Clash Config Auditor

One-click security audit for self-hosted Clash and proxy configs

Problem

Free Clash clients keep appearing on the App Store with no ads and no IAP, and users are publicly wondering how they make money — possibly by harvesting configs or traffic. A normal user receiving a shared yaml subscription or a native client has no way to spot DNS leaks, plaintext subscription URLs, suspicious routing rules, or remote script endpoints before handing over all their traffic.

Solution

A locally-run audit tool: paste or import a Clash / Surge / sing-box config, and it parses every outbound request, subscription link, DNS entry and routing rule, flagging privacy risks with fix suggestions. Optionally diff subscription updates and alert when a new suspicious domain appears.

Users

Self-hosting proxy users, developers juggling multiple airport subscriptions, and ops teams auditing internally distributed configs.

MVP

Import Clash yaml and subscription URLs and parse locally; list all external domains, IPs and script endpoints; rate plaintext subscriptions, public DNS and risky rules red/yellow/green; export a shareable Markdown audit report; never upload the config.

Revenue

Free basic audit plus a subscription for continuous subscription monitoring and team-shared reports at $3-5/mo; or a one-time desktop license.

Why now

New untrusted Clash clients are shipping weekly and user suspicion about config privacy is peaking, yet existing auditing tools target enterprises, not individuals.