Sloth: a sortable GUI over lsof output, with a version matrix and a one-command unsigned build

Sloth is a view over lsof output, so lsof sets the ceiling

The project's own description is that Sloth is essentially a friendly, exploratory graphical interface built on top of the lsof command line tool, and that the output of lsof is parsed and shown in a sortable, searchable outline view. That single sentence tells you both the value and the limit. The value is that you stop reading a flat wall of process and descriptor output and start interrogating it. The limit is that the data set is fixed by whatever lsof reports, so anything lsof cannot enumerate is not something Sloth will surface, and no amount of filtering will widen it. Understanding the app as a front end rather than a new source of information is what stops you expecting it to answer questions the underlying tool was never asked to answer.

The filter and sort options are the actual feature list

What Sloth adds over reading lsof by hand is a set of ways to cut the output down. You can filter by name, by access mode, by volume, by type, by location, or with regular expressions, and you can sort by process name, file count, type, process ID, user ID, Carbon PSN or bundle UTI. On top of that there is a dedicated view of IP socket status with protocol, port and version, a view of sockets and pipes established between processes, and an inspection window carrying detailed macOS and Unix file, socket and process information, plus a contextual menu for file operations. That last group is what makes it usable for chasing a problem rather than browsing. One entry is worth pausing on, though: Carbon PSN as a sort key is a process serial number from a framework macOS replaced years ago, which tells you how long this app has been in service.

Seeing other users' files requires authenticating inside the app

One capability is singled out in the feature list: in-app authentication to scan with root privileges. This exists because files, sockets and pipes owned by other users are invisible to an unprivileged scan, so without it the view is incomplete exactly where you often need it. The design choice is that the elevation happens inside the graphical app rather than by asking you to run a command under sudo in a terminal, which means the app is requesting credentials for a scan it performs itself. The practical consequence for you is that a full picture of the system requires an admin password, and you should expect that prompt the first time you look beyond your own processes. Anything Sloth shows you is therefore only as complete as the privileges behind the scan that produced it.

Version 3.6 needs macOS 11, and older systems get frozen builds

The distribution matrix is stated explicitly rather than left to be discovered. The current download is Sloth 3.6, roughly 1.3 MB, Universal for ARM and Intel 64-bit, requiring macOS 11 or later, and Developer ID signed and notarized. For anything older there is a documented fallback: on macOS 10.13 to 10.15 version 3.4 works just fine, and on 10.9 to 10.12 version 3.2 does the trick, with every older build still downloadable from the project's file area. That is a generous commitment to old hardware, and it carries the cost you would expect. Those fallback builds receive nothing further, so a machine on 10.13 is running software last updated well before the current release and will stay that way.

The Homebrew cask may not be the version you wanted

There are two installation routes and they are not equivalent. The direct route is the signed zip from the project's site, which is where version 3.6 lives. The other is Homebrew, and the project flags the caveat itself: Sloth can also be installed via Homebrew, and it may not be the latest version. The command is short:

brew install --cask sloth

The consequence is a small but recurring annoyance. Anyone who installs through the cask and then reads the download page expecting 3.6 can find an older build, and the two routes become a thing you have to compare rather than choose between. Since the app is free and open source and the donation link sits next to the download, there is no functional difference in what you are licensing, only in which build you land on. If you want the current release, take the zip.

make build_unsigned gives you an app that cannot update itself

Building from source takes one command and requires the Xcode build tools, with the products landing in a products directory:

make build_unsigned

The Makefile explains the rest of the design. It reads the version and app name out of resources/Info.plist with PlistBuddy, and offers an all target that chains clean into build_unsigned alongside a release target that chains clean into build_signed, archives and size. The unsigned target passes an empty code sign identity and switches both CODE_SIGNING_REQUIRED and CODE_SIGNING_ALLOWED off, while the signed target drops those overrides. The archives step then produces both an app zip and a source zip before generating a Sparkle EdDSA signature with tooling from the sparkle directory in the tree. That signature step belongs to the release path; make build_unsigned builds with code signing turned off.

Twenty years of Objective-C, and a release roughly twice a year

The longevity claim is on the front page and the numbers support it. Sloth is described as free, open source software that has been continuously developed and maintained for a very long time, since 2004, and the copyright line runs 2004 to 2026. The tagged releases show a steady cadence rather than a burst: version 3.4 in May 2025, 3.5 in November 2025 and 3.6 in April 2026, with the repository last pushed on 15 October 2026 and not archived. The implementation is Objective-C with Cocoa, and the feature list still advertises it as a very fast, responsive native app. The tree carries CHANGES.md and TODO.md rather than a large documentation directory, which fits a project of this age whose user-facing knowledge lives in the app and on its site.

Editorial conclusion

Sloth suits someone on macOS who needs to answer what has a file open, which process holds a socket, or which two processes are talking over a pipe, and who would rather explore that in a table than read lsof output. It does not add capability beyond what lsof itself can see, and make build_unsigned builds it with code signing turned off. Before installing, check your macOS generation against the version matrix, since 3.6 requires macOS 11 or later, and prefer the signed download over the cask when you want the current release.

Frequently asked questions

Official sources

1. License: BSD-3-Clause
2. Project website
3. README
4. Releases
5. sveinbjornt/Sloth on GitHub