macOS Program Linking — remote AppleEvents, meaning remote AppleScript execution.
Port 3031 is IANA-registered as eppc, Remote AppleEvents/PPC Toolbox, and macOS still uses it for exactly that: when "Remote Apple Events" is enabled in Sharing settings, the Mac accepts AppleEvents from other machines and runs them as an authenticated local user. Apple lists it in its own port reference as TCP and UDP 3031. It is off by default and rare in the wild, so an open 3031 means somebody deliberately turned Program Linking on. The practical effect is scripted remote control of applications on that Mac.
Do not expose
This is remote code execution by design, gated only by an account password — keep it off, or confine it to a trusted LAN behind a VPN.
$ nc -vz TARGET 3031Seen this on your network? Beige Box scans your Wi-Fi and shows every open port on every device — and its Ports tool links straight back here.
Get Beige Box →also available as JSON · Markdown
Corrections or a missing port? Reply @rimrocksystems.