Skip to content

TetherKitNext v1.0.0

Choose a tag to compare

View all tags
@AA-EION AA-EION released this 25 Sep 18:50
· 22 commits to main since this release
v1.0.0
733c89d

TetherKitNext 1.0.0 is the first stable release of TetherKitNext: Android USB tethering on the Mac, as a normal app. There's no kernel extension, SIP stays on, and there's nothing to compile or install with Homebrew. It is signed with Developer ID and notarized by Apple, so it opens without security warnings.

Made by Issen Software Group. Based on TetherKit by XiaoMiku01 (forked from v0.1.5).

Highlights

  • Download, drag, connect. One signed and notarized disk image for Apple Silicon and Intel Macs.
  • No security trade-offs. No kext, no SIP changes, no Terminal commands, no Homebrew.
  • Internet works right after you click Connect. DHCP is set up automatically.
  • "Route all traffic" really does. The phone becomes your Mac's main connection, for both routing and DNS, even when you are also plugged into a network without internet.
  • Works with VPNs. The phone connection is registered as a real macOS network service, so VPN apps (for example FortiClient) can use it.
  • Uses almost no CPU when idle. Before, it kept one core at 100%.
  • Redesigned app with a guided first-run setup, a menu bar mode, and English and Chinese interfaces.

Install

  1. Download TetherKitNext-1.0.0.dmg, open it, and drag TetherKitNext into Applications.
  2. Open TetherKitNext and click Enable Background Component. macOS asks you to allow it once in System Settings › General › Login Items & Extensions.
  3. Plug in your Android phone, turn on USB tethering, and click Connect.

Optional: Settings › Command-line tool › Install Command makes tetherkitnext-cli available in Terminal.

Requires macOS 14 Sonoma or later (the bundled command-line tool also runs on macOS 13.3+). Universal build (Apple Silicon + Intel).

Upgrading from TetherKit (0.2.0 betas or upstream 0.1.x)

TetherKitNext has a new app identity, so it installs next to the old TetherKit app rather than replacing it. Remove the old one first so the two don't compete for your phone. Follow the upgrade steps.

Taken care of automatically:

  • the upstream com.tetherkit.helper background helper and its files in /Library/PrivilegedHelperTools;
  • leftover TetherKit (feth…) entries in System Settings › Network.

Settings from the old app are not carried over, so choose your language, network mode and "Route all traffic" again.

What's new

Installing and updating

  • Signed and notarized DMG. The app and the disk image are both notarized and stapled, so the first launch works even offline.
  • Install window. Opening the DMG shows the app, an arrow and the Applications folder, with instructions in English and Chinese.
  • Everything is inside the app. The interface, the background component, the command-line tool, and bundled copies of libusb and the driver library. Nothing is copied into /Library, and deleting the app removes all of it.
  • Universal binary. Native on Apple Silicon and Intel, including libusb, which is built from a pinned, hash-verified source release. Homebrew is no longer needed (upstream #2).
  • Modern background component. It uses Apple's SMAppService: you approve it once, and it appears under Login Items & Extensions. You can restart or disable it from Settings.
  • Outdated background component detection. The app notices when the background component is still running an older build, even one with the same version number, and offers a one-click restart.
  • Command-line tool on your PATH. One click in Settings links tetherkitnext-cli into /usr/local/bin, and one click removes it. It never overwrites a file it didn't create.
  • Update check. An optional daily check against this project's GitHub releases. It only tells you about new versions and never downloads or installs anything.

Connecting and networking

  • Automatic network setup on Connect. The mode chosen on the Network page (DHCP by default) is applied as soon as the phone connects. It reuses the password from Connect, so there's no second prompt. You can turn this off in Settings.
  • "Route all traffic through this interface" now moves TetherKitNext to the top of the macOS service order, like Set Service Order in System Settings. Internet traffic and DNS both go through the phone, and macOS keeps it that way through later network changes.
  • Real network service. DHCP mode registers a proper macOS network service instead of a temporary one. VPN providers and anything else that looks up the system's network services now see the phone connection (upstream #3, from upstream PR #4).
  • Network settings are remembered across restarts.

