Frequently Asked Questions (FAQ)

RoamSwitch for Mac is a zero-trust autonomous network defense and security diagnostic suite for macOS designed with strict Zero-Telemetry (zero external data transmission). It features sub-second macOS kernel packet filter (pf) switching based on network changes, canary-driven ransomware detection with Air-Gap isolation, dev server LAN exposure protection, unknown port auto-blocking, unauthorized USB storage & BadUSB keyboard defense, an 18-item comprehensive security audit, and read-only AI integration via MCP.

The Free edition includes automatic Wi-Fi detection, 3-tier pf profile switching, automatic sharing service stop/restore, 18-item manual security audit, Wi-Fi encryption strength warning, and port/USB device monitoring (view-only) with no expiration. The Pro Lifetime edition ($19.99 / ¥2,980 one-time purchase, lifetime free updates) adds ransomware encryption detection & Air-Gap isolation, dev server LAN exposure isolation, anomalous port auto-blocking, ARP spoofing auto-containment, gateway ARP/NDP pinning (prevention), VPN auto-tunnel + kill switch (WireGuard / Tailscale), unauthorized USB storage & BadUSB defense, web/mail download protection with automatic ClamAV scanning, hazardous AI model (.pkl) download detection, DNS threat protection, link protection (/etc/hosts sinkholing), link safety auditing, clipboard API key protection, Bluetooth auto-off on untrusted Wi-Fi, autonomous patrols, CSV/JSON export, and dual-Mac licensing per user.

While traditional antivirus software relies on passive scans for known malware signatures, RoamSwitch detects network environment changes in sub-seconds and autonomously enforces kernel-level (pf) packet filtering and service shutdown. Unlike dialog-heavy interactive firewalls like Little Snitch, RoamSwitch provides zero-click autonomous defense once your trusted networks are configured, never interrupting your workflow with constant approval popups.

RoamSwitch contains zero analytics, tracking, or telemetry code. The developer Lafine publishes a comprehensive security architecture whitepaper detailing exact verification methods, allowing users to independently verify zero outbound transmission using standard tools such as Wireshark or tcpdump.

RoamSwitch identifies connected Wi-Fi networks by gateway BSSID/MAC address and SSID in milliseconds, automatically applying one of three macOS packet filter (pf) profiles: Trusted (Home/Office), Balanced (Standard Protection), or Lockdown (Public/Untrusted Wi-Fi). Unnecessary listening ports and sharing services are instantly blocked the moment you open your Mac in a cafe or hotel.

RoamSwitch places canary honeypot files in key directories (Desktop, Documents, Downloads) and monitors FSEvents for mass modifications and encryption entropy spikes. Upon detection, it instantly freezes the offending process using SIGSTOP, severs all network interfaces via pf (Air-Gap), and stops file sharing services to prevent lateral infection across your LAN and Time Machine backups.

When starting local frontend dev servers (Vite, Next.js, Webpack) or local AI backends (Ollama, LM Studio), they often bind to 0.0.0.0, exposing internal endpoints to everyone on the same Wi-Fi network. RoamSwitch detects these listening ports and blocks incoming connections from the local subnet while maintaining full access from localhost.

Even if services like Remote Login (SSH), File Sharing (SMB), Screen Sharing (VNC), and AirDrop are enabled at home, RoamSwitch automatically pauses them the instant you connect to an untrusted Wi-Fi network, and automatically restores them when you return to a trusted network.

When an unregistered USB mass storage device is attached, RoamSwitch automatically unmounts/ejects it (or retains it read-only for ClamAV inspection). When a malicious BadUSB device (e.g. Rubber Ducky, disguised USB cable) that injects keystrokes at superhuman speed is inserted, RoamSwitch temporarily intercepts keystrokes and presents an authorization dialog to stop automated payload injection.

RoamSwitch continuously inspects ARP tables for Man-in-the-Middle (MitM) attacks where rogue machines impersonate the gateway. Upon detection, it triggers emergency Air-Gap isolation. Furthermore, upon connecting to untrusted Wi-Fi, it pins gateway and DNS MAC addresses in the neighbor cache to prevent ARP/NDP poisoning before it starts.

