Skip to main content
Tinfoil Proxy is the same verified proxy as the CLI binary wrapped in a menu-bar app. At session start it verifies a Tinfoil router enclave against the public attestation transparency log; for the rest of the session every upstream connection is TLS-pinned to the attested public-key fingerprint, and the underlying Go client re-runs attestation if the enclave presents a new certificate.

​
Install

Download the matching .pkg for your Mac from the latest release — Tinfoil-Proxy-arm64.pkg for Apple Silicon, Tinfoil-Proxy-x64.pkg for Intel — and double-click to install, or run:
After installing, open the app once to launch it into the menu bar. If you want Tinfoil Proxy to start automatically next time you log in, toggle Open at Login from the popup or the tray menu.

​
Use it from any tool

Point your OpenAI-compatible tool at the local endpoint Tinfoil Proxy exposes:
On startup the proxy auto-discovers a Tinfoil router enclave, verifies its attestation, and forwards subsequent requests to it. The enclave’s attested public-key fingerprint is pinned for the rest of the session, and the underlying Go client re-runs attestation if the enclave rotates its TLS certificate. You can copy the URL from the menu-bar popup.

​
Compare to the CLI

Tinfoil Proxy is the menu-bar wrapper around the same tinfoil-proxy binary; both serve http://127.0.0.1:3301/v1 and do the same attestation. Pick whichever fits your workflow: