Free · No install · No account · Intel & Apple Silicon
mac-check.sh is a free Terminal script that checks a MacBook for Activation Lock, battery health, MDM enrolment, wipe state, and known model defects in under a minute. It uses only macOS built-in commands, installs nothing, and changes nothing on the machine. It works on both Intel and Apple Silicon Macs. One check — pending software updates — makes a network call to Apple's servers; all other checks run entirely offline.
Who is this for?
This tool is useful in three situations. If you are selling a MacBook, running it first tells you exactly what a buyer will find — no surprises during inspection. If you are buying a used Mac, ask the seller to run it and share the output before you pay. If you work in a repair shop or buyback operation and receive trade-ins daily, the script logs every result to a CSV automatically so you have a record of every device you checked.
What does mac-check.sh actually check?
The script checks eight things that directly affect whether a Mac can be sold, listed, or resold:
- Activation Lock — if this is on, the Mac cannot be erased or set up by anyone else. The script prints a red warning the moment it detects it. A Mac with Activation Lock enabled cannot be sold.
- MDM enrolment — MDM is a corporate management profile. Even with Activation Lock off, a managed Mac re-locks itself the first time it connects to Wi-Fi after a wipe. The script catches this separately from Activation Lock.
- Battery health and cycle count — the script reads real capacity from the device hardware and calculates actual health as a percentage. Apple's own display rounds this number; the script does not. Anything below 80% is flagged.
- Storage SMART status — confirms the drive has passed its own self-test. Also flags low free space, which degrades APFS performance.
- Wipe state — checks whether local user accounts still exist, whether FileVault is on, whether an iCloud account is signed in, and whether a firmware password is set on Intel Macs. Any of these can block a clean handover.
- Known model defects — the script matches the Mac's Model Identifier against a built-in list of Apple's documented hardware problems: the 2011 AMD GPU failure, butterfly keyboards from 2016 to 2019, and anti-reflective coating wear on 2012–2015 Retina displays.
- Kernel panics — repeated kernel panics mean hardware instability. The script counts panic files in the system logs and flags the date of the most recent one.
- Peripherals — camera, Wi-Fi, Bluetooth, keyboard, trackpad, and Thunderbolt port count are all read from system logs and confirmed as detected.
- macOS install date — reports when macOS was first set up on this drive, giving a rough sense of how long the Mac has been in use.
- Pending software updates — checks whether macOS updates are waiting. If updates are found, the script offers to install them at the end (requires your admin password — nothing happens automatically).
- Plain-English guidance — when something is flagged, the script prints a plain-English explanation of what it means and what to do about it, directly below the flagged item.
How do I run mac-check.sh on my MacBook?
Download the script using the button above. Then open Terminal — press ⌘ Space, type Terminal, and hit Return. Paste the following command and hit Return:
bash ~/Downloads/mac-check.sh
The script runs and prints a full report — most checks are instant, but the software update check makes a network call to Apple's servers which can add a few seconds or more on a slow connection. Scroll to the bottom for the verdict. A CSV log is saved next to the script automatically — if you are checking multiple devices, keep the script in one folder and run it on each Mac in turn.
You do not need the owner's password. The script reads system information only — it does not install anything, does not send data anywhere, and does not modify the machine.
The script saves two files automatically in the same folder: a running mac-check-log.csv with one row per device checked, and a clean mac-check-reports/ folder containing a full plain-text report for each individual Mac. The report file has ANSI color codes stripped out so it is readable in any text editor and safe to attach to an email.
What do the four verdicts mean?
RESELL means the Mac is clean, unlocked, and the battery is above 80%. It is ready to list or hand over.
WIPE FIRST means user accounts or an iCloud account are still present. Erase the Mac using macOS Recovery, then re-run the script to confirm it came back clean before selling.
PARTS means one or more of the following: Activation Lock is enabled, MDM is enrolled, the battery is below 80%, or the Mac has three or more kernel panics. Any of these alone makes the device difficult or impossible to resell as a working unit.
CHECK MANUALLY means battery data was unreadable. This happens on some older Intel Macs. Open System Information and check battery health by hand before deciding.
How do I check if a MacBook has Activation Lock before buying?
The only reliable way to check Activation Lock on a Mac that is in front of you is to run a diagnostic on the device itself — Apple retired its public Activation Lock checker in 2017. The mac-check.sh script reads Activation Lock status directly from the Mac's hardware and reports it in the first section of its output, labelled SELLABILITY. If the status says Enabled, do not buy the Mac.
How do I check MacBook battery health before selling?
The script reports battery health as a percentage calculated from actual current capacity versus original design capacity. It also reports cycle count and Apple's own condition assessment separately. A battery below 80% will show a "Service Recommended" warning to the buyer inside macOS — the script surfaces this before the sale so you can price accordingly or replace the battery first.
Does the script work on Apple Silicon Macs — M1, M2, M3, M4?
Yes. The script detects the chip architecture automatically and adjusts its checks accordingly. On Apple Silicon, firmware password does not apply — that check is skipped. Battery health is read using the correct IOKit fields for Apple Silicon, which differ from Intel. The OS ceiling check only applies to Intel Macs, where Apple has confirmed macOS 26 Tahoe is the last supported release.
The script also includes a built-in model name lookup table. For common models — MacBook Air M1 2020, MacBook Pro 14-inch 2021, MacBook Pro 13-inch M1, and others — it prints the full Apple marketing name alongside the Model Identifier, so the tech sheet reads "MacBook Air (M1, 2020)" rather than just "MacBookAir10,1".
Is mac-check.sh safe to run on a Mac I don't own?
Yes. The script is read-only. Every command it runs reads system information — none of them write to the disk, change settings, install software, or transmit data. The only file it creates is a local CSV log in the same folder as the script itself. You can open the script in any text editor to verify this before running it.
Frequently asked questions about checking a Mac before selling
What happens if I sell a Mac with Activation Lock still on?
The buyer cannot erase or set up the Mac. They will be blocked at the setup screen and the only resolution is for you to remove the device from your iCloud account. Most buyers will demand a refund or return at that point.
What cycle count is too high for a MacBook battery?
Apple rates most MacBook batteries for 1,000 cycles before capacity drops below 80%. A battery above 500 cycles is worth checking health on. The cycle count alone does not determine health — a Mac used lightly can have 800 cycles and still be at 85% health. The health percentage matters more than the cycle number.
What is MDM lock and why does it matter when selling a Mac?
MDM stands for Mobile Device Management. Companies use it to manage employee Macs remotely. If a Mac is MDM-enrolled and the company's server is still active, the Mac will re-enrol automatically after a wipe — the buyer cannot remove this without the company's IT team taking action. The script detects MDM enrolment and flags it as a reason not to proceed.
What does SMART status mean on a Mac?
SMART stands for Self-Monitoring, Analysis and Reporting Technology. The drive runs its own internal health checks and reports a Verified or Failing status. A Verified status means the drive has not detected internal errors. A Failing status means the drive is at risk of failure and the Mac should not be sold as fully functional.
Can I use this script to check a Mac before buying it in person?
Yes — this is one of the most useful applications. Ask the seller to open Terminal and paste the command while you watch. The script runs quickly for most checks — the software update check calls Apple's servers so timing depends on the connection. The output is straightforward. If they refuse to run it, treat that as a red flag.