App and interface

  • Redesigned interface. A sidebar with Overview, Device, Network, Activity and Settings, and a single Connect/Disconnect button in the toolbar (⌘↩) and in the menu bar. It uses Liquid Glass on macOS 26, with matching materials on macOS 14 and 15.
  • Step-by-step first-run setup: move the app to Applications, enable the background component, approve it in Login Items.
  • New Settings page: background component status, restart and disable; command-line tool; language; menu bar speed; launch at login; update checks; About and licenses.
  • Menu bar mode. Closing the window leaves TetherKitNext in the menu bar and hides the Dock icon, while the connection keeps running. The live speed shown in the menu bar is optional.
  • English and Chinese, switchable from the app menu without restarting.
  • New app icon, and an About window that credits Issen Software Group and the original TetherKit.

Bug fixes

  • An idle connection kept one CPU core at 100%. The receive thread now sleeps when there is no traffic, and idle CPU drops to about 0.03% (upstream #5).
  • Web pages wouldn't load while the Mac was also on a network without internet access (for example Ethernet to a closed LAN). "Route all traffic" changed only the route, so DNS still used the other network, and macOS reverted the route at the next network change. Fixed by the service-order change above.
  • VPN apps reported "No network route to host" over the phone connection, because the connection wasn't a real network service (upstream #3).
  • A route pointing at a dead gateway after connecting. Android first hands out a temporary 464XLAT address (192.0.0.x) before the real one. Routes are now installed only once the gateway has been stable for 2 seconds, and any stale route is replaced.
  • DHCP connections were shown as "Manual" in the network status.
  • After an update, the background component could keep running the previous build without the app noticing, so fixes didn't take effect until a reboot.
  • The Dock icon stayed visible after closing the window.
  • The speed in the menu bar changed width as the numbers changed, making nearby menu bar icons jump (upstream #1).
  • Cleaning up after a crash could disconnect another running session, for example the old and new helper during an upgrade. Cleanup now leaves interfaces alone while the process that owns them is still running.
  • The background component hung forever when started by hand. It now exits immediately with a clear message.
  • Network settings weren't remembered between launches.

Security

A full audit of the code is published in docs/SECURITY-AUDIT.md. No backdoor or malicious code was found. These issues were fixed:

  • (High) Any local program could connect to the root background component. The app and the background component now verify each other's code signature (same Developer ID team, exact bundle identifier). Every privileged action still requires administrator approval as a second layer.
  • (High) Deprecated installer. The AuthorizationExecuteWithPrivileges + setuid + shell-script installer is replaced by Apple's SMAppService. Nothing is copied into system folders anymore, so the installed files can't be swapped between approval and installation.
  • (Medium) A private macOS function was linked directly. A future macOS that removes it would have stopped the app from launching. It is now looked up at runtime, with a fallback.
  • (Medium) Network settings were written without Apple's required lock, so they could clash with System Settings writing at the same time.
  • (Medium) The update check could open any URL returned by the network. Only https://github.com links are accepted now.
  • (Low) Helper tools started as root now get a clean, fixed environment.

Known limitations

  • With static IP, DNS isn't verified yet. Only DHCP mode has been tested end to end.
  • Heavy traffic in both directions at once increases latency (about 0.4 ms → 16 ms), though throughput holds up.
  • Upload speed settles at either about 240 or about 300 Mbps. Both are stable and the cause isn't known yet. Download is about 325 Mbps on USB 2.0.

Found a problem? Please open an issue and attach the log from the Activity page.

Credits

Thanks to XiaoMiku01 for the original TetherKit driver, and to LefterisEvan for upstream PR #4. TetherKitNext is MIT-licensed; it bundles libusb (LGPL-2.1). See NOTICE.md.

Checksum (SHA-256)

a180157d82552185857dbf3ec2026e3228cb1a9e568101da66b1aff5244f22e0 TetherKitNext-1.0.0.dmg

Full changelog: https://github.com/AA-EION/TetherKitNext/commits/v1.0.0

Assets 3
Loading