About

VPN Works is the VPN, rebuilt as an operating system. Its kernel, vpnw, gives each program its own network: its own way out, its own rules and its own record. Plugins are its apps. All of it is open source.

Why It Exists

Programs that act on their own are everywhere now. AI coding agents run commands and call APIs. Scrapers, build jobs and CI steps pull code and data from all over. Most of them get all the network access the machine has, which is a lot of trust for a program that follows instructions it finds in text. A README or an issue only has to carry the right sentence, and an agent holding a token can be talked into sending it out.

The tools we have work at the wrong level for that. A VPN gives the whole machine one way out. A firewall can’t tell which program opened a connection. Neither keeps a record of what one program did. VPN Works works one level down. Each program gets a sealed sandbox whose only door is vpnw, a policy short enough to read, a path you pick (straight out, a proxy, a WireGuard tunnel), and a record of every connection.

How It’s Built

Like an OS. The kernel does four things: seal, decide, carry, record. Paths are its drivers: direct, a proxy, a proxy over TLS, a WireGuard tunnel. Everything else is a plugin, a WebAssembly module in a sandbox with no files, no network and no environment, that reaches the kernel only through the calls its manifest asks for, the way an app uses system calls. Even the console output and the policy drafting are plugins. That keeps the kernel small enough to trust, and lets new features arrive without touching it. The platform · Plugins

Everything is written in Go. vpnw is one static binary for Linux and macOS, and nothing in it needs root, the WireGuard tunnel included.

How It’s Tested

Every number on this site comes from one script in the code repository, tools/record-results.sh, and its output is committed next to the code. The tests aim at the promises that matter: a sealed program tries 17 ways around vpnw, IPv6 included, and all are blocked; plugins that panic, spin forever, write without permission or fall behind are stopped without taking the run with them; a real WireGuard peer runs inside the tests, with a web server and a DNS server in its tunnel. An independent review goes over each release before it ships. How 0.4.0 was tested

Releases go out on their own: when the tests pass on a new version, the release workflow builds the binaries, checks each one, and publishes them.

History

The project started in September 2026 as five separate engines: the Agent for AI agents, Scope for company VPNs, Lab for testing VPN apps, Ledger for tamper-evident records and Exit for fixed exit addresses. Each worked, and each had its own tests and browser demo. Together they lacked a center. In October 2026 the project was rebuilt from scratch as one core with plugins (0.3.0), keeping the code that had earned its place, and WireGuard paths followed in 0.4.0. Ledger came back in 0.5.0, Lab in 0.6.0 and Exit in 0.7.0, each in its new role, and Tunnel plugins arrived in 0.8.0; Scope comes back with gateway mode. Roadmap

License

Apache License 2.0. Copyright VPNW.com 2026. The code, the plugin SDK and the docs are at github.com/VPNWorks/vpnw. WireGuard is a registered trademark of Jason A. Donenfeld; VPN Works isn’t affiliated with the WireGuard project.

Questions, setups to test, plugins to share: contact.