Kilobat CLI: read-only per-app rule/node snapshots on macOS

[seifip]

I’m Philip, the maker of Kilobat CLI, a GPL-3.0-only network diagnostics CLI for macOS. I added a small read-only companion for people who want a scriptable snapshot of which app used which rule and proxy chain, alongside their other Mac diagnostics.

brew install seifip/kilobat/kilobat
kilobat proxy routes --controller 127.0.0.1:9090 --json
kilobat proxy test --controller 127.0.0.1:9090 --json

Use your controller's actual address and authentication if enabled. The controller must be accessible to this Mac. Kilobat can also discover selected local Clash-family configuration paths; the explicit controller is useful for a core it cannot find automatically.

routes reads /connections and returns app, host, rule, node/group and byte counts. It uses the reported process path when present, then tries local established TCP-port matching for system-proxy connections. An unmatched owner is Unknown app; this is a current snapshot, not complete connection history or guaranteed UDP attribution.

test reads /proxies and calls the delay endpoint for each supported group's currently selected node. It does not select nodes, reload configuration, delete connections or change rules. The result is a request delay to Google's generate_204 page, not bandwidth or an all-node benchmark. A failed test can reflect the destination or controller as well as the node, so it is not proof that a server is dead.

The implementation inspected for this post was ClashAPI.swift at v0.14.0. These commands shipped in 0.10.0 and were present in 0.14.0; see the latest release for current version information. The 31 October validation below used 0.14.0; a separate 4 November test used 0.45.1. It needs macOS 14+; Homebrew builds from source with Xcode 16+. The controller client currently uses HTTP host:port, not HTTPS or Unix sockets.

Validation update (31 October): in addition to synthetic controller tests, I ran CLI 0.14.0 against an isolated local mihomo 1.19.33 core. A loopback HTTP request through a test group using DIRECT appeared in the route snapshot, and the selected DIRECT node returned a delay result. This is a narrow local test: a remote proxy node, OpenClash, independent GUI-app attribution and sustained use remain untested.

4 November update: I repeated the isolated local DIRECT route check with source-built CLI 0.45.1 and mihomo 1.19.33. A loopback request appeared in the route snapshot; proxy test returned a 193 ms delay for the selected DIRECT node to its default Google generate_204 destination. This was a single request, not a bandwidth test, and does not extend to remote nodes or the other untested cases above. The initiating curl ran under a Python test harness; the displayed outer application was Python, so this does not verify independent GUI attribution. I would welcome feedback from Mac users on whether this snapshot is useful and where attribution fails. Please do not post secrets, subscription URLs or private connection logs.

There is also a separate proprietary Kilobat desktop app; the CLI commands above are free and do not need desktop Pro. Kilobat does not embed mihomo or provide a proxy/VPN service, and is not affiliated with MetaCubeX.

中文简要：我是开发者 Philip。Kilobat CLI 是 GPL-3.0-only 的 Mac 网络诊断工具，可读取 Clash 兼容 API 的当前连接、规则与节点，也可查询各策略组当前节点的请求延迟。它不切换节点或修改配置。详细限制、macOS/Xcode 要求及本机 Mihomo DIRECT 测试与尚未验证的范围如上；另有专有桌面应用，不要将整个桌面应用称为开源。