Crescendo1.0.4

Crescendo displays system events as they occur, giving Mac users a live view of activity as it happens. Written in Swift, it uses Apple’s Endpoint Security Framework to collect the events shown in its interface.

The project is divided into a system extension named CrescendoExtension, a framework wrapper around Endpoint Security called Crescendo, and CrescendoApp, the graphical event viewer. The framework can also be bundled into other Swift applications, while Xcode can build the included example command-line application. This makes Crescendo useful both for developers examining system behavior and for users who want a real-time event window.

The current 1.0.4 release runs on Intel and Apple Silicon and is freeware in the System Tools category. It requires macOS 10.15 or later and at least Xcode 10. The app must reside in /Applications for its system extension to load; on first use, pressing Start prompts approval of that extension, followed by Full Disk Access authorization, although the approval control may initially fail to appear in System Preferences.

Building or running it on a production Mac requires Apple’s endpoint-security entitlement and a developer certificate, with system-extension signing and notarization presenting non-trivial development work. Developer testing is recommended in a virtual machine with SIP disabled, alongside disabled AMFI and enabled developer mode so extensions reload after OSSystemExtensionManager.shared.submitRequest; production Macs should not have SIP or AMFI disabled.