Manage your Mac by describing the change you want.
NixMC is a native macOS app for managing a nix-darwin configuration with Claude Code or Codex CLI. Ask it to install an app, change a macOS setting, configure your shell, enable a service, or update your packages. nixmc prepares the edit, validates the configuration, and shows you the diff before anything is applied.
My Team turns a Git repository of Markdown recipes into a shared, curated catalog for everyone on the team. Connect it once in the app and nixmc fetches the latest recipes without mixing them into your personal configuration repo.
NixMC started as a way to share useful Mac configuration with coworkers without asking everyone to give up the aliases, tools, and muscle memory that make their own setup work. Recipes turn a configuration into searchable, living documentation: you can find what an alias does, reuse a proven choice, or adapt it to a different workflow. Updates are isolated into reviewable proposals, so keeping a workstation current never quietly changes the configuration you rely on every day.
- Plain-English changes to apps, tools, services, fonts, shell, and macOS settings
- Build validation and a complete diff before activation
- Claude Code and Codex CLI support with a selectable preferred agent My Team: a separately managed Git-backed recipe catalog your whole team can share- Git-backed history with inspect and rollback actions
- Plain-English guides generated from the configuration currently in use
- Source-backed recipes with Nix and shell examples for common macOS changes
- Pareto Security recommended-posture recipe for declarative Mac hardening
- Replacement Mac recipe to capture and reproduce a setup on a new machine
- Background flake-update proposals that wait for your approval
| Area | What you get |
|---|---|
| Apps & CLI tools | Add or remove Homebrew casks and formulae from one package browser |
| macOS configuration | Manage defaults, fonts, services, security, and system behavior |
| Mac security | Apply Pareto Security's recommended posture without weakening macOS protections |
| New Mac setup | Use the Replacement Mac recipe to capture a setup and reproduce it on the next Mac |
| Agent workflow | Describe a result and let the selected coding agent prepare the edit |
| My Team | Fetch a hand-curated Git repository of shared recipes, refreshed hourly and on demand |
| Review & apply | Format, build, inspect the diff, then activate with administrator approval |
| Configuration guide | Browse a readable explanation of what each configuration area does today |
| Updates | Check flake inputs automatically and review isolated update proposals |
| History | Inspect applied changes and roll back an earlier Git commit |
| Appearance | Choose light, dark, or system appearance and a preferred accent palette |
- Describe the result you want or choose a recipe.
- The selected agent edits the configuration repository.
- nixmc formats and builds the configuration.
- Review the generated diff and build output.
- Apply the change; nixmc activates it and records it in Git.
The agent runs non-interactively with permission to edit the configuration. Always review the proposed diff before applying it.
macOS hardening is easy to get wrong when settings are spread across System Settings, command-line tools, and undocumented defaults. Choose Pareto Security recommended posture from the Security & Secrets recipes to apply the core recommendations declaratively: firewall and stealth mode, screen locking, software updates, AirDrop discovery, and the security-sensitive sharing services. The recipe keeps macOS protections intact, includes the Pareto Security cask, and leaves any change visible in the normal build-and-diff review before it is applied.
Your configuration is a Git repository, so it can travel with you. Use the Replacement Mac recipe to capture non-default macOS settings, Homebrew apps, shell tools, and launch agents in the flake. On the new Mac, clone that same repository during first run, build it, review the diff, and apply it to recreate the setup you chose—without having to remember every preference or rebuild it from one-off setup commands.
-
People who want the reproducibility of nix-darwin without editing every Nix option by hand
-
Mac users who prefer reviewing a concrete diff over running one-off setup commands
-
Existing Nix users who want a focused interface for daily configuration changes
-
macOS 14 or newer
-
An administrator account on the Mac Claude Codeavailable on your shell path, orCodex CLIinstalled at
~/.local/bin/codex -
The selected coding agent signed in before nixmc is opened
Install Nix yourself before first use. NixMC links to Determinate's graphical installer for the familiar roughly five-minute macOS setup, but never downloads or runs an installer on your behalf. It uses the agent CLI already installed on the Mac, so no AI API key is entered into NixMC.
