Check your Intel Mac before downloading
ClashX Pro is a macOS graphical client that manages a Clash-compatible core, proxy profiles, system proxy settings, and connection status from the menu bar. Before installing it, confirm that the Mac is using an Intel processor and that the downloaded package matches the application format offered by the distributor. Intel Macs normally use the x86_64, x64, or amd64 architecture label. Do not choose an arm64 or aarch64 package unless the software documentation specifically says that it supports translation through Rosetta.
Open the Apple menu in the upper-left corner, choose About This Mac, and inspect the hardware information. On older systems, the processor line may show an Intel Core i5, Intel Core i7, or Intel Xeon processor. On newer versions of macOS, the window may display a Chip field for Apple silicon instead. If the field explicitly says Intel, use the Intel build. This check takes less than a minute and prevents a large number of launch failures.
| What you see | Package to choose | Typical result |
|---|---|---|
| Intel Core or Intel Xeon | x86_64, x64, or amd64 |
Native Intel execution |
| Apple M1, M2, M3, M4, or later | arm64 or universal |
Apple silicon execution |
| Universal package | One package containing Intel and arm64 binaries | macOS selects the suitable architecture |
| Architecture is not listed | Check the release notes before installing | Avoid guessing from the application name alone |
Also record the macOS version under About This Mac. The exact menus can vary between macOS releases, and an older Intel Mac may not support the newest macOS version. A client can install successfully but still fail to start if its bundled frameworks require a newer system. If the package includes a minimum macOS requirement, compare it with the version shown on your Mac before opening the installer.
Download and open the installer safely
Download the application only from a source you trust, and verify that the file is intended for macOS. The usual distribution format is a .dmg disk image, although some packages arrive as a compressed archive containing an .app bundle. The file extension alone is not enough to establish authenticity. Check the publisher name, release information, architecture, and checksum when one is provided.
After the download finishes, open Finder and select Downloads. A DMG normally opens as a new Finder window containing the application icon and an alias to the Applications folder. Drag ClashX Pro.app to Applications. If the download is a ZIP file, double-click it first and move the extracted application into the same folder. Do not use the client permanently from the DMG, Downloads folder, Desktop, or an external drive.
- Open the downloaded DMG or archive from Finder.
- Drag ClashX Pro.app into the Applications folder.
- Wait for the copy operation to finish before ejecting the DMG.
- Eject the mounted disk image from Finder’s sidebar if a DMG was used.
- Open Applications and launch the copied application from there.
Installing into Applications gives macOS a stable path for the application bundle and makes later updates easier. It also helps avoid repeated authorization prompts caused by launching a copy from a changing location. Keep one active copy of ClashX Pro rather than leaving an older copy in Downloads and another copy in Applications. Multiple copies can create confusion about which menu bar process is currently controlling the system proxy.
If macOS reports that the application cannot be opened because the developer cannot be verified, do not immediately disable all security protections. First confirm that the file came from the intended source and that the download completed correctly. Then open System Settings → Privacy & Security. After one blocked launch attempt, macOS may show an Open Anyway control near the security notice. Use it only after checking the application source.
Handle common Gatekeeper messages
There are several different messages that users often describe as an “installation error.” “Developer cannot be verified” usually means Gatekeeper does not recognize the developer’s notarization or signing status. “The application is damaged” can indicate an incomplete download, a modified bundle, an invalid quarantine attribute, or an actual damaged package. These cases should not all be handled with the same command.
- Developer cannot be verified: verify the source, then review Privacy & Security for an approved launch option.
- Application is damaged: delete the copy, download it again, and compare the checksum if available.
- Nothing happens after double-clicking: launch the copy in Applications, then inspect the system log or the application’s architecture.
- Application quits immediately: check the macOS version requirement and whether an Intel-compatible build was downloaded.
Do not paste a subscription URL into a terminal command while troubleshooting installation. A subscription URL can contain an access token, and terminal history may retain it. Keep installation diagnostics and network configuration diagnostics as two separate tasks.
Complete the first launch and menu bar setup
When ClashX Pro starts successfully, it may not open a large main window. Many macOS proxy clients operate from a menu bar icon. Look at the upper-right area of the screen for the ClashX Pro icon. Select it to open the application menu, where you can usually access profiles, proxy mode, system proxy controls, logs, and preferences.
