ventz / wombat-vpn

⭐ If Wombat is useful to you, please star it: click the ☆ Star button at the top right of the GitHub repo page . Stars help it get into the official Homebrew catalog. 
 Wombat 
 WireGuard®, AmneziaWG and Cisco AnyConnect in one app: the last VPN software you need. 
A native, free and open-source VPN client for macOS. Secure first, easy and beautiful to use,
and powerful when you need it, with a command line developers will actually use.
## Table of Contents
- Overview
- Quick Install
- Features
- Usage
- Security
- Documentation
- Contributing
- Acknowledgements
- License
## Overview
The official WireGuard app for macOS has been effectively abandoned: its last commit was in
February 2023, and it still ships the wireguard-go of that era. The alternatives are either not
native (Electron or web views), not pretty, or not free (Passepartout, Shimo and others).
Wombat is a modern replacement that feels like part of macOS:
- **Native.** SwiftUI app, menu bar extra, and a packet tunnel that runs in Apple's Network
 Extension framework, so tunnels show up in System Settings › VPN and keep running when the
 app is closed.
- **Security first.** No root helper, no sudoers rules, no scripts run from configs, private
 keys never stored in world-readable places. See Security.
- **Developer friendly.** A complete CLI (`wombat status`, `up`, `show`, `check`, `logs -f`…),
 JSON output, a config linter with CI exit codes, and a skill that teaches coding agents to
 drive it.
Wombat speaks standard wg-quick `.conf` files and imports the official app's
**Export Tunnels to Zip** archive directly, so switching takes a minute. It also speaks
AmneziaWG, the WireGuard variant that disguises
its traffic from deep packet inspection, so exports from the AmneziaWG app import too.
And it connects to **Cisco AnyConnect / Secure Client** gateways (ASA, Firepower, and the open
source ocserv), the VPN most universities and companies run, with sign-in by password, Duo,
single sign-on (SAML: Okta, Entra ID, Duo SSO…) or a client certificate from your keychain. One
app for your own WireGuard servers and your work or campus VPN, no Cisco client needed.
## Quick Install
1. Download **Wombat.dmg** (always the latest version;
 also on GitHub Releases).
2. Open it and drag **Wombat** into **Applications** (network extensions only run from there).
3. Open Wombat, then allow its network extension once: **System Settings › General › Login Items
 & Extensions** › **Extensions** › **By Category** › **ⓘ** next to **Network Extensions** ›
 under **Wombat.app**, turn on **Wombat Tunnel** › **Done**. Your first Cisco AnyConnect VPN
 asks once more: turn on **Wombat OpenConnect** there too.
Or with Homebrew, which also puts the `wombat` command on your `PATH`:
 [code] 
Since Homebrew 6, casks from third-party taps must be trusted; installing by the full name, as
above, trusts just this cask. `brew trust --tap ventz/tap` would trust the whole tap instead.
Wombat is signed with a Developer ID, notari