WGSmart 1.0.0

The first public build of WGSmart — a WireGuard control plane for macOS that runs every tunnel at once and routes each destination down the one you choose.

Requirements

macOS 15 or later · Apple Silicon and Intel · administrator access, for the routing and kill-switch service.

⚠️ macOS will warn you on first launch — here is exactly why

This build is not notarized by Apple. Notarization needs a paid Apple Developer membership this project does not have yet, so macOS will say the developer cannot be verified. That warning is accurate — Apple has not checked this build.

To open it anyway: right-click the app ▸ Open, then confirm once.

If that is not a trade you want to make for a tool that runs with system privileges, that is a completely reasonable call — wait for the notarized build. It is the next thing being funded (see Support on the site).

Verify what you downloaded

shasum -a 256 WGSmart-1.0.0.pkg

Compare against WGSmart-1.0.0.pkg.sha256 below. WGSmart-1.0.0.pkg.sig is an Ed25519 signature over a digest that binds the filename, so an older build cannot be replayed as a newer one. The app checks both before installing, and the privileged service checks both again independently. The signing key has never been on GitHub.

What works today

Multiple simultaneous tunnels · per-IP/CIDR routing override where longest prefix wins · a pf kill switch that fails closed and restores your own firewall rules · conflict detection at import · a connection test that shows the tunnel's exit IP next to your real one · dynamic endpoint re-resolution · live logs · a full CLI · Config Studio · keys in the Keychain.

Routing by domain, by macOS user, and by port are built and shipping, but have not been run long enough on real machines to be promised — they are listed on the site under "Built, still being proven" rather than sold to you.

WGSmart is not a VPN service. You bring your own WireGuard configs.