com.harryaskham.atop · Swift · menu bar · atopd · CLI · MCP

atop

A monitor for what is really going on with a Mac: the usual CPU, memory, disk and network, plus the signals that came before this machine's crashes. WindowServer stalls approaching its 40-second watchdog, the memory compressor's segment limit, swap growth, blocked work, storms of new processes or system calls, stuck processes, deprioritised services and recent panic reports.

Two halves

Two halves of atop atop's two parts. atopd runs as root under launchd and samples every process in one pass, every 10 seconds, or every 2 seconds while the dashboard is open, keeping about an hour of history; it never starts other processes to do it. Atop.app sits in the menu bar with small charts, a dashboard, a probe of WindowServer's response time and a short event journal, and falls back to sampling only your own processes if atopd is not running. The atop command prints the same frame as text or JSON, and serves MCP tools. atopdroot · launchd10 s, or 2 s when watched Atop.appmenu bar · dashboard atopreport · --json · mcp the warning signsWindowServer stallsswap · spawn storms

On an M4 Max with about 1,100 processes, one root sample of every process (CPU, memory footprint, disk I/O, system calls and priority) takes about 4 ms, and the per-thread scan for stuck processes about 7 ms more. Nothing is spawned to take it.

The signals

RiskSourceStrained · danger
WindowServerThe app times a real window-list request; atopd watches the main thread's kernel state for no CPU progress5 s · 15 s
MemoryCompressor segments used against their limit, and kernel pressure75% · 90%
SwapSwap in use and the number of swap files24 · 48 GiB
DiskFree space on the data volume25 · 10 GiB
BlockedOne-minute load beyond the busy CPUs2× · 4× CPUs
SpawnsProcess-id allocation rate40/s
SyscallsSystem calls per second against the recent median4× · 8×

The thresholds are defaults. macOS takes a watchdog stackshot when WindowServer stalls for 40 seconds.

Reading it

Click the menu-bar item for the dashboard; drag it away to keep it open as a window. Hovering any chart scrubs every signal to that moment and shows the busiest processes then. Space pauses the dashboard on one moment while sampling carries on, and ⌘C copies exactly what is on screen as Markdown.

Agents see the same view through an owner-only socket, as commands or MCP tools. That socket can report and pause the view; it runs nothing and changes no settings.

atop
# one report, from atopd or sampled locally
atop snapshot --json
atop history swap --minutes 60
atop processes --sort syscalls
atop mcp