What macOS will ask you
macOS is deliberately noisy about apps that install background services or need system access. Everything below is expected during Offsite setup: the setup screen announces each one before it appears.
During “Set up This Mac”
Section titled “During “Set up This Mac””1. Apple’s Command Line Tools installer
Section titled “1. Apple’s Command Line Tools installer”Appears when you click Install… in the Developer Tools row.
Why: a bare Mac ships only stubs for git and python3. The Offsite host
needs the real ones. What you get: the same toolchain any local development
needs — this is Apple’s own installer, not ours. Offsite waits and continues
automatically when it finishes.
2. Administrator password: “Offsite wants to make changes.”
Section titled “2. Administrator password: “Offsite wants to make changes.””Appears once, and only if you enable always reachable.
Why: Offsite registers its host agent as a system service. What you get: this Mac stays reachable from your phone after a restart, before anyone logs in. Cancelling skips only this option; everything else keeps working, and the host is then reachable while you are logged in.
3. Notification: “App Background Activity”
Section titled “3. Notification: “App Background Activity””Software from “RapidRocket GmbH” can run in the background.
Why: macOS names the certificate holder, not the app. RapidRocket GmbH is Offsite’s publisher. What the items are: the Offsite agent and its session helpers — the processes that keep your sessions alive when the app is closed. You can review them anytime under System Settings › General › Login Items & Extensions.
4. “Allow ‘Offsite’ to find devices on local networks?”
Section titled “4. “Allow ‘Offsite’ to find devices on local networks?””Appears right after Launch Host, when the app looks for its host the first time.
Why: Offsite discovers your host on the local network (Bonjour) so devices on the same network can connect directly. What you get: the fast LAN path, lower latency and no detour through the relay, whenever your Mac and your phone share a network. If you decline, everything still works; connections simply always take the relay path.
Later, only if you enable Computer Use
Section titled “Later, only if you enable Computer Use”5. Screen Recording and Accessibility for “Offsite Agent Bridge”
Section titled “5. Screen Recording and Accessibility for “Offsite Agent Bridge””Why: the Agent Bridge is the signed helper that takes screenshots and performs clicks for agent sessions; macOS gates both capabilities behind these two switches. What you get: agents can see and drive the screen — for example to test an app they just built. Off by default, and every session additionally starts locked until you unlock it.
6. “Offsite Agent Bridge is requesting to bypass the system private window picker…”
Section titled “6. “Offsite Agent Bridge is requesting to bypass the system private window picker…””Appears on the first screenshot after you grant Screen Recording — Offsite triggers it right in the settings moment so it does not interrupt your first agent session — and macOS repeats it periodically (roughly monthly, and after restarts).
Why: since macOS 15, apps that capture the screen programmatically (without the interactive window picker — which is the only way an agent can take screenshots) get this extra, recurring confirmation on top of the Screen Recording permission. Every screen-capture tool gets it; it cannot be turned off. What you get: confirmation that agents can keep taking screenshots; clicking Allow is all that is needed.
7. Automation prompts per app
Section titled “7. Automation prompts per app”“Offsite Agent Bridge wants to control …”
Why: macOS asks once per target app the first time an agent runs AppleScript against it. What you get: scripted control of that specific app, and nothing else — the grant does not extend to other apps.
Later, during everyday use
Section titled “Later, during everyday use”8. Folder access: “‘offsite-relay-agent’ would like to access files in your Documents folder.”
Section titled “8. Folder access: “‘offsite-relay-agent’ would like to access files in your Documents folder.””Appears the first time a session, the workspace file browser, or any host process reads a macOS-protected folder (Documents, Desktop, Downloads — also network volumes and removable drives, each asked separately).
Why: everything you run through Offsite executes under Offsite’s background
agent, so macOS attributes the file access to that agent — that is why the
prompt names the raw binary offsite-relay-agent instead of “Offsite”.
What you get: sessions and the file browser can work with projects inside
that folder. If you keep your code elsewhere (for example ~/git), you can
decline — macOS asks again on the next real access.
What you will NOT be asked
Section titled “What you will NOT be asked”- No Apple ID, no account.
- No Remote Login / SSH activation for “This Mac”.
- No admin password for the standard setup (only for the optional always reachable service).