ClashMaxmacOS controlfor Mihomo.
A native client for the Mihomo core. Profiles, proxy groups, rules, logs, system proxy, and TUN controls, on macOS 15 and later.
The first screen is the proxy client.
Start, stop, switch modes, inspect TUN and helper readiness, and recover system proxy state without guessing what the app is doing.
Running v1.19.33
Current NodeRuntime
Network Status
Controller127.0.0.1:9097
ProxySystem Proxy 127.0.0.1:7890
Source profiles stay untouched. Runtime config is app-managed.
ClashMax keeps original YAML profiles intact, then generates runtime YAML for ports, controller auth, DNS, TUN, and launch mode.
Subscriptions and local YAML remain readable, recoverable, and separate from launch-time wiring.
The app writes the values Mihomo needs without mutating the user profile.
- external-controller
- 127.0.0.1
- secret
- generated per run
- mixed-port
- app-managed
- mode
- rule / global / direct
- dns
- app-managed override
- tun
- helper-owned
Eight surfaces ship in the app.
Dashboard, Profiles, Proxies, Connections, Rules, Logs, Settings, and the macOS menu bar.
Dashboard
Start, stop, switch modes, and inspect TUN and helper readiness
Profiles
Local files and subscription URLs keep clear ownership and update paths
Proxies
Switch proxy groups, run latency checks, and read provider health state
Connections
Review sessions, destinations, matched rules, upload and download
Rules
Trace why traffic went direct, proxied, or rejected without opening raw config
Logs
Mihomo logs sit near runtime controls for config and network debugging
Settings
Ports, DNS, TUN, launch behaviour, and updates
Menu bar
Check status and run quick controls from the macOS menu bar
Groups are quick to scan. Traffic is inspectable.
Both panels are rebuilt in HTML from the app’s own layout, labels, and states, so they stay legible at any size.
- Auto - Lowest delay42 ms
- Tokyo 0168 ms
- Singapore 0391 ms
- Los Angeles 02184 ms
- Frankfurt 01—
Security-sensitive behavior is not vague.
A proxy client touches local networking, so the page states the same boundaries the app enforces.
Local controller
Mihomo controller access is bound to 127.0.0.1 by default and protected with Bearer auth.
Per-run secret
Each launch generates a fresh controller secret instead of relying on a shared static credential.
Helper boundary
User-mode owns normal system proxy. The privileged helper owns TUN and validates app-owned core and config paths.
Single bundled core
Only the bundled Mihomo core runs. Another core channel would need a manifest, hash checks, and helper allowlisting first.
Keychain credentials
Subscription URLs are stored per profile ID in the Keychain, never in the runtime YAML.
GPL-3.0 boundary
ClashMax distributes and controls Mihomo, so it keeps a GPL-3.0 compatible licensing boundary.
Install takes four steps.
From the release page to a running core.
Download the DMG
Take ClashMax-X.Y.Z.dmg from the latest release.
Drag to Applications
Installing into /Applications is required for helper approval and the experimental Network Extension.
Import a profile
Open a local Clash or Mihomo YAML file, or add a subscription, then start the runtime from the Dashboard.
Approve the prompt
TUN mode and NE Proxy each need their macOS approval before they can run. System proxy mode does not.
Open source, early, and direct about issues.
ClashMax is GPL-3.0 compatible because it distributes and controls Mihomo. Reproducible bugs belong in GitHub Issues; setup questions and release news live in the Telegram group.