Mac how-to
How to find and kill orphaned node processes on a Mac
Updated · Tested commands for macOS Terminal (zsh or bash)
Your Mac feels slow, the fans are on, and Activity Monitor is full of node. Often these are orphans: dev servers, MCP servers and scripts whose terminal or AI agent session is long gone. Here's how to find them, check what they are and stop them without taking down the ones you need.
Quick answer
Find node processes whose parent has gone (PPID 1) with ps -axo pid,, check each one, then stop its children with pkill -TERM -P PID and the process with kill PID.
Step by step
-
List every node process you're running
pgrep -lf nodeThis prints the PID and full command line of every process whose command mentions
node. For more detail, including each parent PID, age and memory (RSS, in kilobytes):ps -axo pid,ppid, | grep '[n]ode'etime, rss, command The
[n]odetrick stops grep from listing itself. -
Spot the orphans
An orphan is a process whose parent has exited. On macOS it gets adopted by launchd, so its parent PID (PPID) becomes 1. This shows node processes with a PPID of 1:
ps -axo pid,ppid, | awk 'NR == 1 || ($2 == 1 && /node/)'etime, rss, command Example output (example data) PID PPID ELAPSED RSS COMMAND 48211 1 2-03:14:09 412880 node /Users/you/code/app/node_modules/.bin/next dev 51907 1 05:41:22 98304 node /Users/you/.npm/_npx/mcp-server/index.jsRead the list carefully. PPID 1 is also normal for things launchd runs on purpose, such as apps you opened from the Dock or Homebrew services. A
next devorvitethat has been up for two days with PPID 1 is almost certainly a leftover. -
Check where each one came from
To see the project folder a process was started in, and any port it holds:
lsof -a -p 48211 -d cwdlsof -a -p 48211 -nP -iTCP -sTCP:LISTENAnd to see whether it has children of its own (each line is a child PID):
pgrep -P 48211 -
Stop the tree, children first
Ask the children to stop, then the parent. Plain SIGTERM lets each one clean up:
pkill -TERM -P 48211 kill -TERM 48211Wait a few seconds and check with
ps -p 48211. If it's still listed,kill -9 48211forces it. Use that as a last resort.
Careful with pkill node and killall node
It's tempting to run pkill node or killall node and be done. Both stop every node process you own, not just the leftovers. That includes language servers and extensions in your editor, MCP servers your AI agent is using right now, and dev servers you still want.
pkill -f is riskier still, because it matches anywhere in the full command line, so pkill -f next can hit anything with “next” in its arguments. If you do use a pattern, preview exactly what it matches first:
pgrep -lf 'next dev'Only run the matching pkill -f 'next dev' once that list shows nothing you need.
Questions
What is an orphaned process?
A process whose parent has exited. On a Mac, launchd (PID 1) adopts it, so it keeps running with nothing left to stop it. Dev servers and MCP servers started by a terminal or AI agent that later closed or crashed often end up like this.
Is every process with PPID 1 an orphan I should kill?
No. Apps you open from the Dock and services launchd starts on purpose also have PPID 1. Look at the command and its age: a next dev, vite or npx process that's been up for days is a good candidate; anything from /Applications or /System is not.
Why do AI coding agents leave node processes behind?
Agents start dev servers, MCP servers and helper scripts in the background. When a session ends or crashes without stopping them, they lose their parent and keep running, holding ports and memory.
Will killing these lose my work?
A dev server doesn't hold your code, which is saved on disk, so stopping one is generally safe. Plain kill gives it a chance to finish writes; kill -9 doesn't, which is why it's the last resort.
