Allow a Specific App Through Gatekeeper with spctl --add

spctl --add inserts a per-app assessment rule so one tool can launch even while Gatekeeper stays strict for everything else.

macOSquarantineGatekeeperspctlMedium risk

Run `sudo spctl --add /Applications/MyTool.app --label "Approved"` to allow that app specifically; reverse with `sudo spctl --remove`.

01Command

Command

$ sudo spctl --add /Applications/MyTool.app --label "Approved Tools"

02What it does

The blunt fix — disabling Gatekeeper entirely with --master-disable — is deprecated and exposes the whole system; a targeted --add rule approves just one bundle, identified by its code signature, and can be labeled for audit. Rules persist across launches, and --remove --label "Approved" cleans up a whole batch. Remember the app still needs the quarantine attribute cleared or an explicit Open-with-Control-click if it is unsigned.

03Risk

RiskMedium risk

Requirementssudo (admin account)

!Warning: Only approve apps whose provenance you trust — an allow rule bypasses Gatekeeper checks for that code.

04Undo

Undo

$ sudo spctl --remove /Applications/MyTool.app

05Sources

spctl — system policy security assessment (macOS man page)
SS64 · technical · 2026-09-17
Evidence: Documents spctl --add path [--label name] to add an assessment rule and --remove to delete it.

Last verified: 2026-09-17 · Category: Security & Privacy

06Related solutions

Remove the Quarantine Attribute with xattr

macOSquarantineGatekeeperxattr

List and clear extended attributes — the quarantine flag, Finder tags, and download provenance — on any file.

Medium risk ✓ 2026-09-17

Verify an App's Code Signature with codesign

macOSGatekeepersignaturecodesign

Check whether an application bundle was signed properly and hasn't been modified since.

Low risk ✓ 2026-09-17