macOS includes a robust security feature called Gatekeeper. When you attempt to open an application downloaded from outside the Mac App Store, Gatekeeper verifies that the software has been cryptographically signed by a registered Apple Developer and checked for malware (a process called notarization).
If you try to open an older, unsigned application or a custom script written by a colleague, macOS will outright refuse to open it, displaying a warning that the app “cannot be opened because the developer cannot be verified.”
While you can usually bypass this warning on a per-app basis by right-clicking the app and selecting “Open,” system administrators or advanced users who frequently compile their own software often find this tedious. To modify Gatekeeper’s strict global policies, you must use the spctl (System Policy Control) command in the Terminal.
Understanding the Gatekeeper Interface Change
In older versions of macOS, if you opened System Preferences > Security & Privacy, there was a visible “Anywhere” option under “Allow apps downloaded from.” Apple removed this button several years ago to protect average users from accidentally executing malware.
The spctl command allows you to interact with the hidden assessment subsystem and restore this lost functionality.
Step 1: How to Globally Disable Gatekeeper
If you are a developer and need to test unsigned software constantly without macOS blocking you, you can use spctl to completely disable the Gatekeeper assessment checks.
Open the Terminal and run the following command. Because you are modifying a core security policy, you must use sudo:
sudo spctl --master-disablePress Return, enter your administrator password, and press Return again. The command completes silently.
If you now open System Settings > Privacy & Security and scroll down to the Security section, you will see that the hidden “Anywhere” option has magically reappeared and is currently selected. You can now launch absolutely any software on your Mac without a warning prompt.
Step 2: How to Re-enable Gatekeeper
Running a Mac with Gatekeeper permanently disabled is a massive security risk and is strongly discouraged for daily use. Once you are finished testing your unsigned software, you should immediately restore the strict security policy.
To re-enable Gatekeeper and re-hide the “Anywhere” option, run:
sudo spctl --master-enableStep 3: Checking the Status of Gatekeeper
If you are an IT administrator remotely auditing a fleet of Macs, you need to know if any users have disabled Gatekeeper. You can query the current status using the --status flag.
spctl --statusThe terminal will output one of two messages:
assessments enabled(Gatekeeper is on and protecting the system).assessments disabled(Gatekeeper is off and the system is vulnerable).
Step 4: Evaluating a Specific Application
If Gatekeeper is enabled and an application refuses to launch, you can use spctl to diagnose exactly why the system is rejecting it. You can force the policy engine to assess a specific app file.
spctl -a -v /Applications/SuspiciousApp.app- -a: Assess.
- -v: Verbose mode (provide detailed feedback).
The command will analyze the app’s code signature. If it is rejected, the output will usually tell you why (e.g., “invalid signature” or “obsolete resource envelope”), allowing you to inform the software developer of exactly what they need to fix to pass macOS security checks.