diff --git a/.claude/commands/mac-optimizer.md b/.claude/commands/mac-optimizer.md
new file mode 100644
index 0000000..7ce1049
--- /dev/null
+++ b/.claude/commands/mac-optimizer.md
@@ -0,0 +1,35 @@
+---
+description: macOS system health audit and optimization (packages, environment, security, cleanup, resources)
+---
+
+# Mac Optimizer
+
+Run macOS system health audits and apply optimizations with user consent.
+
+## Module Routing
+
+| Keywords | Sub-command |
+|----------|-------------|
+| brew, npm, pip, packages, update, outdated | `/mac-packages` |
+| path, shell, zshrc, environment, env vars | `/mac-environment` |
+| security, firewall, sip, gatekeeper, filevault | `/mac-security` |
+| cache, cleanup, logs, disk space, trash | `/mac-cleanup` |
+| cpu, memory, disk, battery, processes, slow | `/mac-resources` |
+| doctor, full check, health, everything | `/mac-doctor` (runs all 5) |
+
+Default to **/mac-doctor** when the request is ambiguous.
+
+## Workflow
+
+1. **Audit** — run read-only scripts, collect JSON findings
+2. **Report** — present findings grouped by severity (critical → warning → info)
+3. **Consent** — ask which actions to perform
+4. **Execute** — dry-run first, then apply approved actions only
+
+## Safety Rules
+
+- Never execute cleanup without explicit user approval
+- Always show sizes before deleting anything
+- No sudo by default — ask first if needed
+- Security module is read-only (findings + guidance only)
+- Back up shell configs before modifying