Culprit
Free
free for good
The core answer, never locked.
- One plain answer, plus Heat, Memory and Disk
- Every process name explained
- Developer mode and running servers
Get the beta
No account needed.
Free beta. Get the download link by email.
Find out what’s making your Mac hot, slow or full.
One click in the menu bar names the app heating your Mac, eating its memory or filling its disk. Read-only: it never quits or deletes anything.
You’re on the list.
See how it works
Apple SiliconmacOS 13+
Sound familiar?
Fan screaming. Beach ball spinning. Disk full again.
macOS shows long lists and grey bars. The detective work is yours.
- Hot
Hot, fan loud, for no reason.
Activity Monitor lists 900 processes. None of them says “it’s me”.
- Slow
So slow all of a sudden.
“Your system has run out of application memory.” But which app took it?
- Full
Full again, a week after cleaning.
“System Data: 120 GB” in a grey bar you can’t open.
Why now
More runs on your Mac than you opened.
AI coding sessions, forgotten dev servers, 51 Chrome helpers. Culprit groups them by app.
Shown by name
- Claude Code
- Codex
- Cursor
- ChatGPT
- Ollama
- Docker
Activity Monitor
Culprit
Your Mac is working hard. node, a dev server started Tuesday, has been busy for 3 days. Possibly stuck.
Same Mac, same moment.Example
How it works
Click the icon. Get one plain answer.
One sentence names the cause and what to do. Heat, Memory and Disk cards sit below.
Quiet in your menu bar.
A plain icon, until something needs a look.
Every process name, explained.
Plain words for every cryptic name, and what to do about it.
Developer mode, one switch.
Adds process trees, AI agent sessions and running servers.
Running servers
Port 3000 already in use? It’s the dev server from August.
Every local server, with its folder, memory and uptime. Long-idle ones are marked possibly forgotten.
- Open it or find it. In your browser or in Finder, one click.
- Stop it yourself. Press Ctrl+C where it runs.
- Open to your network? Reachable servers are marked.
Example
Example
Left running
Claude Code exited. Its scripts kept going.
Culprit links each AI coding session to what it started, and marks work possibly left running.
- Every session, with what it started. Scripts, servers and builds, even after it ends.
- Free flags it. Pro names the session and shows the whole tree.
Storage
Why is my disk full?An answer that adds up.
Rows that add up to the total, including what “System Data” hides.
- FoldersClick down from your home folder to the biggest ones.
- Dev junkBuild output and caches your tools can rebuild.
- GrowthWhat grew since yesterday. Pro after the beta.
Full Disk Access is optional, only to size Mail and Messages.
Why I built it
My own Mac, one evening in October.
“The fan wouldn’t stop and memory was always full. Activity Monitor showed 900 processes and no answer. Culprit found it in one click: scripts an AI session left looping for 7.5 hours, a dev server I’d forgotten for 23 days, and 23 idle agent sessions holding 9 GB.”
- 7.5 htwo scripts looping, left by an AI session
- 23 daysa dev server running, forgotten
- 9 GBheld by 23 idle AI sessions
From the maker, not a customer review. Numbers are from my Mac on 22 October 2026.
Read-only
It looks. It never touches.
Some chatbots tell people to run sudo rm -rf. Culprit only tells you what’s wrong. The fixing stays with you.
- Never quits or deletes.You decide what to stop or remove, and you do it.
- Never goes online.No account, no analytics. Your data stays on your Mac.
- Honest about guesses.Estimated watts are marked ~. “Possibly” means possibly.
Pricing
Free for the answer. Pay once for Pro.
Everything is free during the beta.
Culprit Pro
$15
planned, one-time$9 early bird for the list
Who started it, alerts and history.
- AI agents & left running. Which session started what, and what it left.
- Alerts. A heads-up on memory, possible leaks and disk.
- History & health report. Disk growth over time, plus a monthly summary.
Pay once. No subscription.
FAQ
Straight answers.
Does Culprit speed up my Mac?
No. It tells you which app is using energy, memory or disk. Quitting it is up to you.
macOS says it “could not verify” Culprit. How do I open it?
Open System Settings › Privacy & Security and click Open Anyway, once. The beta isn’t notarized yet.
Does it work with Claude Code, Codex or Cursor?
Yes, plus OpenCode, Aider and Gemini CLI. It groups each session with what it started, and needs no API key.
Will it delete anything?
No. It never deletes files or quits processes. You decide, and you do it.
Does it send my data anywhere?
No. The app makes no network connections. No analytics, no account.
Is it free?
Yes, all of it during the beta. After it, the core answer stays free; Pro is a planned one-time $15.
Is kernel_task a virus?
No. It’s macOS slowing busy apps to cool the chip. Culprit names the app causing the heat.
Which Macs does it run on?
Apple Silicon Macs (M1 or later) on macOS 13 or later. Intel isn’t supported yet.
Next time your Mac gets hot, you’ll know why.
Free beta for macOS 13 or later.
You’re on the list.
How to open: the beta isn’t notarized yet. If macOS “could not verify” Culprit, click Open Anyway in System Settings › Privacy & Security.