discover · compare · collections · requirements · contribute · feed · watching · stats · help with your tokens
RockxyApp/Shieldxy · source
Snapshot 0 · 2026-11-04T12:47:28Z · Swift · AGPL-3.0
Content fingerprint
74d7b0a817b9d1f3ccd790626b3e9bb983d903bf11345cb55c8681acb795310dGitHub description at capture
Open-source, auditable application firewall and connection monitor for macOS.
README at capture
<p align="center">
<img src="Shieldxy/Assets.xcassets/AppIcon.appiconset/icon_128x128@2x.png" alt="Shieldxy" width="128" />
</p>
<h1 align="center">Shieldxy</h1>
<p align="center">
<strong>The open-source, auditable application firewall for macOS.</strong>
</p>
<p align="center">
See and control outbound connections by signed application, domain, and policy<br />
with a native Swift app you can inspect, build, and trust.<br />
Local-first, payload-free, and designed for explicit network control.
</p>
<p align="center">
<a href="https://github.com/RockxyApp/Shieldxy/actions/workflows/build.yml"><img src="https://github.com/RockxyApp/Shieldxy/actions/workflows/build.yml/badge.svg" alt="Build and validation" /></a>
<img src="https://img.shields.io/badge/status-source%20preview-6f42c1" alt="Source preview" />
<img src="https://img.shields.io/badge/macOS-14%2B-black" alt="macOS 14 or later" />
<img src="https://img.shields.io/badge/Swift-5-orange" alt="Swift 5 language mode" />
<a href="LICENSE"><img src="https://img.shields.io/badge/license-AGPL--3.0-blue" alt="AGPL-3.0 license" /></a>
<a href="CONTRIBUTING.md"><img src="https://img.shields.io/badge/PRs-welcome-brightgreen" alt="Pull requests welcome" /></a>
</p>
---
> [!IMPORTANT]
> Shieldxy is currently a **source preview**. The first signed and notarized
> public binary has not been published. Until an official DMG appears on
> [GitHub Releases](https://github.com/RockxyApp/Shieldxy/releases), treat local
> Xcode builds as development builds—not official releases.
## See It in Action
Shieldxy turns outbound traffic into a focused native workflow: identify the
app behind a connection, inspect its destinations, and control protection from
the menu bar.
<p align="center">
<a href="https://rockxy.io/shieldxy#demo">
<img src="docs/media/shieldxy/overview.webp" alt="Shieldxy showing live outbound connections and menu bar controls on macOS" width="1200" />
</a>
</p>
<p align="center">
<sub><a href="https://rockxy.io/shieldxy#demo">Watch the full Shieldxy demo on Rockxyweb →</a></sub>
</p>
<p align="center">
<picture>
<source media="(prefers-color-scheme: dark)" srcset="docs/media/shieldxy/connections-dark.webp" />
<img src="docs/media/shieldxy/connections-light.webp" alt="Shieldxy monitoring applications, domains, transfer totals, and connection state" width="1200" />
</picture>
</p>
<p align="center"><strong>App-aware monitoring</strong><br /><sub>Trace the process, signer identity, destination, and live traffic volume behind every outbound connection.</sub></p>
<p align="center">
<picture>
<source media="(prefers-color-scheme: dark)" srcset="docs/media/shieldxy/network-map-dark.webp" />
<img src="docs/media/shieldxy/network-map-light.webp" alt="Shieldxy network map showing geographic connection activity" width="1200" />
</picture>
</p>
<p align="center"><strong>Network context</strong><br /><sub>See where connections go with optional offline GeoIP data and local company-region attribution.</sub></p>
<p align="center">
<img src="docs/media/shieldxy/menu-bar.webp" alt="Shieldxy menu bar controls with live throughput and protection actions" width="600" />
</p>
<p align="center"><strong>Menu bar control</strong><br /><sub>Check throughput, start protection, switch connection mode, and open rules or history without leaving your workspace.</sub></p>
<p align="center">
<img src="docs/media/shieldxy/settings.webp" alt="Shieldxy protection settings showing Network Extension status and automatic rules" width="800" />
</p>
<p align="center"><strong>Protection settings</strong><br /><sub>Keep Network Extension status, automatic rules, and safety behavior explicit and reviewable.</sub></p>
## Highlights
- Signer-aware app identity prevents a different developer from inheriting
policy by reusing a bundle identifier.
- App and domain rules support exact, wildcard, global, and app-scoped
matching with bounded in-memory evaluation.
- Ask mode pauses unmatched flows for a decision while keeping timeout and
queue-exhaustion behavior explicit.
- Connection history, local risk context, optional offline geography, and safe
CSV export are integrated into one native workflow.
- The release pipeline validates universal builds, signing, notarization,
stapling, and cryptographically signed Sparkle updates.
