Stats puts small live readouts for your Mac in the menu bar: CPU and GPU load, memory pressure, disk activity and free space, network speed and public IP, battery health, temperatures, voltages and power draw from the sensors, connected Bluetooth devices' battery levels, and clocks for other time zones. Click any of them for a popup with graphs and the top processes. Each module can be switched on or off and styled separately.
It is the free, open-source answer to paid menu bar monitors like iStat Menus, written in Swift by one developer and kept current with every macOS release, with frequent updates and about 42,800 stars. It supports macOS 12 and later on Intel and Apple Silicon.
Limits worth knowing: fan control is a legacy feature that no longer gets fixes, the Sensors and Bluetooth modules cost the most energy, and the project takes issues but generally not unsolicited pull requests.
- Repository: github.com/exelban/stats
- Licence: MIT (MIT License)
- Language: Swift. Stars: 42.8K. Forks: 1,596. Last push: Oct 25, 2026.
- Scan: safe, Oct 26, 2026, commit 5cf09a8
Who it is for
Mac users who want to see what their machine is doing at a glance, from developers watching builds to anyone wondering why the fans are spinning, without paying for iStat Menus.
Getting started
1. Install with Homebrew (or download Stats.dmg from the GitHub releases page)
brew install stats2. Uninstall, including the privileged helper
sh /Applications/Stats.app/Contents/Resources/Scripts/uninstall.shOn macOS 26, if no icons appear, allow Stats under System Settings, Menu Bar. The Wi-Fi network name needs Location Services permission.
Safety scan
We cloned exelban/stats at commit 5cf09a8 on Oct 26, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.
- No secrets, no bare-IP URLs and nothing suspicious in about 47,000 lines of Swift. The app calls api.mac-stats.com for update checks and to look up your public IP, with GitHub as a fallback; the README says it collects no telemetry or analytics, and nothing in the scan contradicts that.
- The two persistence hits are Kit/scripts/install.sh and uninstall.sh adding and removing a LaunchAgent. install.sh is the optional headless installer (curl from cdn.mac-stats.com piped to bash): it installs the app, enables the Remote module, authorizes the Mac against a System Stats account at system-stats.com and registers it to launch at login, after which metrics stream to that account. Flags -c and -u additionally allow remote control commands and remote updates.
- uninstall.sh uses sudo because Stats installs a privileged SMC helper to read sensors and drive fans.
- One committed binary, Kit/lldb/libleveldb.a, a prebuilt copy of the LevelDB storage library linked into the app. It is compiled code you cannot read in the repository.
- Five workflows, none using pull_request_target; none of the 3 third-party actions is pinned to a commit. OpenSSF Scorecard 3.3 out of 10, mostly because a single maintainer merges without review and the repository has no security policy, Dependabot or CodeQL.
What the scanner counted
| Check | Result |
|---|---|
| Secrets | None found. |
| Suspicious code | 2 pattern hits found and read; every one is listed under the raw findings. |
| Install-time code | 2 installer scripts (one can call sudo) |
| Committed binaries | 1 executable or compiled object committed; listed under the raw findings. |
| CI workflows | 5 workflows. None use pull_request_target. 3 of 3 third-party actions pinned to a tag rather than a commit. |
| Network hosts | 17 distinct hosts referenced from source; most often github.com, app.system-stats.com, api.mac-stats.com, www.system-stats.com. No URLs to bare IP addresses. |
| Known vulnerabilities | No lockfile to check: dependencies are declared as ranges, so what gets installed is whatever is current on the day. |
| Project hygiene | Has licence file. Missing security policy, automated dependency updates, CodeQL, contributing guide. |
| OpenSSF Scorecard | 3.3 out of 10, as of Oct 26, 2026. |
The raw findings
Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.
Pattern hits (2)
| Where | Rule | Match |
|---|---|---|
| Kit/scripts/install.sh:326 | persistence | PLIST="$HOME/Library/LaunchAgents/$AGENT_LABEL.plist" |
| Kit/scripts/uninstall.sh:31 | persistence | rm -f "$HOME/Library/LaunchAgents/$AGENT_LABEL.plist" |
Installer scripts (2)
- Kit/scripts/install.sh, 415 lines, uses sudo; talks to api.system-stats.com, app.system-stats.com, github.com, oauth.system-stats.com, www.apple.com
- Kit/scripts/uninstall.sh, 60 lines, uses sudo
Committed binaries (1)
Kit/lldb/libleveldb.a: Mach-O, 1 MB
By the numbers
| Stars | 42.8K |
|---|---|
| Forks | 1,596 |
| Contributors | 194 |
| Commits | 2,520 |
| Open issues | 14 |
| Open pull requests | 2 |
| Releases | 360 |
| Latest release | v3.0.23 |
| Licence | MIT |
| Main language | Swift |
| Project age | 7 years |
| Last push | Oct 25, 2026 |
| Tracked files | 312 |
| Lines of code | 52.3K |
| Checkout size | 7 MB |
Lines by language: Swift 46.7K, C/C++ header 2,193, Python 1,469, Shell 551, JSON 478, YAML 402.
Questions
Is Stats free?
Yes. Stats is MIT-licensed and free, with no paid tier. The developer accepts donations through PayPal, Ko-fi and Patreon. The optional System Stats remote monitoring account is a separate online service.
Does Stats collect data about my Mac?
Not by default. The README states it has no telemetry or analytics; it contacts api.mac-stats.com to check for updates and to show your public IP. If you block that host, you lose update checks and the public IP readout. Metrics leave the Mac only if you enable the Remote module and sign in to a System Stats account.
Does Stats work on Apple Silicon?
Yes, on macOS 12 and newer, on both Apple Silicon and Intel Macs. Apple changes sensor keys with each new chip, so some temperature sensor names can lag behind the newest hardware, and beta versions of macOS are not supported.
This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.