Blocking and protection

Where it connects

Connections shows every open connection on a globe, routed to the country its address is registered in, with the busiest countries in a list and the sockets underneath. Click a country to filter. The country comes from DB-IP's free database bundled with the app, so no address leaves your Mac. It is the registration country: a CDN or VPN address shows its owner's country, not where the server is.

What is this?

Click ⓘ on a connection, a blocked attempt, an approval prompt or an agent network log row to see what the process is and, when Kilobat has a hostname, what the host is. It shows normal traffic, when the process uses a lot, whether blocking is safe and what breaks, with links to the full process and host pages. A connection with only an address shows its network and country instead of guessing a hostname. The answers come from Kilobat's own database, bundled with the app, so nothing is looked up online. For a process or host it doesn't know, it shows what Kilobat knows: the code signature, the path, and the network and country of the address. On macOS 26 or later with Apple Intelligence on, it adds a short best guess from Apple's on-device model, marked as such; nothing leaves the Mac. Free. In Terminal, kilobat explain nsurlsessiond gateway.icloud.com; for agents, the explain_connection MCP tool.

Blocking and filtering

Monitoring works without filtering. To enforce rules, open filtering setup in Kilobat and approve the extension and content filter when macOS asks. On current macOS, extensions are under System Settings → General → Login Items & Extensions → Network Extensions.

Filtering affects new connections; an existing connection may continue until it reconnects. If a rule interrupts something important, switch to Unrestricted or turn filtering off in Settings.

New apps: allow, ask or block

The pill above the app list sets what Travel and Work do with apps that have no rule. Allow lets them connect. Ask holds an app's first connections and opens a window with who signed it, its path and where it wants to go; allow or block it once and Kilobat saves the rule. Unanswered connections give up after a minute and the app asks again. Block only lets apps you allowed connect. Turn on Allow Apple software to let macOS services and Apple's apps through without asking. Your blocklist and connection rules apply in every mode, and if Kilobat isn't running, new apps are allowed rather than held.

Protection: threats, trackers and the agent guard

With the network filter on, Settings › Protection blocks connections to known malicious destinations from every app, and names the app that tried. Kilobat downloads public lists to your Mac from their publishers once a day (with the cache validators they send, so an unchanged list costs nothing), checks each download and keeps the last good copy if one fails. Nothing about your connections is sent anywhere.

• Block threats (Pro, on by default with Pro): malware, phishing and scam hosts and addresses from HaGeZi’s Threat Intelligence Feeds (domains and IPs) and HaGeZi Fake, and URLhaus through malware-filter. A listed domain covers its subdomains.
• Agent guard (Pro, off by default): for Claude Code, Codex, Cursor and the other agents Kilobat recognises, and everything they start through shells, npm, pip or curl. Known threats are always blocked for agents; the guard adds paste sites, file shares, tunnels and request catchers, raw public IP addresses typed into a command, and cuts a connection that sends more than 10 MB (50 or 200 if you choose) to a host no agent on this Mac used before. A cut upload can’t be held for you to confirm: the other end would time out, so Kilobat blocks it and tells you, and Allow Site lets it through next time.
• Block trackers in apps (free, off by default): one list you pick, HaGeZi Multi Light, HaGeZi Multi Normal, OISD small or StevenBlack’s hosts.

What wins. The VPN kill switch comes first. Then known threats and the agent guard, over every allow rule and profile, Unrestricted included; only the local network, Apple’s own services, Kilobat itself and the sites you allowed are never blocked. Trackers come after your own allow rules: Unrestricted, a destination rule or Allow Site lets a tracker through.

Where it shows. Connections › Blocked attempts gives each block’s kind (malware, phishing, scam, known threat, tracker or agent guard), the list and the agent, with Allow Site. A notification goes out once per app, host and day, such as “Blocked: npm (started by Claude Code) tried to reach a known malware host”; trackers don’t notify. The agent network log marks the row Blocked, Health says “Protection on · 263,000 known threats · updated 2 h ago”, and the menu shows a line only after something was blocked in the last hour.

What it can’t see. It isn’t antivirus and scans no files; keep XProtect on. It knows a connection’s name when the app gives one, or from the server name in the encrypted hello (the TLS SNI) or the HTTP Host line, which Kilobat reads from the first bytes of connections that arrive without a name. QUIC connections without a name, and apps that use their own encrypted DNS and then connect by address, are checked by address only. A name another connection used for the same address is used for threats only, never for trackers, because a CDN address serves many sites. Agents are found by walking up the connecting process’s parents, so a server an agent started that was handed over to launchd no longer counts as the agent’s.

In the terminal: kilobat protect for the status, kilobat protect on --agents, kilobat protect on --trackers --list oisd-small, kilobat protect check downloads.example.com, kilobat protect allow example.com and kilobat protect update. Agents read check_host_reputation and get_protection_status; set_protection asks you first.

Why was it allowed or blocked?

Choose Why? on a blocked attempt in Connections › Blocked attempts, or on an open connection in Connections, to see every Kilobat rule that matched it, in the order the filter checks them, with the one that decided first: “Blocked by Protection: login.example is on the phishing list (HaGeZi Threat Intelligence Feeds)”, then “Also matched: Slack is paused while on iPhone, a metered network, until an unmetered one”. Each rule links to where you change it, and Send later’s hold has Send now.

The order is the filter’s: the VPN kill switch, Protection’s threats and the agent guard, Unrestricted, destination rules (newest first), the blocklist, trackers, then the app’s own rules: a timed rule (yours, or one Send later, call mode or going live set), the network’s data budget, the app’s quota, paused updaters, the app rule in the current profile, an answer you gave when asked, and last the profile’s default for apps without a rule. A rule that matched but came later is listed as also matched: change the one that decided and it may decide instead. Notes, such as a site you allowed past Protection or the kill switch letting the local network through, explain without deciding.

For a blocked attempt, the filter records the rules as it blocks, so the answer is what happened then, even if your rules or the VPN changed since; records from before this feature, and connections the filter couldn’t tie to an app, are checked against your rules as they are now, and say so. Allowed connections are always checked as the rules are now. Recording happens only for connections the filter blocks, so allowed traffic pays nothing for it.

In the terminal: kilobat verdict api.example.com --app com.tinyspeck.slackmacgap, kilobat verdict --app com.example.App for the app’s own rules, and kilobat verdict --blocked 10 for the latest blocked attempts, each with the command that changes the rule. Agents call explain_verdict, which returns the same JSON as --json.

Blocking domains and IPs

Right-click an app's open connection to block that host for the app or for every app. The blocklist takes domains (subdomains included; *.example.com works too), IP addresses and CIDR ranges, alongside an imported hosts list. From the terminal: kilobat block-host ads.example.com.