See [CHANGELOG.md](CHANGELOG.md) for detailed changes.
## Features
Shieldxy starts with the application responsible for a connection—not only an
address and port. It combines signer-validated identity with destination
context, policy, and connection activity to answer three practical questions:
**Which application connected? Where did it connect? Should it be allowed?**
### Application-Aware Connection Monitoring
See newly created socket flows by signed application, hostname or IP, company,
country, verdict, and bytes transferred. Shieldxy observes flows after its
Network Extension starts; it is a connection monitor, not a process inventory.
`Signed App Identity` · `Host & IP` · `Company Context` · `Country` ·
`Live Throughput` · `Allow / Drop Verdict`
### Application & Domain Firewall
Allow or block an application using both its bundle identifier and validated
Apple Developer team. Add exact-host or wildcard domain rules globally, or
scope them to one signer-validated app.
`App Rules` · `Domain Rules` · `Wildcard Hosts` · `Signer Validation` ·
`App-Scoped Policy` · `Temporary Blocks`
### Four Connection Modes
Switch the whole system between Monitor Only, Allow All, Block All, and Ask New
Connection. The selected mode persists across launches and remains visible in
the main app and menu bar.
`Monitor Only` · `Allow All` · `Block All` · `Ask New Connection` ·
`Persistent Mode`
### Ask Before Connecting
Pause an unmatched new flow and decide whether it should continue. A visible,
unanswered prompt follows the configured fail-open safety timeout; if a prompt
cannot enter the bounded decision queue, Shieldxy drops that flow.
`Per-Flow Decision` · `Remember Choice` · `Safety Timeout` ·
`Bounded Queue` · `Explicit Failure Semantics`
### Connection History & Safe Export
Review a bounded local timeline of network activity and export it as
spreadsheet-safe CSV. History writes are coalesced away from the verdict hot
path, keeping policy evaluation responsive.
`Local History` · `Bounded Storage` · `CSV Export` · `Formula-Safe Cells` ·
`Search & Review`
### Local Risk Context
Highlight curated tracker or suspicious domains and unusual outbound volume
without sending destinations to a cloud reputation service. Risk scoring is
deterministic, local, and informational—it never silently creates firewall
rules.
`Tracker Signals` · `Suspicious Domains` · `Volume Signals` ·
`Local Scoring` · `No Automatic Blocking`
### Network Map
Explore connection geography using optional offline GeoIP data and bundled
company-region fallback. MapKit may contact Apple for map content, but Shieldxy
does not send an observed hostname or IP to place a connection.
`Offline GeoIP` · `Company Attribution` · `MapKit` · `Local Placement`
### Native Menu Bar Controls
Keep connection status, current mode, and throughput within reach without
leaving the active workspace. Quick controls use the same policy state as the
main application.
`Status Item` · `Live Throughput` · `Mode Switching` · `Quick Access`
### Open in Rockxy
Hand an HTTP or HTTPS destination to
[Rockxy](https://github.com/RockxyApp/Rockxy) for deeper protocol-aware
inspection. The handoff is always explicit and user initiated.
`One-Click Handoff` · `HTTP / HTTPS`
## Security by Design
Shieldxy controls a latency-sensitive system extension. Its trust model keeps
the verdict path small, authenticated, and bounded:
- **Signer-aware identity.** App-scoped rules bind the bundle identifier and
validated Apple Developer team.
- **Authenticated policy delivery.** The app sends validated, versioned rule
snapshots over a same-team XPC channel. Invalid updates preserve the last
accepted snapshot.
- **Bounded hot path.** Ask groups, paused flows, aggregation, statistics, XPC
backlog, imported rules, and persisted history all have explicit limits.
`handleNewFlow` performs no blocking disk I/O.
- **Honest failure behavior.** A fresh extension starts fail-open until an
authenticated snapshot arrives, avoiding an accidental machine-wide outage.
Ask queue exhaustion fails closed; an unanswered visible prompt follows its
configured fail-open timeout.
- **No payload access.** Shieldxy works with flow metadata and byte counts—not
HTTP bodies, TLS plaintext, credentials, or API-key values.
Report vulnerabilities privately through
[GitHub Security Advisories](https://github.com/RockxyApp/Shieldxy/security/advisories/new).
See [SECURITY.md](SECURITY.md) for supported versions, scope, and response
targets.
## Quick Start
```bash
git clone https://github.com/RockxyApp/Shieldxy.git
cd Shieldxy
make build
make test
```
Run the complete release-quality validation suite with:
```bash
make verify-release
```
This runs formatting and lint checks, Debug and Release-optimized unit tests,
and an unsigned Release build. Continuous integration additionally runs static
analysis, a universal `arm64`/`x86_64` build, and bundle metadata validation.
