Crescendo

Crescendo provides a macOS‑only interface for monitoring system‑level events in real time. It consists of a system extension that taps into the Endpoint Security Framework, a Swift framework wrapper, and a lightweight application that displays the captured events through a graphical UI. The tool is intended for developers and security analysts who need to observe process execution, file access, and other kernel‑level activities as they occur.

The application requires macOS 10.15 or later and a recent Xcode toolchain, and it relies on Apple’s system‑extension and endpoint‑security entitlements. Users must approve the extension in System Preferences, grant Full Disk Access, and, for development, may need to disable SIP and AMFI in a virtual machine. The project includes an Xcode project file for building the components and can be integrated into other Swift applications via the provided framework.

Crescendo is released as a stable version, with documentation covering installation, signing, troubleshooting, and contribution guidelines. Issues and feature requests are tracked through the repository’s issue tracker, and releases are provided as compiled, signed binaries.