Paws — finds the processes nobody owns

Why it slows down

The fan spins, but the culprit stays hidden

When a Mac slows down we go looking for the heaviest app. On a Mac running several AI tools, the culprit isn’t at the top of the list — it isn’t in the list at all.

The heavy work finished long ago, and the fan is still spinning.

Only a few windows are open, yet scrolling feels sticky and switching apps lags.

“Your system has run out of application memory.” You quit the app it named, and minutes later it’s back.

You open Activity Monitor, see hundreds of rows, and have no idea where to start.

When these four arrive together, it’s usually not one big app but hundreds of small processes piling up. Each one is harmless on its own — which is exactly why neither the warning nor Activity Monitor can point at them.

The record from the day this app was made 2026-09-09 · Mac Studio M4 Max · 64 GB · 55 days uptime

What the warning named

Safari1.15 GB
Terminal1.69 GB

Both were innocent. They were quit as instructed; the warning came back minutes later.

What never appeared in it

Orphaned chroma-mcp2,750
Memory they held34 GB

This was the culprit. Their parents died, launchd adopted them, and they piled up quietly for 55 days.

3,311

processes running that day. This Mac normally runs about 570.

73 GB

of swap in use. Physical memory was 64 GB.

1,374 pairs

spawned on every worker restart and never reclaimed.

“Can’t I just count them on my own Mac?”

Not in one line. Counting parentless processes on the Mac this was written on gives you this:

$ ps -eo ppid= | awk '$1==1' | wc -l 798

All ~800 of them have “no parent”, and the number worth cleaning up is zero. Spotify, Notion, Safari’s tabs and dozens of Apple’s audio helpers all have launchd as their parent too. Having no parent isn’t evidence of being orphaned — it’s just an absence of information. Telling real orphans apart from processes that are doing their job — that is what Paws does.

What it finds

Tells you why it's slow, by name

Plenty of tools show you how much memory something uses. Paws goes further and decides which of them lost its owner.

Orphan processes

A process left behind when its parent died. It becomes a candidate only once three or more of the same command have piled up. A lone one is left alone.

Large processes with no session

Something no terminal is holding that still eats a lot of memory. Paws never ends it on its own; it only lists it.

Memory pressure

The ring in the menu bar says the state in color. Grey when calm, orange on warning, red on danger. A graph shows how it got there.

How it works

It doesn’t guess.
It asks the kernel

What to keep is the harder question, not what to remove. Paws narrows that judgment in four steps, and stops at any step where it isn’t sure.

It watches

Memory pressure and swap every 5 seconds, the process list every 15. All you see is one ring in the menu bar.

NO EFFECT ON YOUR WORKPaws stays under 100 MB. It remembers the last 15 minutes and drops the rest.

It judges

It asks “is a session holding this?”, not “is this busy?”. It reads the group the kernel put in front of the terminal (e_tpgid), and protection spreads upward to the parent.

NO EFFECT ON YOUR WORKWhatever the terminal holds, and everything beneath it, is protected — including an AI session sitting at 0% CPU waiting for input.

It narrows

Only commands stacked three deep or more become candidates. Apple’s XPC services and app extensions are never candidates at all.

NO EFFECT ON YOUR WORKA lone process may simply be working. When it isn’t sure, it doesn’t list it.

You choose

It opens the record window, shows you what is about to end and asks again. For processes no session holds, the list opens with nothing ticked at all. What was ended, when and why is kept for a year.

NO EFFECT ON YOUR WORKAutomatic cleanup is off by default. Even switched on, it only touches orphans that passed step 03.

We got this judgment wrong once

The first version treated “not in launchctl’s list” as proof of being orphaned. On that rule it ended 108 healthy Apple XPC services — Safari’s web content processes among them. It shipped with all 100 synthetic tests passing. Absence from the list was an absence of information, not evidence, and testing against fake processes could never have revealed that.

Now a test on a real machine — “on a healthy Mac, is the automatic cleanup set empty?” — runs on every build. The rules have grown to six since that day, and every one of them defaults to doing nothing when unsure.

The real thing

This is what it looks like

Every shot below was taken on the Mac this was written on, or printed straight from the code the app draws its icon with. Nothing redrawn, no numbers dressed up.

One thing in the menu bar

Day to day, one paw is all you see. Turn on the readout in settings if you want numbers.

The ring around it carries the memory state.
Quiet normally, coloured when it matters.

The Paws icon in the Mac menu bar: a single paw inside a ring gauge.

Readout off (default)

Readout on

Normal

Warning

Critical

Paused

Cleaning

When you click it

The whole state fits on one panel, nothing to scroll — reclaimed so far, what it found, free memory and swap, process count, the pressure graph, the last action, and settings and quit at the bottom.

This Mac has taken back 161.3 GB since install,
across 1,590 processes.

The whole Paws panel: the automatic-cleanup switch, 161.3G reclaimed, findings, memory and swap, process count, the pressure graph, recent actions, and settings and quit at the bottom.

Before anything ends

Press clean up and the record window opens, lists exactly what is about to end, and asks again. Only what you pick ends.

“Unsaved work may be lost.”
It says that before it ends anything.

The cleanup approval sheet over the record window, listing the processes about to end with cancel and end buttons.

What, when and why

Everything ended stays on the record — by date, how many of what, and how much came back. Kept for a year.

Cleaned up most — 1,122 node,
427 GoogleUpdater.

The actions tab of the Paws record window: total reclaimed, a bar chart by date, a most-cleaned list and the day-by-day log.

Captured 18 September 2026 with Paws 1.3.2 on macOS 26, a Mac Studio (M4 Max, 64 GB). The numbers are that machine’s real values. The six menu-bar icons were printed straight from the code that draws them (PawGauge, MenuBarLabel) — a screenshot picks up the wallpaper through them and goes muddy.

What it never does

A tool that loses your work
isn't worth using

What matters most in a cleanup app is not what it removes but what it leaves.

HOLD
Never touches what your terminal is holding

Everything hanging below it is protected too. An AI session waiting for input counts.
HOLD
Nothing is pre-checked

The cleanup list opens empty. Every process that ends is one a person picked.
HOLD
Data never leaves this machine

No usage statistics, no crash reports. The license check is the single exception.
HOLD
No termination without a record

It asks again before ending anything, and writes down what ended, when, and why. When the call is uncertain, it does nothing.

Zero CPU doesn't mean idle. Claude Code waiting for input uses 0 CPU. Cleanup tools that judge by CPU kill it. Paws reads the group the kernel put in front of the terminal, e_tpgid. It asks whether a session owns it, not whether it's busy.

34 GB was gone.
The culprit wasn't on the list.