For proxy and VPN users
Behind a system proxy, every app looks like the proxy app. Kilobat puts each app’s traffic back where it belongs, shows which node it went through, and tells you when the proxy, the VPN or your DNS lets you down.
brew install seifip/kilobat/kilobatThe app’s proxy isn’t answering.
Why can’t it connect? Kilobat tests the request and path the app itself uses, its own proxy, IPv6 and tunnels included, and names the layer that broke.
An app that sends through a local proxy is charged for its own traffic. The proxy core or VPN tunnel that forwards it reads “Carries other apps’ traffic”, and nothing is counted twice. Free.
With a Clash-compatible proxy (Clash Verge, ClashX, mihomo, Mihomo Party, FlClash, or sing-box with clash_api), each app’s row shows the node it went through, such as “via HK-01 · 2 direct”, and its tooltip lists each host, node and rule. Free.
Health › Where traffic leaves names a system proxy nobody answers, DNS or IPv6 that skip the VPN, a proxy and a VPN both taking traffic, and global mode. Why can’t it connect? adds a Proxy app step that names a dead node. Free.
macOS content filters never see connections to 127.0.0.1, so blocking can’t see apps behind a system proxy. Kilobat says so, and suggests TUN mode or the proxy’s own rules.
Clash Verge, ClashX, Mihomo Party, Clash Nyanpasu, FlClash, mihomo, Surge, Stash, sing-box, V2Ray, Xray, Shadowsocks, Shadowrocket and Hiddify, plus VPNs such as WireGuard, Tailscale, OpenVPN and the packet-tunnel VPN apps. Per-app routes need a Clash-compatible API; the rest works with any of them. Kilobat reads the API address and secret from the app’s own config and never shows the secret.
kilobat proxy lists proxy apps, their mode and TUN, and what’s wrong. kilobat proxy routes --app Telegram shows which rule and node an app took, kilobat proxy test times each group’s current node, and kilobat vpn checks DNS and IPv6 against the tunnel. AI agents get the same through the MCP tools get_proxy_status, test_proxy_nodes and check_vpn. Read the docs.
No. Kilobat only reads: the system proxy setting, the proxy app’s config and its local API. It never switches nodes, edits rules or touches the VPN. When something needs changing, it tells you what to change in your proxy app.
With a system proxy, apps connect to Clash on 127.0.0.1, and Clash makes the real connection out. Monitors that only see sockets charge it all to Clash. Kilobat matches each app’s loopback connection to the proxy port and counts it as that app’s internet traffic.
Kilobat finds Shadowrocket on a Mac with Apple silicon and counts traffic through it for the right app. Shadowrocket has no Clash-compatible API, so the per-app node and rule aren’t shown for it.
Everything on this page is free: the attribution, the routes, the checks, the CLI and the MCP tools. Blocking, profiles, budgets and history are part of Pro, $19 once, with a 7-day free trial.
brew install seifip/kilobat/kilobat