Last tested: Macos 26.5.2 (25F84) jul 2026
I have and bundle_id "com.endpoint"
General SQL looks like this. It returl a lot of useless info for you:
sudo sqlite3 -markdown -header "/Library/Application Support/com.apple.TCC/TCC.db" "SELECT * FROM access WHERE client LIKE '%endpoint%';"
so this is a little formatted layout:
sudo sqlite3 -markdown -header "/Library/Application Support/com.apple.TCC/TCC.db" \
"SELECT
service,
client,
CASE auth_value
WHEN 0 THEN 'Denied (0)'
WHEN 2 THEN 'Allowed (2)'
ELSE CAST(auth_value AS TEXT)
END AS status,
datetime(last_modified, 'unixepoch', 'localtime') AS modified_time
FROM access
WHERE client LIKE '%endpoint%';"
| service | client | status | modified_time |
|---|---|---|---|
| kTCCServiceScreenCapture | com.endpoint | Allowed (2) | 2026-02-03 19:00:35 |
| kTCCServiceSystemPolicyAllFiles | /Users/a/Library/Developer/Xcode/DerivedData/endpoint-hckcawfzgtmpkfaaegaejeoqqtyh/Build/Products/Debug/appService | Denied (0) | 2026-02-04 12:59:43 |
| kTCCServiceScreenCapture | /Users/a/Library/Developer/Xcode/DerivedData/endpoint-hckcawfzgtmpkfaaegaejeoqqtyh/Build/Products/Debug/appService | Denied (0) | 2026-02-06 22:43:14 |
| kTCCServiceAccessibility | com.endpoint | Allowed (2) | 2026-07-08 18:59:03 |
| kTCCServiceEndpointSecurityClient | com.endpoint.access | Allowed (2) | 2026-07-09 02:13:52 |
| kTCCServiceSystemPolicyAllFiles | com.endpoint | Allowed (2) | 2026-07-21 13:12:10 |