Apple services

What is imagent?

imagent is the agent behind Messages on the Mac. Apple publishes no man page for it, but its framework and launchd services tie it to Messages and iMessage.

Process: imagentMade by AppleApplies to: macOS 14 Sonoma and later. Checked on macOS 27.2.Checked: 1 November 2026

Short answer

Part of macOS, not documented by Apple. It is the agent behind the Messages app, in the IMCore framework, so iMessage traffic can show under it.

Block with care

Blocking it stops Messages on this Mac. Your iPhone keeps working. Sign out of iMessage on the Mac if you don't use it here.

Path: /System/Library/PrivateFrameworks/IMCore.framework/imagent.app/Contents/MacOS/imagent
launchd label: com.apple.imagent
Signing identifier: com.apple.imagent

What it is

Apple publishes no man page for imagent. The program is IMCore.framework/imagent.app, signed by Apple, and launchd starts it for each user as com.apple.imagent.

Its launchd property list names services for push (com.apple.aps.imagent), for Messages notifications (com.apple.MobileSMS) and for Spotlight search of messages.

Apple Platform Security says that each iMessage goes through APNs. A long message or an attachment is encrypted and uploaded to iCloud; the recipient downloads it from there.

Why it uses the network

Sending and receiving messages. Text goes through the Apple Push Notification service. Apple says that APNs relays messages of up to 4 or 16 KB.
Attachments. Photos, videos and long messages are encrypted and uploaded to iCloud. The other devices download them from there.
Group conversations. Apple says that for a group, the process is repeated for each recipient and each of their devices.

How much is normal

Text messages are small. Photos and videos are the large part.

Each attachment is encrypted with its own key before it goes to iCloud, Apple says.

Apple doesn't document which of these steps run in imagent and which in other processes.

When it uses a lot, and why

Photos and videos. Sending or receiving a video uploads or downloads the whole file through iCloud.
Busy group chats. Every photo in a group arrives on every device of every member.

Is it safe to block?

Block with care

Blocking it stops Messages on this Mac. Your iPhone keeps working. Sign out of iMessage on the Mac if you don't use it here.

What breaks if you block it

Messages on this Mac can't send or receive iMessages.
Attachments can't upload or download.
Apple doesn't document what else depends on it, so other Messages features may fail too.

Blocking means a firewall rule that refuses its connections. Don’t quit or disable a macOS process to save data: macOS starts it again, and other features depend on it.

Reduce its use

If you don't use Messages on this Mac, open Messages. Choose Messages › Settings › iMessage and sign out.
On a hotspot, avoid sending videos from the Mac. Send them later on your usual network.
Don't quit imagent in Activity Monitor. macOS starts it again.

See how much it uses

Open Activity Monitor from Applications › Utilities. Click Network.
Type imagent in the search field. The Sent Bytes and Rcvd Bytes columns show what it moved since it started.
In Terminal, watch only this process. Press d to show the change per second, and q to quit.
```
nettop -p 'imagent' -P
```

With Kilobat

In the Kilobat app list, search for imagent. Its row shows the live rate and what it moved today.
In Connections, click the ⓘ button on one of its rows. The popover shows this page’s short answer, without going online.
In Terminal, ask the same question. Add --json for scripts and agents.
```
kilobat explain 'imagent'
```
Show its traffic over one day.
```
kilobat bandwidth 'imagent' day
```
Through MCP, an AI agent asks explain_connection with the process name. It gets the same facts.

The live view and the explanations are free. History in the app needs Kilobat Pro. Blocking needs Pro and the network filter: see the network filter, Protection and the hotspot data saver.

Hosts it contacts

Apple and the maker document these hosts for this feature. A process can also contact others; Kilobat’s Connections tab shows what it actually opens on your Mac.

*.push.apple.comThe Apple Push Notification service (APNs). The Mac keeps one connection to it, so notifications, iMessage, FaceTime calls and iCloud changes can arrive.Apple →*.icloud-content.comAn Apple domain for iCloud services. Large uploads and downloads of iCloud content, such as files and photos, can go to hosts under it.Apple →

What isn’t documented

Apple publishes no man page for imagent. This page relies on its launchd property list and on what Apple Platform Security says about iMessage.

Questions

Is imagent a virus?

The genuine macOS imagent is part of the IMCore framework, signed by Apple and started by launchd. Check the process path and signature if you are unsure.

Does Messages download attachments I don't open?

Apple says that each receiving device retrieves the attachment from iCloud when needed. Apple doesn't say when that happens on a Mac.

Sources

launchd property list com.apple.imagent, macOS 27.2
Apple Platform Security: How iMessage sends and receives messages securely
Apple Platform Security: iMessage security overview
Apple Support: Receive phone calls and text messages on your Mac

Checked on 1 November 2026.