about

Why the Project Is Called VPN Works When It Isn't Another VPN App

VPN Works is the name of an operating system for network paths: the VPN, rebuilt as an OS. It isn’t a VPN app. There’s no server list, no country picker and no monthly plan. The name is about what a VPN is supposed to do, and doing it at the level where it’s needed now.

A VPN, at its core, decides which way your traffic leaves and who gets to see it. For twenty years that decision was made for a whole machine. You turn the VPN on, and everything goes through it. You turn it off, and nothing does.

That was fine when the programs on a machine were the ones you were watching. Now a coding agent runs commands you didn’t type, a scraper fetches pages you never see, a build job pulls dependencies from wherever its lock file says. They need different ways out and different rules, and one switch for the whole machine can’t give them that.

Before: one VPN for the whole machine, one path and one set of rules for every program, and no record of which program sent what. After: the program sealed in, with vpnw as its one door, each connection checked, routed and recorded, and the rest of the machine untouched.

What the Name Says

VPN, because the job is the same: choose the way out, keep traffic where it should be. VPN Works even speaks WireGuard now, the protocol most modern VPNs run on, and runs the tunnel itself.

Works, in two senses. The plain one: a VPN that works for the thing you’re actually worried about, one program at a time. And works as in a workshop, the place where the parts get made. VPN Works is a kernel and the plugins that run on it, the way apps run on an OS, and more parts will come out of it: Ledger for records nobody can quietly edit, Exit for fixed addresses, Lab’s fault tests that every tunnel must pass, Scope for company networks.

The kernel and its command are vpnw, four letters, quick to type, which matters for a tool you put in front of other commands all day:

vpnw guard --policy agent.toml -- ./my-agent

What It Isn’t

It isn’t a privacy service. VPN Works doesn’t run servers or sell exits; it uses the ones you have, from your VPN provider, your office, or a WireGuard server of your own.

It isn’t a firewall either. A firewall works on addresses and ports for a whole machine. vpnw works on one program, knows the names it asked for, and writes down what it did.

Put together, it’s an operating system for network paths: a kernel with one door per program that opens only where you said, drivers for the ways out, apps that add the rest, and a log of everyone who used the door. The platform · How it works