It stays quiet — until it doesn’t.
A calm bar-chart sits in your menu bar. When a runaway is detected, the spike turns red and a card appears: what the process is, whether this is normal, and the safest thing to do.
Normally ~0.1% CPU; now ~150% for 41 hours.
Duet Activity Scheduler — the daemon that runs background system tasks — is wedged in a loop, heating your Mac. It’s safe to stop: macOS relaunches it immediately, and worst case a background task runs a little late.
What it does
Detects
Rolling per-process baselines catch sustained CPU, monotonic memory growth, and cumulative-time runaways — the slow burns a snapshot tool like Activity Monitor can’t see.
Judges
Every anomaly is explained on-device by Apple Intelligence, grounded in a curated map of macOS daemons. A typed card: what it is, why it’s hot, is this normal, what to do.
Acts — safely
Tiered actions: Quit / Force Quit, brew services stop & restart, or explain-only for things you shouldn’t kill. A confident wrong button is worse than no button.
Sees root daemons
An optional privileged helper — one System Settings approval, never a password prompt — watches root-owned daemons like dasd, where the worst runaways hide.
Why it exists
The fans were running. Activity Monitor showed mysqld and dasd at the top — but not why. It took a 30-minute manual debugging session to find what the OS had silently tolerated for two days: a scheduler daemon wedged in a loop burning 25 CPU-hours and 60 GB of RAM, and three queue workers busy-polling MySQL hundreds of times a second. Every runaway had a detectable signature for days. Nothing surfaced it. Anomalous is that missing layer — the context, watching for you.
Trust is the product
Open source, auditable
The sensor is Apache-2.0. You can read exactly what’s collected and what’s sent — and the app’s send log is diffable against this source. No taking our word for it.
Nothing identifiable leaves
Detection, judgment, and actions run entirely on-device, offline, with no account. The optional cloud triage composes an allowlisted payload — never paths or command lines — and logs it locally, byte-for-byte, before it’s sent.
Get it
A signed, notarized disk image. Drag Anomalous to Applications and launch — it lives in your menu bar and says nothing until it has something worth saying.
Requires macOS 26 (Tahoe) or later on Apple Silicon. ~3 MB. Free.
More from the same workshop
Native macOS tools, built the same way — small, fast, open, no telemetry.