Shieldxy

The open-source, auditable application firewall for macOS.

See and control outbound connections by signed application, domain, and policy
with a native Swift app you can inspect, build, and trust.
Local-first, payload-free, and designed for explicit network control.

---

See It in Action

Shieldxy turns outbound traffic into a focused native workflow: identify the app behind a connection, inspect its destinations, and control protection from the menu bar.

_{Watch the full Shieldxy demo on Rockxyweb →}

App-aware monitoring
_{Trace the process, signer identity, destination, and live traffic volume behind every outbound connection.}

Network context
_{See where connections go with optional offline GeoIP data and local company-region attribution.}

Menu bar control
_{Check throughput, start protection, switch connection mode, and open rules or history without leaving your workspace.}

Protection settings
_{Keep Network Extension status, automatic rules, and safety behavior explicit and reviewable.}

Highlights

• Signer-aware app identity prevents a different developer from inheriting policy by reusing a bundle identifier.
• App and domain rules support exact, wildcard, global, and app-scoped matching with bounded in-memory evaluation.
• Ask mode pauses unmatched flows for a decision while keeping timeout and queue-exhaustion behavior explicit.
• Connection history, local risk context, optional offline geography, and safe CSV export are integrated into one native workflow.
• The release pipeline validates universal builds, signing, notarization, stapling, and cryptographically signed Sparkle updates.

See CHANGELOG.md for detailed changes.

Features

Shieldxy starts with the application responsible for a connection—not only an address and port. It combines signer-validated identity with destination context, policy, and connection activity to answer three practical questions: Which application connected? Where did it connect? Should it be allowed?

Application-Aware Connection Monitoring

See newly created socket flows by signed application, hostname or IP, company, country, verdict, and bytes transferred. Shieldxy observes flows after its Network Extension starts; it is a connection monitor, not a process inventory.

Signed App Identity · Host & IP · Company Context · Country · Live Throughput · Allow / Drop Verdict

Application & Domain Firewall

Allow or block an application using both its bundle identifier and validated Apple Developer team. Add exact-host or wildcard domain rules globally, or scope them to one signer-validated app.

App Rules · Domain Rules · Wildcard Hosts · Signer Validation · App-Scoped Policy · Temporary Blocks

Four Connection Modes

Switch the whole system between Monitor Only, Allow All, Block All, and Ask New Connection. The selected mode persists across launches and remains visible in the main app and menu bar.

Monitor Only · Allow All · Block All · Ask New Connection · Persistent Mode

Ask Before Connecting

Pause an unmatched new flow and decide whether it should continue. A visible, unanswered prompt follows the configured fail-open safety timeout; if a prompt cannot enter the bounded decision queue, Shieldxy drops that flow.

Per-Flow Decision · Remember Choice · Safety Timeout · Bounded Queue · Explicit Failure Semantics

Connection History & Safe Export

Review a bounded local timeline of network activity and export it as spreadsheet-safe CSV. History writes are coalesced away from the verdict hot path, keeping policy evaluation responsive.

Local History · Bounded Storage · CSV Export · Formula-Safe Cells · Search & Review

Local Risk Context

Highlight curated tracker or suspicious domains and unusual outbound volume without sending destinations to a cloud reputation service. Risk scoring is deterministic, local, and informational—it never silently creates firewall rules.

Tracker Signals · Suspicious Domains · Volume Signals · Local Scoring · No Automatic Blocking

Network Map

Explore connection geography using optional offline GeoIP data and bundled company-region fallback. MapKit may contact Apple for map content, but Shieldxy does not send an observed hostname or IP to place a connection.

Offline GeoIP · Company Attribution · MapKit · Local Placement

Native Menu Bar Controls

Keep connection status, current mode, and throughput within reach without leaving the active workspace. Quick controls use the same policy state as the main application.

Status Item · Live Throughput · Mode Switching · Quick Access

Open in Rockxy

Hand an HTTP or HTTPS destination to Rockxy for deeper protocol-aware inspection. The handoff is always explicit and user initiated.

One-Click Handoff · HTTP / HTTPS

Security by Design

Shieldxy controls a latency-sensitive system extension. Its trust model keeps the verdict path small, authenticated, and bounded:

• Signer-aware identity. App-scoped rules bind the bundle identifier and validated Apple Developer team.
• Authenticated policy delivery. The app sends validated, versioned rule snapshots over a same-team XPC channel. Invalid updates preserve the last accepted snapshot.
• Bounded hot path. Ask groups, paused flows, aggregation, statistics, XPC backlog, imported rules, and persisted history all have explicit limits. handleNewFlow performs no blocking disk I/O.
• Honest failure behavior. A fresh extension starts fail-open until an authenticated snapshot arrives, avoiding an accidental machine-wide outage. Ask queue exhaustion fails closed; an unanswered visible prompt follows its configured fail-open timeout.
• No payload access. Shieldxy works with flow metadata and byte counts—not HTTP bodies, TLS plaintext, credentials, or API-key values.

