The Clash ecosystem, Surge and sing-box can route connections by domains, IP addresses, processes and other conditions. CCIso aims to protect local privacy and keep Claude within boundaries you control. Connection routing is one part of that goal.
CCIso is available for macOS; Windows and Linux are still planned. This is a guide to choosing by task; it does not replace current product documentation or tests of your configuration.
When your existing routing tool fits
- You need routing for many applications across your computer.
- You already maintain rules, policy groups and DNS settings.
- You need to choose a proxy for each connection, without adding a Claude-specific view of checks.
Behavior depends on configuration. Mihomo and Surge match rules in order and provide final handling rules; sing-box also provides a final outbound setting. Those actions can differ. These tools cannot fairly be described as always connecting directly after a failure.
The tasks CCIso targets
| Task | CCIso’s direction | Current limit |
|---|---|---|
| Understand Claude protection status | Bring together connection rules, entry points and findings | macOS only for now; the process tree view is not available yet |
| Reduce exposure of specific credentials | Restrict proxy-secret storage and check some Claude credential permissions | This does not isolate all login storage or personal folders |
| Keep included processes within connection rules | Combine system rules with a local forwarding engine | Coverage depends on processes, platform and validated rules |
| Decide which private files may be read and which contents may be sent | Part of a broader privacy-control requirement | Full folder isolation and outbound content inspection are not provided |
If your current tool already meets your connection-control needs, the reason to consider CCIso should be whether its privacy-control experience fits your needs, not a different way to enter a proxy.
Check routing and isolation separately
Knowing the route does not tell you which file Claude read. Seeing one blocked connection does not establish that the contents of other allowed connections were inspected.
Evaluate the process scope, failure behavior, secret storage, private-file access controls and test evidence separately. Those questions are more useful than a product-category label.
Running two tools together
System proxies, virtual interfaces and application rules can overlap. CCIso has not published complete coexistence tests. A generic allow rule is not enough to establish a working combination; check the actual path and failure behavior on each platform.
Sources
Reviewed on November 1, 2026:
Product names belong to their respective owners. Continue with CCIso’s scope or downloads.