Sentinel is a free Mac utility that puts Gatekeeper controls, app quarantine removal, and ad-hoc code signing into a single, accessible interface — eliminating the need to memorize Terminal incantations every time macOS blocks a legitimate application.
What is Sentinel?
Sentinel is a lightweight macOS menu-bar tool that wraps three notoriously cryptic security commands — Gatekeeper configuration, extended-attribute quarantine stripping, and ad-hoc self-signing — into a clean GUI. Instead of hunting for the right spctl or xattr invocation, you drag in an app, click a button, and get on with your day.
It ships as a free download from developer Alin Panaitiu (the same mind behind Lunar, the brilliant display-brightness manager), which is all the social proof I need to trust that it's a conscientious, purposeful piece of software and not a dubious hack.
What does Sentinel do best?
Sentinel excels at defusing the three most common situations where macOS security machinery gets in your own way. First, there's Gatekeeper itself — Sentinel lets you toggle the global policy between strict App Store-only, signed-and-notarized, and anywhere, without diving into System Settings or the Terminal. Second, when a downloaded app is tagged with the quarantine extended attribute and macOS refuses to open it, Sentinel strips that flag in one drag-and-drop action. Third, and most impressively for developers, it can apply an ad-hoc self-signature to an app that has been partially invalidated — for instance after modifying a bundle or transplanting it to a different volume.
What makes all of this pleasant is the presentation. There are no modals stacked three deep, no cryptic error strings, and no need to copy a file path into Terminal. Sentinel is the kind of small app that earns a permanent place in your dock precisely because it does one cluster of things extremely well and never oversteps.
Who should use Sentinel?
The primary audience is anyone who regularly works with software that lives outside the App Store ecosystem. That means developers testing unsigned or locally-built binaries, power users who depend on open-source utilities distributed as raw .app bundles, and IT professionals who field the inevitable "macOS won't let me open this" calls from colleagues.
If you spend most of your time in App Store apps, Sentinel will probably never leave its shelf. But if your workflow touches Homebrew Cask installs, pre-release betas, independent Mac software from developers who skip notarization, or your own Xcode projects mid-iteration, Sentinel will quickly feel indispensable. It's especially handy on Apple Silicon, where Rosetta emulation and ad-hoc re-signing edge cases crop up more often than Intel users were used to.
Is Sentinel free?
Yes — Sentinel is free to download with no paywalled features, subscription tier, or nag screen. The developer, Alin Panaitiu, makes his income from Lunar and other paid utilities; Sentinel appears to be a gift to the community rather than a revenue line item. That said, if you find yourself reaching for it weekly, consider buying Lunar as a form of patronage — it's among the best monitor-management apps on the platform.
What are the best Sentinel alternatives?
For Gatekeeper management specifically, the closest alternatives are pure-Terminal workflows (sudo spctl --master-disable and friends) or the buried System Settings toggle. Neither is as ergonomic. Some users reach for Apple Configurator 2 to manage signing on managed fleets, but that's organisational-scale tooling and wildly overcomplicated for personal use.
On the quarantine-stripping front, a handful of contextual-menu extensions (like the venerable Services approach via Automator) can add a "Remove Quarantine" right-click option, but they require setup and don't bundle the Gatekeeper controls Sentinel includes. There's also Suspicious Package, which takes the opposite philosophical approach — it audits what an installer will do, rather than helping you bypass the checks. Both are worth having; they solve adjacent problems.
For self-signing, the only real alternative is codesign -s - in Terminal — Sentinel just wraps it without the flag-lookup tax.
How does Sentinel compare to using Terminal directly?
Terminal is perfectly capable of everything Sentinel does, but the cognitive overhead is non-trivial. You need to remember which flag disables Gatekeeper vs which one queries status, the exact xattr invocation for quarantine, and the correct codesign syntax for ad-hoc signing — then you need to handle file-path escaping and run with sudo where required. Sentinel removes every one of those friction points. I still keep a Terminal tab open during heavy dev sessions, but for the one-off "just let me open this app" moments, Sentinel is faster every time.
