LuLu

Apple's firewall watches what comes in. LuLu watches what goes out, which is where the interesting things happen: a cracked app checking in with a server, a menu bar utility uploading analytics, malware looking for its operator. Unknown outgoing connection, dialog, allow or deny, rule saved.

It comes from Patrick Wardle, who spends his working life taking macOS malware apart, and the whole thing is on GitHub. For a tool that inspects every connection your machine makes, being able to read the source — or point at people who have — matters more than in most categories.

Against Little Snitch it is honestly the plainer tool. There is no traffic map, the reporting is thinner, and managing a large rule set is more tedious. What it does have is the part that actually protects you, at no cost, from someone with a strong reputation for not shipping nonsense.

Install it if you have wanted an outbound firewall but balked at the price, or if paying a company to sit in your network path is exactly what you would rather not do. Skip it if you want polish and someone to answer a support email, or if you know you will click "allow" on everything to make the prompts stop — a firewall you overrule is worse than none, because it makes you feel covered.