Undo

Undo

$ sudo spctl --master-enable

05Sources

SPCTL Command: Manage security assessment policy in macOS
SS64 · technical · 2026-09-17
Evidence: Documents spctl --status, --master-enable, and --master-disable for the Gatekeeper assessment policy.
Safely open apps on your Mac - Apple Support
Apple Support · vendor-doc · 2026-09-17
Evidence: Apple's guidance on Gatekeeper app-safety checks that spctl reports on and controls.

Last verified: 2026-09-17 · Category: System & Settings

06Related solutions

Verify an App's Code Signature with codesign

macOSGatekeepersignaturecodesign

Check whether an application bundle was signed properly and hasn't been modified since.

Low risk ✓ 2026-09-17

Remove the Quarantine Attribute with xattr

macOSquarantineGatekeeperxattr

List and clear extended attributes — the quarantine flag, Finder tags, and download provenance — on any file.

Medium risk ✓ 2026-09-17

Create an Encrypted Disk Image with hdiutil

macOShdiutilsecuritydisk-image

Build an AES-256 encrypted .dmg vault from the Terminal — no Disk Utility clicking required.

Low risk ✓ 2026-09-17