blackice

A headless application firewall for macOS, operated through a CLI.

read the docsinstallview on github
appopens a connectionblackicechecks your rulesallowedyou or fxapprove or denydroppedruleno rule: pausedapprovedeny or no answer

how it works

  1. An app on your Mac opens a connection.
  2. blackice lets it through, drops it, or holds it, by the mode and your rules.
  3. A held connection waits for an answer: yours, with blackice approve or blackice deny, or an agent's, such as Claude Code or fx.
  4. With no answer in time, it is dropped.

modes

accept-all
Allows every connection and logs it.
ask
Holds any connection that no rule or approval covers yet.
block-all
Allows only what your rules allow.

details

An approval covers one app and one host, and expires. Rules you want to keep go in blackice.toml.

An agent sees where a connection goes, never what it sends, and does not run as root.

There is no window: a menu bar icon shows the mode and what waits.

configuration

blackice.toml holds the mode and your rules. The first blackice start writes it. The configuration docs cover every key.

mode = "ask"

[[allow]]
app = "com.apple.curl"
hosts = ["pypi.org"]

install 1.0.7

1.0.7 has run on one Mac, with macOS 27.0.1. It needs macOS 14.4 or later on Apple silicon.

curl -fsSL https://blackice-macos.vercel.app/install.sh | sh

The script checks the release and copies Blackice.app to /Applications. Or with Homebrew:

brew trust --cask valentintorassa/tap/blackice
brew install --cask valentintorassa/tap/blackice

Or download Blackice-1.0.7.zip from the GitHub release and check it as the install docs describe.

Then run blackice start. It asks a few questions and opens System Settings so you can allow the extension.

demo