Kivuko

A NordVPN client for the Mac menu bar, written in Rust and built on WireGuard.

Kivuko (kee-VOO-koh) is Swahili for “crossing” or “ferry”.

Build from sourceApple silicon · macOS 14 or later Source on GitHubgithub.com/piedol/kivuko

Kivuko is an independent project. It is not made, endorsed or supported by Nord Security. You need your own NordVPN subscription.

Kivuko’s menu while connected: Disconnect, Location set to United States, and Kill Switch, Auto-Connect and Block Ads and Trackers ticked

Kill switch, auto-reconnect and ad blocking

Kivuko is a free, open-source NordVPN client for macOS that connects over WireGuard (NordLynx).

Kivuko’s kill switch is enforced by macOS. Kivuko reconnects after sleep and network changes, and it can block ads and trackers through NordVPN’s DNS. The menu bar app uses about 23 MB of memory and the tunnel about 8 MB.

Its tunnel runs GotaTun, Mullvad’s Rust implementation of WireGuard, inside a macOS packet-tunnel extension. macOS starts and restarts that extension, for example after sleep.

The menu

Connect and Disconnect are at the top of the menu. Quitting Kivuko turns the VPN off.
Location lists every country NordVPN serves, with your recent choices first. Fastest Server uses NordVPN’s recommendation for where you are.
With Kill Switch on, macOS blocks any traffic that would leave outside the tunnel while the VPN is on or reconnecting. Your local network keeps working. IPv6 traffic goes into the tunnel, where NordVPN drops it, so it can’t leak around the VPN.
Auto-Connect reconnects on any network, after sleep and when Kivuko starts, until you click Disconnect.
Block Ads and Trackers uses NordVPN’s Threat Protection Lite DNS. With it off, Kivuko uses NordVPN’s standard DNS.

The Kivuko menu: Connected for 5 minutes, Disconnect, Location, the Protection toggles, Launch at Login and Quit

When a server stops answering

Kivuko checks the WireGuard handshake every 15 seconds.

8 sTry the next serverIf a server doesn’t answer within 8 seconds, Kivuko tries the next server, up to three.
3 minForce a handshakeIf no WireGuard handshake arrives for 3 minutes, Kivuko forces a new handshake.
6 minRestart on a new serverAfter 6 minutes, macOS restarts the tunnel on a new server (with Auto-Connect on).

How it works

Kivuko.app                     app/       menu bar app: menu, token prompt, VPN configuration
└── Contents/PlugIns/
    └── KivukoTunnel.appex     provider/  packet-tunnel extension: server choice, GotaTun, watchdog

The menu bar app manages the VPN configuration that macOS keeps in System Settings › VPN, including the kill switch, the On-Demand rule and the DNS choice.
The tunnel is a NetworkExtension packet-tunnel provider. macOS starts it whenever the VPN starts, including automatic reconnects while the app isn’t running.
On each start, the tunnel asks NordVPN for recommended WireGuard servers, gives macOS the addresses, routes and DNS, and runs GotaTun on the tunnel interface macOS creates.
docs/architecture.md explains the design decisions, the connection sequence and the watchdog.

Privacy and security

Kivuko talks only to NordVPN’s API and the VPN server you’re connected to, and sends no analytics.

Your NordVPN access token is stored in your login keychain. When you click Connect, the app hands it to the tunnel, which uses it to fetch your WireGuard key from NordVPN.
The tunnel keeps the WireGuard key in its own sandbox container, readable only by your user (mode 0600).
Any user on the Mac can read macOS’s VPN configuration, so Kivuko stores only your country and DNS choice there.
The logs record events, never the token or the key. docs/setup.md lists every file Kivuko writes.

Resource use

Measured on a MacBook Pro with macOS 26.

Process	Memory	CPU
Menu bar app	23 MB	0% when idle
Tunnel	8 MB	Under 1% with background traffic; about 26% of a core while downloading at 212 Mbit/s

Get Kivuko

There’s no ready-made download. macOS loads VPN extensions only when they’re signed through a paid Apple Developer Program membership, so you build and sign Kivuko yourself. The full guide is docs/setup.md.

Requirements

Mac: Apple silicon
macOS: 14 or later (so far tested only on macOS 26)
VPN service: Your own NordVPN subscription
Signing: A paid Apple Developer Program membership

To build it

Xcode: Signed in with that account
XcodeGen: github.com/yonaskolb/XcodeGen
Rust: 1.95 or later

Clone the repository and choose a bundle ID prefix of your own, such as com.yourname:
```
git clone https://github.com/piedol/kivuko.git
```
```
cd kivuko && cp signing/local.env.example signing/local.env
```
Set KIVUKO_BUNDLE_PREFIX in signing/local.env, and KIVUKO_TEAM if your Apple ID is in several developer teams. scripts/bundle.sh --check shows what will be signed.
Build, sign and install. On the first run, Xcode registers your Mac and the two bundle IDs and downloads development profiles:
```
scripts/bundle.sh --install
```
Get a NordVPN access token from Nord Account › NordVPN › Advanced settings › Access token.
Click the shield in the menu bar and choose Set Up and Connect. Paste the token, click Save and Connect, then click Allow when macOS asks to add a VPN configuration.

Development profiles last a year. When they expire, macOS stops loading Kivuko, and running scripts/bundle.sh --install again renews them. Don’t keep a second copy of Kivuko on your Mac. When two copies of the tunnel extension are registered, opening either copy of the app makes macOS stop the other’s tunnel, which drops the VPN.

To uninstall, follow Uninstalling in order. Deleting the app first can leave the kill switch blocking your connection until you remove the VPN configuration.

Frequently asked questions

Is Kivuko free and open source?

Yes. Kivuko is free to download and use, and its source code is on GitHub under the GNU General Public License v3.0 or later.

Do I need a NordVPN subscription?

Yes. Kivuko connects to NordVPN with your own subscription, using an access token from Nord Account › NordVPN › Advanced settings.

Is Kivuko affiliated with Nord Security?

No. Kivuko is an independent project. It is not made, endorsed or supported by Nord Security.

How do I install Kivuko?

Build it from source on a Mac with Apple silicon and macOS 14 or later. macOS loads VPN extensions only when they’re signed through a paid Apple Developer Program membership, so there’s no ready-made download. docs/setup.md has the steps.

What does Kivuko send over the network?

It talks only to NordVPN’s API and the VPN server you’re connected to, and sends no analytics. Your access token stays in your login keychain.

How do I uninstall Kivuko?

Quit Kivuko first, then remove its configuration in System Settings › VPN, move Kivuko.app to the Trash and delete its token from the login keychain. Deleting the app first can leave the kill switch blocking your connection.

License

Kivuko is free software under the GNU General Public License v3.0 or later. Bug reports and pull requests are welcome on GitHub.

Use it anywhere, including at work, and read, change and share the source. If you distribute a modified version, release its source under the same license.

Credits: GotaTun by Mullvad, wireguard-apple and objc2.