RoamSwitch prevents local DNS resolution of known malicious C2 and phishing domains (via Quad9, Cloudflare, or AdGuard integration). It also detects newly downloaded files and hazardous AI models (.pkl / .pt) in real time via FSEvents and scans/quarantines them using ClamAV.

Before clicking a link received via email or chat, Link Audit expands shortened URLs, traces redirect chains, checks Unicode homoglyphs, and inspects domain reputation locally with Zero-Telemetry. Additionally, Link Protection automatically sinkholes confirmed malicious phishing domains locally via /etc/hosts to prevent accidental connections.

macOS 13 Ventura or later. Exclusively built for Apple Silicon Macs (M1, M2, M3, M4 and newer). Intel-based Macs are not supported.

RoamSwitch requires privileged daemon execution (SMAppService.daemon) and sub-second kernel packet filter (pf) management, which are strictly prohibited by Mac App Store sandbox policies. The .dmg package is officially code-signed with Apple Developer certificates and notarized by Apple for full security and integrity.

Open System Settings -> General -> Login Items & Extensions, and ensure RoamSwitch helper is toggled ON under 'Allow in Background'. Ensure the app is located in /Applications, then restart the application.

No, this is not malicious behavior. The Web & Mail Protection feature scans files downloaded via your browser or email the moment they arrive, so it requests access to your Desktop, Downloads, and Documents folders through macOS's standard permission system. RoamSwitch explains this in-app before the prompt appears, and it is a legitimate system permission (TCC), not unauthorized access. Scanning happens entirely on your Mac; file contents are never sent to any external server (Zero Telemetry). If you'd rather not grant this permission, you can leave this feature off -- other protections (such as DNS Threat Protection) will keep working normally.

A single Pro Lifetime license permits installation on up to 2 Macs owned by the same user (e.g. MacBook and desktop Mac). To transfer to a new machine, deactivate the license on your old Mac or contact official support.

It checks 18 critical macOS security parameters: FileVault full disk encryption, System Integrity Protection (SIP), Gatekeeper, automatic security updates, XProtect update status, macOS Application Firewall, Stealth Mode, Wi-Fi encryption strength, ARP spoofing state, external listening port exposure, and more, providing an overall security posture score (0-100).

It is an implementation of the Model Context Protocol (MCP) enabling AI assistants such as Claude Desktop, Claude Code, Cursor, OpenCode, and Google Antigravity to directly inspect your Mac's security posture score and audit findings.

None. The bundled MCP server (RoamSwitchMCPServer) is designed as strictly read-only over local stdio. Even in the event of prompt injection, the AI has no capability to modify firewall rules, change system settings, or execute administrative commands.

Yes. We provide the official open-source Swift client SDK RoamSwitchKit (Swift Package Manager supported). With a few lines of Swift async code, you can fetch security reports, exposed ports, guard statuses, and link safety scores.

A. It's probably not broken — RoamSwitch's Rogue USB / BadUSB Keyboard Guard may have detected an unregistered keyboard and is temporarily blocking its input. Select “Allow” in the approval dialog that appears when you connect it, and the keyboard will work normally from then on (if you missed the dialog, unplug and replug it to bring it back). Input is also released automatically after 3 minutes of no response. If the issue persists, check the allowlist from “USB / BadUSB Guard Settings…” in the menu.

A. Yes — ordinary outbound traffic like web browsing, email, and chat is never restricted at any protection level. The three levels differ in how much unsolicited inbound traffic they allow. 🟢 Trusted disables the firewall and also allows shared services (SSH/SMB/Screen Sharing) and AirDrop. 🟡 Standard Protection uses the firewall and stealth mode to block external probing while keeping shared services available. 🔴 Maximum Lockdown fully blocks the firewall and enables stealth mode, and also disables shared services and AirDrop. None of the levels ever block traffic you initiate yourself, like browsing.