cachereaper

Your disk is full of ghosts.

Dead caches. Abandoned node_modules. Build artifacts from projects you left for dead. cachereaper finds them, grades the risk on every single finding, and reaps only what's safe.

Download for macOS Star on GitHub

Free & open source · MIT · Apple silicon + Intel · CLI for Linux too

You didn't put 83 GB there.
But there it is.

Every build, every install, every npm ci leaves something behind — and nothing cleans up after itself. This is what a two-year-old dev machine looks like under the floorboards:

Xcode DerivedData 23.4 GB
node_modules ×41 18.2 GB
~/Library/Caches 12.1 GB
Docker images 9.6 GB
cargo registry 6.8 GB
iOS simulator runtimes 6.0 GB
pip + uv caches 4.3 GB
Homebrew downloads 3.1 GB
0.0 GB

of a 256 GB Mac, gone to things no application will ever read again.

So why haven't you deleted it?

Because you've read the horror stories. Because du tells you what's big, not what's safe. Because somewhere in that 83 GB is one folder you actually need. 

$ rm -rf ~/Library/ Caches
One accidental space. That command deletes your entire ~/Library — keychains, mail, app data — and then starts on a folder in your home directory named Caches.

Fear is the correct response.
cachereaper is built around it.

Every finding wears its risk.

Nothing is deleted without a rule, and every rule carries a tier and a "here's how you get it back" note. Dry-run is the default. This is real output: 

$ cachereaper scan --tier high

LOW RISK      pure caches, regenerate automatically         [5.0G]
  ────────────────────────────────────────────────────────────────
      1.2G        pnpm-store          pnpm content store
      1.2G  ×17   app-cache           app HTTP cache
    800.1M        vscode-vsix         VS Code extension installers
    595.3M        cargo-registry      cargo crate sources + archives

MEDIUM RISK   reinstallable, costs you time/bandwidth       [3.2G]
  ────────────────────────────────────────────────────────────────
    701.3M        nuget-packages      NuGet global packages
    255.2M  ×7    node-modules        installed npm packages

HIGH RISK     stateful or expensive — review each one       [1.8G]
  ────────────────────────────────────────────────────────────────
      1.4G        rustup-toolchains   rust toolchains
            ! prefer `rustup toolchain uninstall <old>`
low
Regenerates itself, costs you nothing. npm, pip and cargo caches, Electron app caches, __pycache__, DerivedData.
medium
Reinstallable, costs time or bandwidth. node_modules, virtualenvs, Maven and NuGet caches, git-ignored dist/.
high
Stateful or expensive — review each one. Rustup toolchains, simulator devices, Xcode archives. Deleting means typing a phrase, not tapping y.

See your disk the way the reaper does.

GrandPerspective shows you what's big. The cachereaper desktop app shows you what's big and safe to delete. Colour carries one meaning — tiers stay saturated, everything unclaimed drains to grey. This one's live; go ahead:

cachereaper demo data
low medium high unclaimed hover a block

Click to drill in · ↑ up or Backspace to go back. The real app adds select mode, box-drag across folders, ⌘click, and a delete pipeline with receipts.

Seven guards between you and a very bad day.

  1. Confined to $HOME plus roots you pass explicitly. Touching system paths needs --system and sudo.
  2. Hard blocklist, re-checked before every delete. .git, .ssh, .gnupg, Keychains, photo libraries, and anything under iCloud, Dropbox, OneDrive or Google Drive.
  3. Never follows symlinks. Never crosses filesystems.
  4. Re-validated at delete time. A path that changed since the scan is skipped, not deleted.
  5. Stateful data is not a rule at all. VM disks, chat history, Downloads, and source directories are never even offered.
  6. Everything is logged to ~/.cachereaper/ with the path, the rule, the bytes, and the restore command.
  7. High risk means typing a phrase — not tapping y on autopilot.

And where a vendor command is safer than rm -rf — Docker, rustup, simctl, Time Machine — cachereaper prints that command instead of running the risky thing itself.

Fluent in 55 dialects of disk waste.

Build artifacts must prove what they are.

A directory is never claimed on its name alone — every ambiguous name is gated on a marker:

target/        claimed only if Cargo.toml sits beside it
.venv/         claimed only if it contains pyvenv.cfg
dist/ build/   claimed only if git already ignores them

Reap what your tools have sown.

Desktop app

Downloads the latest release into /Applications, quarantine already cleared, ready to open:

curl -fsSL https://raw.githubusercontent.com/samreshan/cachereaper/main/install.sh -o install.sh
bash install.sh
Download the .dmg

CLI

One file, no dependencies. Python 3.9+, macOS and Linux:

git clone https://github.com/samreshan/cachereaper
install -m 755 cachereaper/cachereaper.py ~/.local/bin/cachereaper
Star the repo