Report vulnerabilities privately through GitHub Security Advisories. See SECURITY.md for supported versions, scope, and response targets.

Quick Start

git clone https://github.com/RockxyApp/Shieldxy.git
cd Shieldxy
make build
make test

Run the complete release-quality validation suite with:

make verify-release

This runs formatting and lint checks, Debug and Release-optimized unit tests, and an unsigned Release build. Continuous integration additionally runs static analysis, a universal arm64/x86_64 build, and bundle metadata validation.

Requirements

Requirement	Build and tests	Installed network filter
macOS 14.0 or later	Required	Required
Xcode 16 or later	Required	Required for local development
Apple Silicon or Intel Mac	Supported	Supported
Paid Apple Developer account	Not required	Required for NetworkExtension and system-extension entitlements

SwiftLint and SwiftFormat are required for repository linting. The standard build and test commands run unsigned when no local signing configuration is present.

Run the Network Filter

A paid Apple Developer account is required to install and run the Network Extension. Signing configuration is machine-specific and intentionally excluded from Git:

cp Configuration/Developer.xcconfig.template Configuration/Developer.xcconfig

Add your own Apple Developer Team ID, then follow CONTRIBUTING.md for the complete setup. Never commit certificates, provisioning profiles, notarization keys, or local developer configuration.

On first launch, macOS presents two separate approval gates:

1. Enable the system extension in System Settings › General › Login Items & Extensions.
2. Allow the content filter when macOS requests network-filter permission.

Both approvals are required before live filtering begins.

Architecture

Shieldxy separates user-facing policy from latency-sensitive enforcement:

┌──────────────────────────────────────────────────────────────────┐
│  Shieldxy app                                                    │
│  SwiftUI · rules · history · risk · local persistence            │
└─────────────────────────────┬────────────────────────────────────┘
                              │
             validated rule snapshots ↓   flow events ↑
                  authenticated, versioned XPC contract
                              │
┌─────────────────────────────▼────────────────────────────────────┐
│  Network Extension                                               │
│  NEFilterDataProvider · signer identity · allow / drop / pause   │
└──────────────────────────────────────────────────────────────────┘

Component	Responsibility
Shieldxy/	Native interface, policy authoring, history, risk context, updates, and persistence
ShieldxyNetworkExtension/	Per-flow identity resolution and enforcement on the NetworkExtension verdict path
Shared/	Versioned IPC models, snapshot validation, rule matching, and runtime limits
ShieldxyTests/	Policy, identity, import, persistence, resource-bound, and release-hardening coverage

The extension owns no editable policy. It evaluates the latest accepted in-memory snapshot while the app remains the source of truth for user-authored rules.

Privacy

• No account, telemetry, analytics, advertising, or cloud reputation service.
• No TLS decryption, payload capture, request-body inspection, or secret scanning.
• Rules and connection history remain in the current user's Application Support directory; preferences use macOS UserDefaults.
• Optional GeoIP and company attribution run locally.
• Official builds may contact the signed public update feed.
• Opening Network Map may cause Apple's MapKit to fetch map content.
• Opening a website or using Open in Rockxy is an explicit user action handled by macOS or the receiving application.

Read the complete Shieldxy Privacy Policy for observed metadata, storage, third-party data, and network-request details.

Documentation

Guide	Covers
Network Extension	Installation, activation, IPC, and enforcement boundaries
Rules	App rules, host matching, temporary blocks, and Ask behavior
Policy and limits	Community defaults, technical ceilings, and bounded state
Risk and DNS	Local attribution, risk scoring, and optional GeoIP
Menu bar	Status item, throughput, and quick controls
Appearance	Theme and presentation settings
Releasing	Verifying a published DMG: signatures, notarization, architectures, and the Sparkle feed

Releases

The first official release will be a universal Apple Silicon and Intel application, signed with an Apple Developer ID certificate, notarized by Apple, distributed as a stapled DMG, and updated through a cryptographically signed Sparkle appcast.

Those properties are enforced by the release pipeline. They are not claimed for arbitrary local builds.

Contributing

Issues and focused pull requests are welcome. Start with CONTRIBUTING.md, run make verify-release, and add tests for behavior changes.

For vulnerabilities or privacy-sensitive reports, follow SECURITY.md instead of opening a public issue.

Rockxy Ecosystem

• Rockxy — native HTTP, HTTPS, WebSocket, GraphQL, and protocol-aware debugging
• Tracexy — network analysis and observability
• Shieldxy — application-aware network security and connection control

License

Shieldxy is available under the GNU Affero General Public License v3.0.

Copyright © 2026 Shieldxy Contributors.