---

Table of Contents

• Why
• Features
• How LanGuard compares
• Install
• Usage
• How it works
• Is it safe?
• FAQ
• Uninstall
• Reporting a bug
• Contributing
• Support
• License

Why

macOS keeps Wi-Fi on even when you're docked over Ethernet — wasting an IP lease, adding a second default route, sometimes sending traffic out the wrong interface, and leaving an extra radio exposed. LanGuard switches Wi-Fi off the instant a wired link is active and switches it back on when the cable's gone. It only acts on plug/unplug transitions, so if you manually flip Wi-Fi back on while docked, it stays on until you next unplug.

Features

🔌 Edge-based	Acts only on wired plug/unplug transitions — your manual Wi-Fi changes are respected.
😴 Wake-aware	A transition that happened while asleep is detected and corrected on wake.
🎛️ Per-interface	Pick which wired adapters trigger and which Wi-Fi adapters are controlled.
🧪 Ignores virtual NICs	Bridge / VPN / VM adapters (e.g. VMware vmnet) are off by default so they can't pin Wi-Fi off.
🔔 Notifications	Optional banner whenever Wi-Fi is toggled.
🧭 Configurable indicator	Menu-bar shows LAN / Wi-Fi / Off — icon only, icon + label, or label only.
⏸️ Master switch	Pause all automatic toggling from the menu.
🚀 Start at login	Self-healing login item — re-registers if the app moves; prompts if macOS needs approval.
🔐 No admin, no sudo	Wi-Fi power via CoreWLAN, link state via SystemConfiguration. No network calls of its own.

Menu-bar indicator (icon + label style):

An open-menu screenshot is still welcome — see #1.

How LanGuard compares

	LanGuard	BridgeChecker	ToggleWifi
Price	Free	Paid (~$50)	Free
Open source	✅ (MIT)	❌	✅
Per-interface selection	✅	✅	❌
Edge-based (respects manual toggle)	✅	—	—
Wake-from-sleep handling	✅	—	not documented
No admin / sudo	✅	—	❌ (needs admin)

_{Comparison based on each project's public docs at time of writing; verify current details on their sites. LanGuard is not notarized (ad-hoc signed) — see Is it safe?.}

Install

Requires macOS 14+ (Sonoma).

Homebrew

brew install --cask roypadina/tap/languard

LanGuard is ad-hoc signed (not notarized). On first launch, right-click it in /Applications → Open (then Open again), or run once:

xattr -dr com.apple.quarantine "/Applications/LanGuard.app"

See Is it safe? for why.

Build from source

git clone https://github.com/roypadina/LanGuard.git
cd LanGuard
xcodebuild -workspace LanGuard.xcworkspace -scheme LanGuard -configuration Release build
cp -R ~/Library/Developer/Xcode/DerivedData/LanGuard-*/Build/Products/Release/LanGuard.app /Applications/
open /Applications/LanGuard.app

The app lives in the menu bar (no Dock icon). On first launch, click Allow on the notification prompt if you want toggle banners.

Usage

Click the menu-bar icon for status, the Auto-toggle master switch, and Settings….

In Settings you can:

• choose which wired adapters count as triggers (real adapters on by default, virtual off),
• choose which Wi-Fi adapters are controlled,
• toggle notifications,
• pick the menu-bar icon style (icon / icon + label / label),
• enable Start at login.

How it works

wired link UP   ─▶  Wi-Fi OFF
wired link DOWN ─▶  Wi-Fi ON
(no edge)       ─▶  leave Wi-Fi alone   ← respects manual override

Component	Role
NetworkMonitor	SCDynamicStore link/IP callbacks + NSWorkspace wake notification
WiFiController	CoreWLAN power on/off (no sudo)
ToggleEngine	Edge state machine — dependency-injected, fully unit-tested
InterfaceCatalog	Enumerate + classify Ethernet/Wi-Fi; flag virtual adapters
LoginItem	SMAppService login item (self-healing)
Notifier	UNUserNotificationCenter banners

See the Wiki for deeper docs, CHANGELOG.md for release history, and CLAUDE.md for the full component map.

Is it safe?

Fair question — it toggles your network and launches at login. Here's the honest picture:

• Open source (MIT). Every line is in this repo; read or build it yourself.
• No network calls of its own. No ads, no analytics, no tracking. It uses local macOS networking APIs (CoreWLAN, SystemConfiguration). The only external tools it ever runs are read-only ifconfig (a link-state fallback) and a one-time launchctl to remove the legacy LaunchAgent — never networksetup, never with elevated privileges.
• No admin / sudo. It never asks for your password or installs a privileged helper.
• Ad-hoc signed, not notarized. That's the one rough edge: macOS can't verify the developer, so the first launch is blocked until you right-click → Open (or clear quarantine with the xattr command above). Notarization needs a paid Apple Developer ID; it's on the roadmap. If you'd rather not trust a prebuilt binary, build from source.
• Each release ships a SHA-256 for the download so you can verify it.

FAQ

Wi-Fi turned back on by itself while I was docked — bug? No. LanGuard is edge-based: it acts only at the moment you plug/unplug. If you (or another app) turn Wi-Fi on while wired, LanGuard respects that until your next unplug/replug.

I'm docked but Wi-Fi stayed on. Either you turned it on manually since plugging in (see above), or that wired adapter isn't selected as a trigger in Settings (virtual adapters are off by default).

Does it work with USB-C / Thunderbolt docks and USB-Ethernet adapters? Yes — any adapter macOS reports as an Ethernet interface. You choose which ones count.

Why is my VPN / VM adapter ignored? Virtual adapters (VPN tunnels, VMware/Parallels vmnet, bridges) are off by default so they can't be mistaken for a real wired link. You can opt any of them in under Settings.

Does it need admin rights? No. Wi-Fi power goes through CoreWLAN and link state through SystemConfiguration, both as your normal user.

macOS says it "can't verify the developer." It's not notarized yet — right-click the app → Open, or run the xattr command in Install. See Is it safe?.

Uninstall

brew uninstall --cask languard          # if installed via Homebrew
# or just drag /Applications/LanGuard.app to the Trash

defaults delete com.roy.languard        # forget all settings (optional)

Also remove it under System Settings → General → Login Items if it's still listed.

Reporting a bug

Hit something odd (Wi-Fi toggling when it shouldn't, etc.)? Turn on Settings → Debug → Enable debug logging, reproduce it, then click Reveal Logs in Finder and attach ~/Library/Logs/LanGuard/languard.log to your issue. The log stays on your Mac and contains only interface names + toggle decisions (no personal data).

Contributing

PRs welcome! main is protected — fork, branch, add tests, and open a PR. Good first issues are labeled here. See CONTRIBUTING.md and the Code of Conduct.

cd LanGuardPackage && swift test   # pure logic, no hardware needed

Support

If LanGuard saves you some battery and annoyance, you can buy me a coffee on Ko-fi ☕ — totally optional, always appreciated. A ⭐ star helps just as much.

License

MIT © Roy Padina