Ask Gatekeeper for a Verdict with spctl --assess
spctl evaluates any app against macOS's Gatekeeper policy and tells you exactly why it was accepted or rejected.
Run `spctl --assess --verbose /Applications/SomeApp.app` to see whether Gatekeeper accepts the app and on what basis.
01Command
Command
$ spctl --assess --verbose /Applications/SomeApp.app02What it does
spctl --assess applies the same system policy Gatekeeper uses at launch time: accepted means the app is signed by a recognized developer and notarized by Apple. --verbose prints the source of the assessment, such as 'accepted source=Notarized Developer ID'. You can also run `spctl --status` to see whether Gatekeeper is enabled globally. It evaluates only — it never launches or modifies the target.
03Risk
!Warning: An 'accepted' verdict means the policy is satisfied, not that the software is safe; keep assessing unknown apps with other checks.
04Undo
✓No undo needed — this command does not change persistent state.
05Sources
- Protecting against malware (Apple Platform Security)Evidence: Apple's security guide explains Gatekeeper and notarization assessments performed on downloaded apps.
- spctl — system policy security assessment tool (macOS)Evidence: Documents --assess to evaluate a path against system policy and --verbose to show the reason for the verdict.
Last verified: 2026-09-17 · Category: Security & Privacy