Mole is a free command line toolkit that does the jobs people usually buy several Mac utilities for. mo clean clears caches, logs and leftovers from apps you already deleted; mo uninstall removes an app together with its launch agents and preference files; mo analyze is an interactive disk explorer; mo status is a live view of CPU, memory, disk and network. There are smaller tools too, such as mo purge for old build folders and mo installer for forgotten .dmg and .pkg files.
It earns its place by being careful. Every command that deletes has a --dry-run preview, uninstalls and disk deletions go to the Trash by default, personal data is kept unless you select it, and a log of what was removed sits in ~/Library/Logs/mole. The project is GPL-3.0, written mostly in shell with Go for the faster parts, and ships a release almost every week.
The limits: mo clean, purge and installer delete permanently rather than to the Trash, so the dry run is worth the extra second. This repository is the macOS command line tool; the native Mac and Windows apps on mole.fit are separate downloads, and the Windows command line version lives on its own branch.
- Repository: github.com/tw93/Mole
- Licence: GPL-3.0 (GNU General Public License v3.0)
- Language: Shell. Stars: 72.9K. Forks: 2,574. Last push: Oct 26, 2026.
- Scan: safe, Oct 26, 2026, commit ad7915c
Who it is for
Mac users who are short on disk space and comfortable in a terminal, and anyone who wants app-uninstaller and disk-analyzer features without paying for three separate apps.
Getting started
1. Install with Homebrew (macOS 12 or newer)
brew install mole2. See what a cleanup would remove, without deleting anything
mo clean --dry-run3. Open the interactive menu
moThere is also a curl | bash installer on the README. It installs to /usr/local/bin, which can ask for your password; pass --prefix "$HOME/.local/bin" to keep it in your own folder. The project warns that molemac.com, moleapp.net and molefit.com are not Mole.
Safety scan
We cloned tw93/Mole at commit ad7915c on Oct 26, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.
- No secrets, no packed or self-decoding code and no bare-IP URLs across about 100,000 lines of shell, Go and Python.
- The three download-piped-to-shell hits in install.sh are an error message and a comment explaining how to install with curl | bash. The installer itself uses sudo when the target folder needs it and adds a PATH line to your shell profile; installing with Homebrew avoids both.
- The seven persistence hits in lib/core/app_protection.sh, app_protection_data.sh and lib/uninstall/batch.sh are the uninstaller finding an app's LaunchAgents and LaunchDaemons so it can remove them, which is the opposite of persistence.
- Three more scripts (bin/installer.sh, bin/uninstall.sh) carry sudo because some cleanup and app removal touches system folders. mo touchid also edits the sudo configuration to accept Touch ID, and only when you run it.
- One known advisory, in golang.org/x/text 0.39.0 (a crash on crafted input in its precis package), with no severity assigned yet. Seven workflows, none using pull_request_target, every third-party action pinned to a commit. Security policy, Dependabot and CodeQL present.
What the scanner counted
| Check | Result |
|---|---|
| Secrets | None found. |
| Suspicious code | 10 pattern hits found and read; every one is listed under the raw findings. |
| Install-time code | 4 installer scripts (one fetches and runs a remote script; one edits your shell profile; one can call sudo) |
| Committed binaries | None. |
| CI workflows | 7 workflows. None use pull_request_target. 0 of 5 third-party actions pinned to a tag rather than a commit. |
| Network hosts | 8 distinct hosts referenced from source; most often github.com, api.github.com, raw.githubusercontent.com, bford.info. No URLs to bare IP addresses. |
| Known vulnerabilities | 1 advisory across 30 pinned packages: 0 critical, 0 high, 0 moderate, 0 low, 1 unrated. go.mod: 30 packages, 1 advisories. |
| Project hygiene | Has security policy, automated dependency updates, CodeQL, licence file, contributing guide. |
| OpenSSF Scorecard | Not scored: the project is not in Scorecard's weekly index. |
The raw findings
Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.
Pattern hits (10)
| Where | Rule | Match |
|---|---|---|
| install.sh:1415 | download-piped-to-shell | log_error "Retry later, or opt into a source build explicitly: MOLE_VERSION=main ./install.sh (piping from curl: | bash -s -- main)" |
| install.sh:1443 | download-piped-to-shell | log_error "Retry later, or opt into a source build explicitly: MOLE_VERSION=main ./install.sh (piping from curl: | bash -s -- main)" |
| install.sh:1873 | download-piped-to-shell | # (`curl ... | bash`, where BASH_SOURCE[0] is empty). Sourcing only loads |
| lib/core/app_protection.sh:2162 | persistence | "/Library/LaunchAgents/$bundle_id.plist" |
| lib/core/app_protection.sh:2254 | persistence | # System LaunchAgents/LaunchDaemons often use bundle-id-derived helper |
| lib/core/app_protection.sh:2277 | persistence | # System LaunchAgents/LaunchDaemons by name. These live under /Library and |
| lib/core/app_protection.sh:2528 | persistence | /Library/LaunchAgents/*.plist | /Library/LaunchDaemons/*.plist) |
| lib/core/app_protection_data.sh:623 | persistence | # Generic app-name words that collide with many unrelated LaunchAgents/Daemons. |
| lib/core/app_protection_data.sh:627 | persistence | # LaunchAgents) and find_app_system_files() (system LaunchAgents/Daemons) so the |
| lib/uninstall/batch.sh:390 | persistence | "$HOME"/Library/LaunchAgents/*.plist | /Library/LaunchAgents/*.plist | /Library/LaunchDaemons/*.plist) ;; |
Installer scripts (4)
- bin/installer.sh, 1,066 lines, uses sudo
- bin/uninstall.sh, 2,361 lines, uses sudo
- install.sh, 1,877 lines, uses sudo, edits your shell profile, fetches and runs a remote script; talks to api.github.com, github.com, no-color.org
- scripts/setup-quick-launchers.sh, 434 lines; talks to www.apple.com
Worst known vulnerabilities (1 of 1)
| Advisory | Severity | Package | Summary |
|---|---|---|---|
| CVE-2026-56851 | unknown | golang.org/x/text@0.39.0 | Panic parsing crafted input in x/text/secure/precis in golang.org/x/text |
By the numbers
| Stars | 72.9K |
|---|---|
| Forks | 2,574 |
| Contributors | 167 |
| Commits | 3,835 |
| Open issues | 12 |
| Open pull requests | 1 |
| Releases | 85 |
| Latest release | V1.64.0 |
| Licence | GPL-3.0 |
| Main language | Shell |
| Project age | 1 year |
| Last push | Oct 26, 2026 |
| Tracked files | 343 |
| Lines of code | 101.7K |
| Checkout size | 15 MB |
Lines by language: Shell 59.3K, Go 29.1K, Markdown 8,627, Python 3,273, YAML 1,191, JSON 236.
Questions
Is Mole free?
Yes. The command line tool in this repository is GPL-3.0 and free to use. The native Mac and Windows apps on mole.fit are separate products from the same author.
Is Mole safe to run on my Mac?
The code has nothing hidden in it, but it is built to delete files. Run any command with --dry-run first, keep the caches you care about with mo clean --whitelist, and run it without sudo; it asks for administrator access only when a step needs it.
Does Mole replace CleanMyMac or AppCleaner?
For most of what those apps do, yes: cache cleanup, app removal with leftovers, a disk map and a system monitor. It works in the terminal rather than a window, unless you use the separate Mole for Mac app.
This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.