If macOS asks whether the application may access files in a particular folder, decide based on the feature you are using. Importing a local YAML file requires access to that file. A client may also ask for permission to access network-related settings when enabling system proxy or a transparent routing feature. Read each prompt instead of approving every request automatically.
The first launch is a good time to close other proxy clients. Clash for Windows, Clash Verge, ClashX, FlClash, a standalone mihomo process, and command-line proxy tools can all compete for the same local port or repeatedly change the macOS system proxy. Quit unused clients from their menu bar icons and check Activity Monitor if you suspect an old process is still running.
| Initial item | What to confirm | Why it matters |
|---|---|---|
| Menu bar icon | ClashX Pro remains visible after launch | The client is running even without a main window |
| Profile list | A local file or subscription can be added | The core needs a valid configuration before it can start |
| Proxy mode | Rule, global, or direct mode is clearly displayed | Mode determines how traffic is selected |
| System proxy toggle | It is off until a working profile is ready | This prevents applications from pointing to an inactive local port |
Do not enable the system proxy immediately after installation if no profile has been imported. macOS applications may then send requests to a local address such as 127.0.0.1:7890 while the Clash core is not listening. The result can look like a general internet outage even though the underlying issue is only an inactive local proxy.
Import a profile or subscription
ClashX Pro needs a configuration profile before it can establish proxy connections. Depending on the version and distribution, the menu may use labels such as Config, Profiles, Import, or Download. A local YAML file can be imported from Finder, while a subscription is normally added by entering its URL. Use the exact menu provided by your installed version rather than assuming that every Clash client has the same layout.
Add a local YAML file
- Open the ClashX Pro menu bar menu.
- Choose the profile or configuration management option.
- Select the command for importing a local file.
- Choose a valid Clash-compatible YAML file.
- Wait for the profile to appear in the list.
- Select the imported profile and allow the core to reload it.
Before importing a YAML file, check that it is actually a configuration rather than an HTML error page. A valid file commonly contains fields such as proxies, proxy-groups, rules, or an inbound port such as mixed-port. A response beginning with <html>, <!doctype html>, or a provider login message is not a usable Clash profile.
Add a subscription URL
To add a subscription, copy the complete URL from your provider’s account page and paste it into the profile import field. Avoid copying from a formatted document that may insert spaces or line breaks. Many subscription URLs contain long tokens, so do not share screenshots of the address and do not publish it in a support forum.
After the profile is downloaded, inspect its name, updated time, and parsing result. If ClashX Pro reports a timeout, status code, or YAML parsing error, test the URL separately in a browser or with a local command while hiding the token from any saved output. A browser page that displays a login form, CAPTCHA, JSON error, or HTML notice is not equivalent to a successful Clash configuration response.
curl -L --connect-timeout 10 --max-time 30 \
-A "clash.meta" \
-o profile.yaml \
-w "HTTP=%{http_code} SIZE=%{size_download}\n" \
"https://example.invalid/subscription/token"Do not assume that every profile works with every core. Fields designed for mihomo, newer proxy protocols, advanced rule providers, or TUN-specific behavior may not be accepted by an older Clash-compatible core bundled with an older ClashX Pro build. If the download succeeds but parsing fails, inspect the exact error and ask the subscription provider whether a classic Clash or compatible output format is available.
Configure system proxy and local ports
Once a profile loads without a parsing error, start with system proxy mode. This is the least invasive way to test a new installation because macOS applications that respect system proxy settings will send HTTP and HTTPS requests through the local Clash service. In the ClashX Pro menu, enable the system proxy only after selecting an active profile and a usable policy group.
