ostapondo/Plonk

A toolbox for your Mac, behind one menu bar icon.
Windows, workspaces, screenshots, OCR, a ruler, keep-awake, pointer tools,
shortcuts, voice and agents — native, local and modular.
To plonk is to set a thing down exactly where it belongs.
ostapondo.github.io/Plonk
One app instead of eight menu bar icons
Plonk is a small suite of macOS tools that share one interface, one command
palette and one automation surface. Use all of it, or switch off every module
you do not need.
**Capture and understand the screen.** Take a region, window or full-screen
screenshot, annotate it, pin a live crop, copy otherwise unselectable text with
on-device OCR, or measure an interface in points and pixels.
**Keep the Mac and your workflow moving.** Hold sleep off until a timer, time of
day or process exit; find the pointer, add crosshairs or click rings; inspect the
front app's real shortcuts; and run anything by name from one palette.
**Arrange the desk.** Draw snap zones, save workspaces that remember each
monitor, move windows by drag, shortcut or voice, and let app rules put new
windows where they belong.
**Let an agent use the same tools.** Plonk ships an MCP server and CLI for
layouts, workspaces, screenshots, OCR, measuring, keep-awake and the rest. The
app stays the source of truth, and the whole surface remains on your Mac.
**It is early.** Version 0.4.x, one author. Shortcuts, zone files and workspaces
are settled. The MCP tool names and the HTTP API are not, and can still change
between minor versions. CHANGELOG.md says what moved.
Install
macOS 13 or newer, Apple silicon.
Grant Accessibility when it asks, then relaunch. Screen Recording is asked for
separately, the first time you capture. Nothing else: no Full Disk Access, no
Automation, no Keychain.
Plonk is signed but not notarized, so macOS holds a copy you download by hand.
The cask takes care of that for you.
Running it alongside Rectangle or Magnet is fine, as long as their shortcuts do
not collide.
**Checking what you downloaded.** Notarizing an app means paying Apple for a
developer account, and this project does not have one, so Plonk is signed with
a certificate it made itself. That means macOS cannot tell you who built the
app. There is a check that answers a more useful question, and you can run it
yourself: was this exact file built by GitHub from the source in this
repository?
Put the number from the file name in place of . The command comes
with the GitHub CLI, which is brew install gh. It
prints the commit and the workflow run that built the archive. If the file was
altered after it was built, or was not built from this repository at all, the
command fails and tells you so.
Every release also carries a small Plonk- .zip.sha256 file. Put it
beside the zip and run shasum -a 256 -c Plonk- .zip.sha256 to confirm
the download arrived complete and unchanged. That file is signed the same way
as the zip, so gh attestation verify works on it too. The attestation itself
is also on the release as Plonk- .zip.sigstore.json, for anyone who
wants to check it offline with gh attestation verify --bundle or with
cosign instead of asking GitHub.
Installing by hand, Intel Macs, tiling managers, and removing it
**Why macOS holds a downloaded copy.** The certificate is self-signed rather
than an Apple Developer ID, because notarizing needs a paid Apple account and
this project does not have one. macOS cannot vouch for who built it, and says
so. The cask skips that check by clearing the quarantine flag for you.
That is a check skipped on your behalf, so here is a stronger one to run before
you open anything:
It prints the commit and the GitHub Actions run that built this exact archive.
Apple's stamp would tell you a build passed a malware scan. This tells you the
binary came from the source in this repository, with no laptop in between.