Profile source
Subscriptions and local YAML remain readable, recoverable, and separate from launch-time wiring.
profiles/
default.yaml
work.yaml
lab.yaml
subscription URL -> Keychain
source YAML -> local storage
Native macOS proxy client
ClashMax
Native macOS control for Mihomo profiles, proxy groups, TUN, logs, and system proxy recovery.
Checking GitHub
v1.0.18
Latest ClashMax release Jun 23, 2026
Build
24
Read from the current release channel
Mihomo core
v1.19.27
Latest upstream release Jun 6, 2026
Platform
macOS 15+
SwiftUI app, GPL-3.0 boundary
Source profiles stay untouched. Runtime config is app-managed.
ClashMax keeps original YAML profiles intact, then generates runtime YAML for ports, controller auth, DNS, TUN, and launch mode.
Managed launch
The app writes the values Mihomo needs without mutating the user profile.
Controller127.0.0.1
Secretper run
System proxysnapshot
TUNhelper
Mihomo boundary
The controller stays local, uses Bearer auth, and avoids Linux-only TUN keys on macOS.
external-controller: 127.0.0.1:<port>
secret: generated per run
tun: no auto-redirect on macOS
controller access: Bearer auth
The first screen is the proxy client.
The portal mirrors the product direction: dense enough for operations, calm enough for daily use.
Runtime state stays explicit.
Start, stop, switch modes, inspect TUN/helper readiness, and recover system proxy state without guessing what the app is doing.
proxyprofile loaded09:41:12
ruleGEOIP matched direct09:41:15
tunhelper route active09:41:20
Groups are quick to scan.
Switch proxy groups, run latency checks, and read provider health state where decisions happen.
Imports stay reversible.
Local files and subscription URLs keep clear ownership and update paths.
Traffic is inspectable.
Review sessions, destinations, matched rules, upload, download, and close stale flows.
Rule paths are visible.
Trace why traffic went direct, proxied, or rejected without opening raw config first.
Logs are part of the workflow.
Mihomo logs sit near runtime controls for config and network debugging.
Lightweight actions stay close.
Check status and run quick controls from the macOS menu bar.
Versions come from GitHub at page load.
The app release and Mihomo core cards refresh from GitHub API endpoints, with local fallback values when the API is unavailable.
v1.0.18 build 24
Download links are selected from the latest GitHub release asset list.
Published
Jun 23, 2026
Primary asset
DMG
Public links stay inspectable.
The page uses GitHub release metadata, the Sparkle appcast, and the upstream Mihomo release feed.
Security-sensitive behavior is not vague.
A proxy client touches local networking, so the portal calls out the same boundaries the app enforces.
Local controller
Mihomo controller access is bound to 127.0.0.1 by default and protected with Bearer auth.
Per-run secret
Each launch generates a fresh controller secret instead of relying on a shared static credential.
Helper boundary
User-mode owns normal system proxy. The privileged helper owns TUN and validates app-owned core/config paths.
Open source, early, and direct about issues.
ClashMax is GPL-3.0 compatible because it distributes and controls Mihomo. Reproducible bugs belong in GitHub Issues.