The local address is often 127.0.0.1, while the port depends on the active configuration. A common mixed port is 7890, but you should not hard-code that value without checking the YAML or the client preferences. Other configurations may use 7891, 7892, or separate HTTP and SOCKS ports. The port shown in macOS network settings must match the port actually opened by the Clash core.
| Setting | Example | Purpose |
|---|---|---|
| Mixed proxy port | 127.0.0.1:7890 |
Accepts common HTTP and SOCKS client traffic on one port |
| HTTP proxy port | 127.0.0.1:7890 |
Handles applications using an HTTP proxy setting |
| SOCKS5 port | 127.0.0.1:7891 |
Handles applications configured for SOCKS5 |
| External controller | 127.0.0.1:9090 |
Provides a local API for compatible interfaces and tools |
After enabling the system proxy, open a browser and test a normal HTTPS website. Then open a site that displays your public IP address and compare the result with the selected proxy node. If the browser cannot connect, disable the system proxy first, then check whether the core is running, whether the selected node is available, and whether the local port is already occupied.
System proxy mode does not capture every application. Some command-line tools, games, virtual machines, and applications with their own networking stack ignore macOS proxy settings. Do not treat this as an installation failure. It means that the application requires its own proxy configuration or a transparent routing feature supported by the client and core.
Check permissions, TUN, and connection status
For a basic browser test, system proxy mode is normally the best starting point. TUN or enhanced routing mode is a separate feature that creates a virtual network interface and can capture traffic from applications that do not honor the system proxy. It may require administrator approval, a network extension, a VPN configuration, or additional macOS permissions depending on the client and core version.
Do not enable TUN merely because the system proxy test has not been completed. First confirm that the profile parses, a policy group has a selected node, the core is running, and ordinary browser traffic works. Then decide whether you actually need transparent routing. Enabling multiple traffic interception tools at once can produce DNS conflicts, routing loops, or a connection that appears to fail randomly.
| Feature | Typical requirement | Recommended first test |
|---|---|---|
| System proxy | Working profile and local proxy port | Browser request through the selected policy |
| TUN or enhanced mode | Network extension, VPN approval, or administrator authorization | Enable only after system proxy mode works |
| DNS override | Core DNS configuration and compatible resolver settings | Compare domain resolution before changing several fields |
| External controller | Local controller address and optional secret | Keep it bound to 127.0.0.1 unless LAN access is required |
If macOS displays a permission prompt while enabling TUN, read the requested component carefully. A VPN or network extension approval is different from a Keychain prompt. An administrator password may be required to install a helper or authorize a system-level component. If the prompt repeatedly reappears, disable TUN, quit ClashX Pro, restart the Mac, and check System Settings → Privacy & Security and the network extension or VPN section before trying again.
Use the ClashX Pro logs to separate connection failures from routing failures. A timeout while connecting to a node points toward the node, DNS, firewall, or network path. A successful node connection followed by browser errors points more toward system proxy settings, rules, certificates, or an application that bypasses the proxy. A local “connection refused” message usually means that the process is not listening on the configured port.
Finish with a repeatable connection test
A complete installation check should cover more than whether the menu bar icon appears. First confirm that ClashX Pro remains running after the DMG has been ejected. Next confirm that a profile is selected, the core log shows no parsing error, and a policy group has an available node. Then test the local proxy port and a browser request separately.
- Open ClashX Pro from the Applications folder.
- Confirm that the menu bar icon is visible.
- Select a valid profile and wait for the configuration to reload.
- Choose a working node or automatic policy group.
- Enable system proxy mode.
- Open an HTTPS website in a browser.
- Check the client log for the request and the selected outbound policy.
- Disable system proxy mode after testing if you do not want it enabled continuously.
If the browser works but a particular application does not, inspect that application’s own network settings before changing ClashX Pro. If no application works, disable system proxy mode and confirm that the original network connection has returned. Then check the configured port, the active profile, and whether another client is already using the same port. The most useful evidence is the exact error, timestamp, profile name, local port, and selected node—not a screenshot containing the subscription URL.
For regular use, enable automatic startup only after the configuration has been tested. If the client starts before the network is ready, subscription updates and health checks may fail temporarily. A stable routine is to keep the application in Applications, use one active client, update the profile at a reasonable interval, and disable the system proxy before quitting the client. This prevents macOS applications from retaining a dead local proxy address.
Intel Macs can continue to provide a reliable ClashX Pro setup when the architecture, macOS compatibility, profile format, local port, and permissions are checked in that order. Start with the least invasive system proxy mode, confirm the core and node connection, and add TUN only when a specific application requires traffic capture beyond the system proxy.