What is searchtoold on Mac?

Last updated: 2026-08-08

What it is

searchtoold is a user-level search daemon supplied by Apple as part of macOS. Despite the “OmniSearch” name in its framework path and code identifier, it is not the similarly named third-party search application. The executable lives inside the protected /System/Library/PrivateFrameworks/OmniSearch.framework directory and identifies itself as com.apple.omniSearch.searchtoold.

Its launch agent registers internal services for general search, personal search, and answer synthesis. Resources shipped with the framework indicate that its personal-search results can cover files, Mail, Messages, contacts, calendars, and photos. They also contain material related to query rewriting and answer synthesis. That makes searchtoold broader than a simple web-search helper: it participates in processing queries and assembling different kinds of results.

There is still an important boundary around what can be stated confidently. Apple has not published a manual page or a complete description of the daemon’s responsibilities. The precise division of work among searchtoold, Spotlight, Siri, Apple Intelligence, Core Spotlight, and other search services has not been verified. Its visible services and resources show what kinds of work it can participate in, but they do not document the whole search pipeline.

Why it talks to the network

The searchtoold binary has permission to initiate network connections and can call Apple search services such as parsecd. System-level triggers include opening Spotlight or typing a Spotlight query, requesting internet or related-content suggestions, and invoking Siri from Spotlight. A connection recorded under this process can therefore be part of ordinary search handling rather than evidence of a background download.

Possible destinations include Apple’s search and suggestion services, Apple partners that supply related content, and trusted service providers used by Apple. According to Apple’s search privacy information, requests of this kind may include the query, an approximate location, topics of interest, the suggestion selected by the user, and limited device context. Apple also says that this information does not include search results that show files or content stored locally on the Mac.

Those statements describe the service category, not a complete process-level network map. The specific domains contacted by searchtoold have not been verified. It is also unverified whether searchtoold itself opens connections to ChatGPT or Private Cloud Compute, or how individual connections are divided between this daemon and other Apple processes. Seeing network activity under searchtoold is not enough to identify any one remote feature.

How much traffic is normal

There is no published process-level traffic baseline for searchtoold, and no reliable independent measurement establishes a normal byte range. A precise daily or per-query allowance would therefore be invented rather than evidence-based.

Based on the shape of its documented functions, normal activity would more likely appear as intermittent, query-triggered requests followed by result data. It should resemble search suggestions or answer responses more than sustained transfers such as photo synchronization or application downloads. That is only a qualitative expectation: it cannot be converted into a fixed number of kilobytes or megabytes, and the available evidence does not establish a threshold at which its traffic becomes abnormal.

Can you turn it off

The practical verdict is to keep searchtoold running. Apple does not provide a supported switch for disabling this shared daemon, so there is no System Settings path that turns the process itself off. Ending it or blocking its connections may interfere with personal-content search, query rewriting, answer synthesis, or Siri requests initiated from Spotlight. Apple has not guaranteed that local file search will continue unchanged after process-level blocking.

There are narrower controls for narrower goals. To remove online related content supplied by Apple partners, open Apple menu > System Settings > Spotlight and turn off Show Related Content. This changes the related-content feature; it does not disable searchtoold.

The same Spotlight settings page also contains Help Apple Improve Search. Turning that off prevents Apple from storing search queries for service improvement, but it does not stop normal query processing. Neither setting is equivalent to terminating or firewall-blocking the daemon.

What people get wrong

• “OmniSearch means it belongs to a third-party app or is malware.” It does not. This executable is stored in Apple’s protected System/Library area and has the Apple platform code identifier com.apple.omniSearch.searchtoold. The internal framework name is not evidence that the unrelated third-party application installed it.

• “It is only the networking back end for web search.” That description is too narrow. Its registered services and bundled resources cover general search, personal-content search, query rewriting, and answer synthesis. Files, Mail, Messages, contacts, calendars, and photos appear among the personal-search entity types it can handle.

• “It replaced mds and mdworker and now builds the entire Spotlight file index.” There is no evidence for that claim. What is known fits query processing, personal results, and answer services. Spotlight indexing remains part of the Core Spotlight and metadata-services system; the available evidence does not assign the whole indexing job to searchtoold.

• “Blocking it removes only web results, while local search definitely keeps working normally.” That has not been verified. Apple provides no compatibility guarantee for this kind of process-level blocking. Because the daemon also exposes personal-search and query-processing services, local or mixed-result searches may be affected.

• “If it connects to the internet, my files, emails, or photos must be getting uploaded.” That conclusion does not follow from the connection. Apple says the limited search information sent to its services does not include the results that display files or content stored on the Mac. Queries and limited contextual information may still be sent under the conditions described above.

• “Any connection attributed to searchtoold must be ChatGPT.” That is also unsupported. Spotlight suggestions, Apple search services, and related content can all require network access. ChatGPT additionally depends on the relevant feature being enabled or selected by the user, and it has not been verified that its sockets are directly owned by searchtoold.

Seeing what it actually used

When the concern is traffic volume, the next step is to measure searchtoold by process instead of guessing from its name or one connection. In Bytetally, find searchtoold in the per-process statistics and compare its activity with the times when Spotlight or Siri was used. That observation can show what your Mac actually transferred, although it cannot by itself identify an unverified remote service.

Related processes

Common questions