--- title: "AirPlayXPCHelper: what it is, why it uses the network, and whether to block it · Kilobat" url: "https://kilobat.app/processes/airplayxpchelper" description: "AirPlayXPCHelper is a macOS helper for AirPlay. What Apple documents about it, what its traffic is, and what breaks if you block it." --- Nearby devices # What is AirPlayXPCHelper? `AirPlayXPCHelper` is a macOS helper with AirPlay in its name. Apple publishes no man page for it. Its launchd services belong to CoreMedia's AirPlay endpoints, and its traffic stays on your local network. Process: `AirPlayXPCHelper` · Made by Apple · Applies to: macOS 14 Sonoma and later. Checked on macOS 27.2. · Checked: 1 November 2026 ## Short answer Part of macOS, not documented by Apple. Its name and its launchd services point to AirPlay, the streaming of video and audio between Apple devices and TVs. Block with care Blocking it doesn't save internet data. AirPlay from this Mac to TVs and speakers may stop working. Path `/usr/libexec/AirPlayXPCHelper` launchd label `com.apple.AirPlayXPCHelper` Signing identifier `com.apple.AirPlayXPCHelper` ## What it is Apple publishes no man page for `AirPlayXPCHelper`. The program is `/usr/libexec/AirPlayXPCHelper`, signed by Apple. launchd starts it for the system as `com.apple.AirPlayXPCHelper`. Its launchd property list names the services that it offers. They include `com.apple.coremedia.endpointmanager.xpc`, `com.apple.coremedia.endpointpicker.xpc` and `com.apple.coremedia.endpointstream.xpc`. Those names point to AirPlay devices, the “endpoints” you can stream to. Apple doesn't document what each service does. AirPlay streams video and audio from a Mac to an Apple TV or a smart TV, or from other devices to a Mac. Apple lists TCP ports 5000 and 7000 for AirPlay. ## Why it uses the network - **Streaming to a TV or speaker.** When you choose an Apple TV, a smart TV or a speaker as the output, the stream goes from the Mac to that device. - **Finding AirPlay devices.** Apple lists Bonjour on UDP port 5353 for AirPlay. Devices that you can stream to show up through it. ## How much is normal Traffic while you stream to a TV or a speaker is expected. Video takes much more than audio. AirPlay between devices on the same network doesn't use your internet connection. Kilobat counts local traffic apart. When you aren't streaming, it is quiet or not running at all. launchd starts it only when it is needed. ## When it uses a lot, and why - **Screen mirroring.** Mirroring the Mac's display to a TV sends a continuous video stream for as long as the mirror runs. - **A video to a TV.** Streaming a film or a long video to an Apple TV moves a lot of data, but only on your local network. ## Is it safe to block? Block with care Blocking it doesn't save internet data. AirPlay from this Mac to TVs and speakers may stop working. What breaks if you block it - Streaming video or audio from this Mac to an Apple TV, a smart TV or an AirPlay speaker may fail. - Screen mirroring to a TV may fail. - Apple doesn't document the helper's other services, so other AirPlay features may be affected too. Blocking means a firewall rule that refuses its connections. Don’t quit or disable a macOS process to save data: macOS starts it again, and other features depend on it. ## Reduce its use 1. Stop streaming when you don't need it. Click the AirPlay button in the app, then deselect the TV or speaker. 2. To stop other devices streaming to this Mac, choose Apple menu › System Settings › General › AirDrop & Continuity. Turn off AirPlay Receiver. 3. Don't quit `AirPlayXPCHelper` in Activity Monitor. macOS starts it again. ## See how much it uses 1. Open Activity Monitor from Applications › Utilities. Click Network, then search for `AirPlay`. 2. In Terminal, list its open connections while you stream. The addresses should be on your local network. ``` lsof -nP -i -a -c AirPlayXPC ``` ## With Kilobat 1. In the Kilobat app list, search for `AirPlayXPCHelper`. Its row shows the live rate and what it moved today. 2. In Connections, click the ⓘ button on one of its rows. The popover shows this page’s short answer, without going online. 3. In Terminal, ask the same question. Add `--json` for scripts and agents. ``` kilobat explain 'AirPlayXPCHelper' ``` 4. Show its traffic over one day. ``` kilobat bandwidth 'AirPlayXPCHelper' day ``` 5. Through MCP, an AI agent asks `explain_connection` with the process name. It gets the same facts. The live view and the explanations are free. History in the app needs Kilobat Pro. Blocking needs Pro and the network filter: see the [network filter](https://kilobat.app/docs/blocking#filtering), [Protection](https://kilobat.app/docs/blocking#protection) and the [hotspot data saver](https://kilobat.app/save-hotspot-data). ## What isn’t documented Apple doesn't document `AirPlayXPCHelper`. This page describes only its launchd property list, its path and what Apple says about AirPlay. The AirPlay Receiver that listens on ports 5000 and 7000 is a separate process, ControlCenter. See [Port 5000 or 7000 is in use on a Mac: AirPlay Receiver](https://kilobat.app/guides/airplay-receiver-port-5000). ## Questions **Is AirPlayXPCHelper a virus?** No. It is in `/usr/libexec`, signed by Apple, and launchd starts it from Apple's own property list. **Why is port 5000 already in use on my Mac?** AirPlay Receiver listens on ports 5000 and 7000. See [Port 5000 or 7000 is in use on a Mac: AirPlay Receiver](https://kilobat.app/guides/airplay-receiver-port-5000). ## Sources - launchd property list com.apple.AirPlayXPCHelper, macOS 27.2 - [Apple Support: Stream video and audio with AirPlay](https://support.apple.com/guide/mac-help/stream-video-and-audio-with-airplay-mchld7e543a0/mac) - [Apple Support: TCP and UDP ports used by Apple software products](https://support.apple.com/en-us/103229) - [Apple Support: Change AirDrop & Continuity settings on Mac](https://support.apple.com/guide/mac-help/mchl6a407f99/mac) Checked on 1 November 2026. ## Related - [sharingd](https://kilobat.app/processes/sharingd): Part of macOS. It runs AirDrop, Handoff, Instant Hotspot discovery and the shared computers in the Finder. AirDrop transfers can show under it. - [mDNSResponder](https://kilobat.app/processes/mdnsresponder): Part of macOS. It handles system DNS lookups for apps and runs Bonjour on the local network, so its traffic can include other apps' name lookups. - [rapportd](https://kilobat.app/processes/rapportd): Part of macOS. It connects this Mac to your other Apple devices on the local network for Handoff, phone calls and other Continuity features. - [Port 5000 or 7000 is in use on a Mac: AirPlay Receiver](https://kilobat.app/guides/airplay-receiver-port-5000) - [Port already in use on a Mac](https://kilobat.app/guides/port-already-in-use)