Free
- Network
- VPN · Gotham VPN
- DNS · 28 ms
- Night Drive’s own proxy
- Server
The app’s proxy isn’t answering.
For proxy and VPN users
Your proxy, seen clearly.
Behind a system proxy, every app looks like the proxy app. Kilobat puts each app’s traffic back where it belongs, shows which node it went through, and tells you when the proxy, the VPN or your DNS lets you down.
Download for Mac ↓
brew install seifip/kilobat/kilobat- Free forever
- Pro $19 once
- 14-day refunds
- macOS 14+
- Open-source CLI
# Which rule and node Telegram took
$ kilobat proxy routes --app Telegram
# Do DNS or IPv6 skip the tunnel?
$ kilobat vpnSound familiar?
- “Every monitor says Clash used all my data.”
- “Quit Surge and now nothing loads.”
- “Is my DNS going through the VPN or not?”
- “Which node is Telegram actually using?”
Most monitors stop at 127.0.0.1.
With a system proxy, apps talk to the proxy core on your own Mac, and the core makes the real connection out. Monitors that only see sockets charge it all to the core. Kilobat follows each loopback connection back to the app that made it.
- TelegramSends to the proxy port
- 127.0.0.1:7890The proxy core, such as mihomo
- Rule and node“via HK-01”, read from the Clash API
- The internetCounted once, for Telegram
What goes wrong, and what Kilobat says.
Health › Where traffic leaves checks the proxy and the VPN together, and Why can’t it connect? adds a Proxy app step.
Everything looks like the proxy
Apps talk to 127.0.0.1, so monitors charge it all to the core.
Each app is charged for its own traffic; the core reads “Carries other apps’ traffic” and nothing is counted twice. Free
Nothing loads after quitting the proxy
A system proxy still points at an app that isn’t running.
Named as a dead system proxy, with what to switch off. Free
The VPN is on, but lookups leak
DNS goes to the café’s router, or IPv6 skips the tunnel.
Checked against the tunnel and named as a leak. Free
Sites fail only when both are on
A proxy in TUN mode and a VPN both want the default route.
Flagged as two tunnels fighting. Free
It looks like the internet is down
One node in the group stopped answering.
Each group’s current node is timed, and the dead one named. Free
Blocking doesn’t seem to work
macOS content filters never see connections to 127.0.0.1.
Kilobat says so, and suggests TUN mode or the proxy’s own rules. Free
Routes
See the route each app took.
With a Clash-compatible proxy, each app’s row shows the node it went through, such as “via HK-01 · 2 direct”, and its tooltip lists each host, node and rule. Kilobat reads the API address and secret from the proxy app’s own config and never shows the secret.
- Clash Verge, ClashX, mihomo, Mihomo Party, FlClash, or sing-box with clash_api.
- Shadowrocket on Apple silicon: traffic counted for the right app; no per-app node, as it has no Clash API.
- Read-only: Kilobat never switches nodes, edits rules or touches the VPN.
# Proxy apps, their mode and TUN, and what’s wrong
$ kilobat proxy
# Which rule and node an app took
$ kilobat proxy routes --app Telegram
# How fast each group’s current node answers
$ kilobat proxy test
# The VPN, and whether DNS or IPv6 skip it
$ kilobat vpnWorks with
- Clash Verge
- ClashX
- Mihomo Party
- Clash Nyanpasu
- FlClash
- mihomo
- Surge
- Stash
- sing-box
- V2Ray
- Xray
- Shadowsocks
- Shadowrocket
- Hiddify
- WireGuard
- Tailscale
- OpenVPN
- Packet-tunnel VPN apps
Per-app routes need a Clash-compatible API; everything else works with any of them. AI agents get the same through the MCP tools get_proxy_status, test_proxy_nodes and check_vpn. Read the docs.
What’s free, and what Pro adds
Free, for good
- Per-app traffic that stays right behind a proxy or VPN
- The node and rule each app took
- Dead proxy, dead node, DNS and IPv6 leak checks
kilobat proxy,vpnand the MCP tools
Pro, $19 once
- Blocking, profiles and budgets
- History by app
- Ask about new apps before they connect
Pro is $19 once for two Macs, with a 7-day free trial and 14-day refunds. Free for students.
Questions
Does Kilobat route traffic or change my proxy?
No. Kilobat only reads: the system proxy setting, the proxy app’s config and its local API. It never switches nodes, edits rules or touches the VPN. When something needs changing, it tells you what to change in your proxy app.
Why does Clash use all my data in other monitors?
With a system proxy, apps connect to Clash on 127.0.0.1, and Clash makes the real connection out. Monitors that only see sockets charge it all to Clash. Kilobat matches each app’s loopback connection to the proxy port and counts it as that app’s internet traffic.
Does Shadowrocket work?
Kilobat finds Shadowrocket on a Mac with Apple silicon and counts traffic through it for the right app. Shadowrocket has no Clash-compatible API, so the per-app node and rule aren’t shown for it.
Is it free?
Everything on this page is free: the attribution, the routes, the checks, the CLI and the MCP tools. Blocking, profiles, budgets and history are part of Pro, $19 once, with a 7-day free trial.
Know where every byte went.
Download for Mac ↓
brew install seifip/kilobat/kilobat