### Requirements
| Requirement | Build and tests | Installed network filter |
| --- | ---: | ---: |
| macOS 14.0 or later | Required | Required |
| Xcode 16 or later | Required | Required for local development |
| Apple Silicon or Intel Mac | Supported | Supported |
| Paid Apple Developer account | Not required | Required for NetworkExtension and system-extension entitlements |
SwiftLint and SwiftFormat are required for repository linting. The standard
build and test commands run unsigned when no local signing configuration is
present.
### Run the Network Filter
A paid Apple Developer account is required to install and run the Network
Extension. Signing configuration is machine-specific and intentionally excluded
from Git:
```bash
cp Configuration/Developer.xcconfig.template Configuration/Developer.xcconfig
```
Add your own Apple Developer Team ID, then follow
[CONTRIBUTING.md](CONTRIBUTING.md) for the complete setup. Never commit
certificates, provisioning profiles, notarization keys, or local developer
configuration.
On first launch, macOS presents two separate approval gates:
1. Enable the **system extension** in **System Settings › General › Login Items &
Extensions**.
2. Allow the **content filter** when macOS requests network-filter permission.
Both approvals are required before live filtering begins.
## Architecture
Shieldxy separates user-facing policy from latency-sensitive enforcement:
```text
┌──────────────────────────────────────────────────────────────────┐
│ Shieldxy app │
│ SwiftUI · rules · history · risk · local persistence │
└─────────────────────────────┬────────────────────────────────────┘
│
validated rule snapshots ↓ flow events ↑
authenticated, versioned XPC contract
│
┌─────────────────────────────▼────────────────────────────────────┐
│ Network Extension │
│ NEFilterDataProvider · signer identity · allow / drop / pause │
└──────────────────────────────────────────────────────────────────┘
```
| Component | Responsibility |
| --- | --- |
| `Shieldxy/` | Native interface, policy authoring, history, risk context, updates, and persistence |
| `ShieldxyNetworkExtension/` | Per-flow identity resolution and enforcement on the NetworkExtension verdict path |
| `Shared/` | Versioned IPC models, snapshot validation, rule matching, and runtime limits |
| `ShieldxyTests/` | Policy, identity, import, persistence, resource-bound, and release-hardening coverage |
The extension owns no editable policy. It evaluates the latest accepted
in-memory snapshot while the app remains the source of truth for user-authored
rules.
## Privacy
- No account, telemetry, analytics, advertising, or cloud reputation service.
- No TLS decryption, payload capture, request-body inspection, or secret
scanning.
- Rules and connection history remain in the current user's Application Support
directory; preferences use macOS `UserDefaults`.
- Optional GeoIP and company attribution run locally.
- Official builds may contact the signed public update feed.
- Opening Network Map may cause Apple's MapKit to fetch map content.
- Opening a website or using Open in Rockxy is an explicit user action handled
by macOS or the receiving application.
Read the complete [Shieldxy Privacy Policy](PRIVACY.md) for observed metadata,
storage, third-party data, and network-request details.
## Documentation
| Guide | Covers |
| --- | --- |
| [Network Extension](docs/network-extension.md) | Installation, activation, IPC, and enforcement boundaries |
| [Rules](docs/rules.md) | App rules, host matching, temporary blocks, and Ask behavior |
| [Policy and limits](docs/policy-and-limits.md) | Community defaults, technical ceilings, and bounded state |
| [Risk and DNS](docs/risk-and-dns.md) | Local attribution, risk scoring, and optional GeoIP |
| [Menu bar](docs/menu-bar.md) | Status item, throughput, and quick controls |
| [Appearance](docs/appearance.md) | Theme and presentation settings |
| [Releasing](docs/RELEASING.md) | Verifying a published DMG: signatures, notarization, architectures, and the Sparkle feed |
## Releases
The first official release will be a universal Apple Silicon and Intel
application, signed with an Apple Developer ID certificate, notarized by Apple,
distributed as a stapled DMG, and updated through a cryptographically signed
Sparkle appcast.
Those properties are enforced by the release pipeline. They are not claimed for
arbitrary local builds.
## Contributing
Issues and focused pull requests are welcome. Start with
[CONTRIBUTING.md](CONTRIBUTING.md), run `make verify-release`, and add tests for
behavior changes.
For vulnerabilities or privacy-sensitive reports, follow
[SECURITY.md](SECURITY.md) instead of opening a public issue.
## Rockxy Ecosystem
- **[Rockxy](https://github.com/RockxyApp/Rockxy)** — native HTTP, HTTPS,
WebSocket, GraphQL, and protocol-aware debugging
- **Tracexy** — network analysis and observability
- **Shieldxy** — application-aware network security and connection control
## License
Shieldxy is available under the
[GNU Affero General Public License v3.0](LICENSE).
Copyright © 2026 Shieldxy Contributors.