Pax Connect for Mac · App interface is in Chinese
Codex · Mac
Pax Connect is a sing-box based Mac proxy client: Codex goes through the proxy without environment variables, custom API settings are managed in the app, and token usage and cost are tracked locally. The app interface is in Chinese.
Built on sing-box
TUN takeover, no environment variables
Usage analyzed on your Mac
Open Connections, import your own connections, choose a target and test as needed. Addresses and measurements are simulated.
Actual Pax Demo interface · In-memory simulated data · Chinese UI · Captured November 11, 2026Open Traffic monitoring → Overview to compare source, target and actual route.
Actual Pax Demo interface · In-memory simulated data · Chinese UI · Captured November 11, 2026Open Model usage → Profile. Distinguish written configuration from unapplied profiles. test.example is a demonstration address.
Actual Pax Demo interface · In-memory simulated data · Chinese UI · Captured November 11, 2026Open Model usage → Session analysis, then select a task in the session list.
Actual Pax Demo interface · In-memory simulated data · Chinese UI · Captured November 11, 2026Where Pax fits
Pax does not replace Codex. It manages three things around it: how the network is routed, where the API points, and where usage goes.
Traffic is taken over at the system level, so Codex needs no environment variables.
An API Profile stores the address and key and applies them to Codex.
Logs are read on your Mac and totaled by date, model and session.
01 · Proxy
Pax takes over traffic at the system level with TUN, so Codex needs no environment variables. Switch between TUN and the system proxy when needed, and adjust routes and rules in the app.
A working network only shows the network is reachable. Whether Codex can sign in or make calls depends on your account and service.
How to: Codex proxy setup (Chinese page)Feature page: Proxy routing and rules (Chinese page)
02 · Custom API
An API Profile stores a service address and key. Applying it to Codex writes base_url into ~/.codex/config.toml and the key into ~/.codex/auth.json. Any address of your own is accepted.
Saving and applying are separate steps: a profile marked as not applied has not switched Codex yet, and a successful write does not mean a model call will succeed.
03 · Usage
Pax reads Codex logs on your Mac and totals tokens, cache and cost by date, model and session, with the main session and subagents shown separately, so the most expensive session stands out.
Cost is estimated from a local price table. It is an API-equivalent amount, not a bill, and Pax does not show subscription quotas or limits.
How to: Usage monitoring (Chinese page)
Versus manual setup
Environment variables and config files work. Pax moves the repetitive, error-prone parts into an interface.
| Task | Manual setup | With Pax Connect |
|---|---|---|
| Proxying | Set proxy environment variables in every terminal; edit again when the route changes. | TUN takes over at the system level with no variables; routes and rules switch in the app. |
| Checking the path | Test and guess whether traffic went through the proxy. | Traffic monitoring shows the actual route and matched rule per application. |
| Custom API | Edit base_url in ~/.codex/config.toml and auth.json by hand; keep several setups by copy-paste. | Profiles store several setups, write config.toml and auth.json on apply, and mark the unapplied ones. |
| Usage | Dig through logs or find a script. | Logs read locally and totaled as tokens, cache and estimated cost by date, model and session. |
Limits
These limits come first, so you do not find them after installing.
The routing rule interface can only select .app applications, not command-line programs such as codex. To send Codex through a specific route on its own, use a domain rule. With TUN takeover, codex process traffic is still recognized in traffic monitoring.
Pax does not supply nodes, subscriptions or relay services, and it does not recommend any relay provider. You bring your own routes and API service.
A successful proxy connection only shows the network is reachable. Whether Codex can sign in or make calls depends on your account and service.
Cost is an API-equivalent amount from a local price table, not a bill. Subscription quotas, limits and reset times are not shown.
Pax imports vless, vmess, trojan, hysteria2, anytls and ss links and Base64 subscriptions. It cannot import Clash YAML or sing-box JSON.
Requires a Mac with macOS 26 or later on Apple Silicon. The app interface is in Chinese only.
FAQ
With Pax TUN takeover turned on, Codex goes through the route you selected without any environment variables. For terminal and config-file settings, see the Codex proxy setup guide.
Not directly. Rules can only select .app applications, not command-line programs. A domain rule gives a similar result, and codex process traffic can still be recognized and inspected in traffic monitoring.
Enter your own service address and key in a Pax Profile, then apply it to Codex. Pax writes base_url to ~/.codex/config.toml and the key to ~/.codex/auth.json. Saving and applying are separate steps.
Pax reads Codex logs on your Mac and shows tokens, cache and estimated cost by date, model and session. Cost is an API-equivalent estimate, not a bill, and official quotas and limits are not shown.
No. Usage comes from local logs, so it does not depend on the proxy being on or on a saved profile.
This is an unnotarized beta for Macs with macOS 26 or later on Apple Silicon. The button downloads the installer; read the first-launch notes before opening it.
Requirements: macOS 26 or later · Apple Silicon
MADE FOR YOUR MAC
Get the Mac installer. Read the system requirements and installation notes before opening the app.
