---
title: "Kilobat for Clash, Surge and VPN users on Mac"
url: "https://kilobat.app/proxies-vpns.html"
description: "Per-app traffic that stays right behind Clash Verge, Surge, sing-box, Shadowrocket or a VPN; the node each app took; dead proxies and DNS or IPv6 leaks found for you."
---

For proxy and VPN users

# Your proxy, seen clearly.

Behind a system proxy, every app looks like the proxy app. Kilobat puts each app’s traffic back where it belongs, shows which node it went through, and tells you when the proxy, the VPN or your DNS lets you down.

[Download for Mac ↓](https://kilobat.app/downloads/Kilobat-1.5.0.dmg)

```
brew install seifip/kilobat/kilobat
```

## What goes wrong with a proxy or VPN on a Mac

- **Everything looks like the proxy.** With a system proxy, apps talk to 127.0.0.1, so most monitors show the proxy core using all your data and every app using none.
- **A dead system proxy.** Quit Clash or Surge without turning its system proxy off, and every browser stops loading while the Wi-Fi looks fine.
- **Leaks.** The VPN carries your traffic, but name lookups go to the café’s router, or IPv6 skips the tunnel.
- **Two tunnels fighting.** A proxy in TUN mode and a VPN both want the default route, and sites fail only when both are on.
- **A slow node.** One server in the group stops answering, and it looks like your internet is down.

## How Kilobat helps

1

### Traffic counts for the right app

An app that sends through a local proxy is charged for its own traffic. The proxy core or VPN tunnel that forwards it reads “Carries other apps’ traffic”, and nothing is counted twice. Free.

2

### See the route each app took

With a Clash-compatible proxy (Clash Verge, ClashX, mihomo, Mihomo Party, FlClash, or sing-box with clash_api), each app’s row shows the node it went through, such as “via HK-01 · 2 direct”, and its tooltip lists each host, node and rule. Free.

3

### Catch the problem

Health › Where traffic leaves names a system proxy nobody answers, DNS or IPv6 that skip the VPN, a proxy and a VPN both taking traffic, and global mode. Why can’t it connect? adds a Proxy app step that names a dead node. Free.

4

### Keep blocking honest

macOS content filters never see connections to 127.0.0.1, so blocking can’t see apps behind a system proxy. Kilobat says so, and suggests TUN mode or the proxy’s own rules.

## Works with

Clash Verge, ClashX, Mihomo Party, Clash Nyanpasu, FlClash, mihomo, Surge, Stash, sing-box, V2Ray, Xray, Shadowsocks, Shadowrocket and Hiddify, plus VPNs such as WireGuard, Tailscale, OpenVPN and the packet-tunnel VPN apps. Per-app routes need a Clash-compatible API; the rest works with any of them. Kilobat reads the API address and secret from the app’s own config and never shows the secret.

## In the terminal and for agents

`kilobat proxy` lists proxy apps, their mode and TUN, and what’s wrong. `kilobat proxy routes --app Telegram` shows which rule and node an app took, `kilobat proxy test` times each group’s current node, and `kilobat vpn` checks DNS and IPv6 against the tunnel. AI agents get the same through the MCP tools `get_proxy_status`, `test_proxy_nodes` and `check_vpn`. [Read the docs](https://kilobat.app/docs.html#proxies).

## Questions

**Does Kilobat route traffic or change my proxy?**

No. Kilobat only reads: the system proxy setting, the proxy app’s config and its local API. It never switches nodes, edits rules or touches the VPN. When something needs changing, it tells you what to change in your proxy app.

**Why does Clash use all my data in other monitors?**

With a system proxy, apps connect to Clash on 127.0.0.1, and Clash makes the real connection out. Monitors that only see sockets charge it all to Clash. Kilobat matches each app’s loopback connection to the proxy port and counts it as that app’s internet traffic.

**Does Shadowrocket work?**

Kilobat finds Shadowrocket on a Mac with Apple silicon and counts traffic through it for the right app. Shadowrocket has no Clash-compatible API, so the per-app node and rule aren’t shown for it.

**Is it free?**

Everything on this page is free: the attribution, the routes, the checks, the CLI and the MCP tools. Blocking, profiles, budgets and history are part of Pro, $19 once, with a 7-day free trial.

## Get your network out of the dark.

[Download for Mac ↓](https://kilobat.app/downloads/Kilobat-1.5.0.dmg)

```
brew install seifip/kilobat/kilobat
```