Check Releases for a signed
nixmc.dmg
. Open the disk image and move nixmc.app
to Applications.
If no signed release is listed, build the current version locally:
git clone https://github.com/dz0ny/nixmc.git
cd nixmc
make app
open dist/nixmc.app
- If prompted, install Nix with the linked graphical installer, then return to NixMC and choose
Check Again. - Create the initial nix-darwin configuration, or clone an existing remote dotfiles repository that contains
flake.nix
. - Open Settings > General and choose Claude Code or Codex CLI. - Describe a change in the message field or choose a recipe.
- Review the diff and build result, then select Apply.
Initial setup asks for administrator approval to create the canonical
/etc/nix-darwin
link. Applying system changes also requires administrator approval.
Creating a configuration starts from nixmc's small nix-darwin + Home Manager
template. It tracks nixpkgs-unstable
intentionally: a Mac workstation needs
current applications, developer tools, and macOS support more often than a
long-lived server does. This does not make each build unpinned—the generated
flake.lock
records the exact revisions in use, so a known configuration can
always be reproduced. nix-darwin
and Home Manager follow that same pinned
nixpkgs
revision.
nixmc updates those pins as a reviewable change. When automatic update checks
are enabled (or when you check manually), it creates an isolated Git worktree,
runs nix flake update
, commits the resulting lock-file change, and verifies
it with darwin-rebuild build
. It then presents the diff as an update proposal. Choosing Stage for review stages that proposal in your configuration repository; you still review the diff and use Build & Apply to activate it. Dismissing a proposal leaves your live configuration untouched.
There is one supported source of configuration: the single Git-backed flake
that nixmc manages. New configurations live at ~/.config/nixmc/darwin
, with
/etc/nix-darwin
linked to it; if you already have a flake at
/etc/nix-darwin
, nixmc uses that repository instead. Make system, user, and Homebrew changes in this one repository through nixmc so the build, diff, history, rollback, and update workflow all describe the same machine. Do not maintain a second nix-darwin configuration alongside it.
| Permission | Why it is needed |
|---|---|
| Administrator approval | Create /etc/nix-darwin and activate system changes |
| App Management | Allow Homebrew to update managed app bundles in /Applications |
If apply fails with Operation not permitted
while processing an app bundle, open System Settings > Privacy & Security > App Management, allow nixmc, then apply again.
The Git-backed configuration lives at:
~/.config/nixmc/darwin
Homebrew packages are declared in:
~/.config/nixmc/darwin/.nixmc/homebrew/data.json
Applied changes are committed automatically so the History section can show diffs and roll back earlier changes.
Open My Team in the sidebar and paste a GitHub repository URL. nixmc keeps
an independent shallow checkout at ~/.nixmc/team-recipes
, fetches it hourly,
and refreshes it when the page is opened. This catalog is intentionally kept
outside ~/.config/nixmc/darwin
, so team recipe updates never alter your configuration history.
Put recipe Markdown anywhere in that repository. Use descriptive file names
and include title
, section
, and summary
front matter; the app discovers files recursively and groups all of them under My Team. Start from the example recipe.
A root-level GUIDE.md
is also supported. nixmc displays that team-authored guide verbatim in the My Team > Guide tab and includes it in global search.
Built-in recipes live under
Sources/nixmc/Resources/recipes/<section>/<title>.md
. They are bundled with the app and grouped by the same areas shown in the sidebar. The front matter drives the UI; the Markdown body is passed to the selected agent and may contain exact Nix snippets, shell commands, or a focused diff.
Recipe pull requests are welcome in the recipes folder, especially for well-tested macOS, nix-darwin, and Home Manager workflows with a source link and a concise guide section.
---
id: touch-id-sudo
title: Enable Touch ID for sudo
section: Security & Secrets
symbol: touchid
summary: Add the supported PAM rule for Touch ID authentication in Terminal.
featured: true
source: https://github.com/nix-darwin/nix-darwin
---
``` nix
security.pam.services.sudo_local.touchIdAuth = true;