Static analysis shows capability. A monitored run shows behaviour. privacycommand launches the inspected app and streams what it does in real time: A heat-graded callout fires when something spikes — a burst of disk writes, a fresh outbound host, a CPU climb that wasn’t there a moment ago.

​
What you need

File-event monitoring requires the privileged helper, because fs_usage needs root. The other streams do not.
A monitored run executes the app. If you have real doubts about a bundle, do this inside VM mode instead, where the blast radius is a disposable guest rather than your Mac.

​
Getting useful coverage

Dynamic analysis only sees the code paths you exercise. An app sitting on its launch screen will barely touch anything.
  • Drive the features you care about. If you want to know whether the export function uploads anything, run an export.
  • Watch the first thirty seconds. Analytics and attribution SDKs typically fire their first beacon at startup.
  • Let it idle afterwards. Some telemetry batches on a timer and won’t appear until minutes in.
  • Then check what changed at rest. Some apps only phone home on quit.

​
Watch mode

Some behaviour won’t show up in the ten minutes you’re prepared to sit there: licence-server pings, telemetry that batches on a timer, a scheduled update check, a phone-home the day a trial expires. Watch mode is a monitored run you leave running. Start it from Run → Start Watching… (⇧⌘W) or the eye button in the header — either one starts a run first if there isn’t one already. Then:
  • A menu-bar icon appears with an unread badge. A change detector diffs each tick of the run against the previous one and posts a single entry per genuinely new thing: a destination not contacted before, a new behavioural anomaly, an event the risk classifier called surprising, a live-probe event, a CPU spike. Clicking the icon opens the list and marks it read.
  • Closing the main window does not quit privacycommand. This is the part worth knowing in advance — while watching, the app deliberately stays alive with the menu-bar icon as your only handle on it. Stop Watching — ⇧⌘W again, or the header button — ends the watch and the run together.
  • The icon style is yours to pick under Settings → General.
Everything else is an ordinary monitored run, with the same requirements — file events still need the helper.

​
Pausing the target

You can freeze the inspected app and its child processes mid-run, then resume them. That’s ordinary process suspension — useful for reading a fast-scrolling event list without losing the run. It stops the app from doing anything further, but it does not sever connections already open. For that, see the network kill switch.

​
Reading the network tab

Destinations are reverse-DNS labelled, so 142.250.80.14 shows up as something recognisable rather than a bare address. Rows can be highlighted and then filtered to highlighted-only, which is the practical way to work through a busy run: mark the interesting destinations as you go, then review just those. Bear in mind that a reverse lookup shows the hosting party. A connection to a cloud provider’s address tells you the provider, not necessarily who rented it.