about

Why the Project Is Called VPN Works When It Isn't Another VPN App

VPN Works isn’t a VPN app. There’s no server list, no country picker and no monthly plan. The name is about what a VPN is supposed to do, and doing it at the level where it’s needed now.

A VPN, at its core, decides which way your traffic leaves and who gets to see it. For twenty years that decision was made for a whole machine. You turn the VPN on, and everything goes through it. You turn it off, and nothing does.

That was fine when the programs on a machine were the ones you were watching. Now a coding agent runs commands you didn’t type, a scraper fetches pages you never see, a build job pulls dependencies from wherever its lock file says. They need different ways out and different rules, and one switch for the whole machine can’t give them that.

Before: one VPN for the whole machine, one path and one set of rules for every program, and no record of which program sent what. After: the program sealed in, with vpnw as its one door, each connection checked, routed and recorded, and the rest of the machine untouched.

What the Name Says

VPN, because the job is the same: choose the way out, keep traffic where it should be. VPN Works even speaks WireGuard now, the protocol most modern VPNs run on, and runs the tunnel itself.

Works, in two senses. The plain one: a VPN that works for the thing you’re actually worried about, one program at a time. And works as in a workshop, the place where the parts get made. VPN Works is a core and the plugins around it, and more parts will come out of it: Ledger for records nobody can quietly edit, Exit for fixed addresses, Lab for testing tunnels, Scope for company networks.

The command is vpnw, four letters, quick to type, which matters for a tool you put in front of other commands all day:

vpnw guard --policy agent.toml -- ./my-agent

What It Isn’t

It isn’t a privacy service. VPN Works doesn’t run servers or sell exits; it uses the ones you have, from your VPN provider, your office, or a WireGuard server of your own.

It isn’t a firewall either. A firewall works on addresses and ports for a whole machine. vpnw works on one program, knows the names it asked for, and writes down what it did.

The closest thing to it is a sandbox for the network: a door that opens only where you said, and a log of everyone who used it. How it works