Throne wraps sing-box in a Qt desktop client, but on macOS it ships unsigned and needs setuid-root

One Qt client for both system proxy mode and Tun VPN mode

Throne is a cross-platform desktop proxy client written in C++ on Qt, with SagerNet's sing-box doing the actual traffic handling. It manages proxy profiles and subscriptions and routes traffic with rule-based routing profiles. The important choice for a user is the mode: Throne works either as a system proxy or as a Tun VPN. System proxy mode only affects applications that honor the operating system's proxy settings, while Tun mode captures traffic at the network interface, which is why it needs elevated privileges. The project credits Qv2ray among its influences, and the repository layout shows a separate core/ directory next to the Qt src/ tree, alongside docker/ and dist/ for packaging.

Headless Throne is driven by thronectl, not the GUI

Throne does not have to run with a window. It also runs headless, as a service or in a container, and in that mode it is controlled with thronectl, which lives in a separate repository, throneproj/Throne-api. Setup for this mode is covered on the project site under Headless Throne at throneproj.github.io/headless/. The consequence is that the desktop experience and the server experience are different tools: the GUI is the Qt client, while a router box or a container is managed through a command-line controller you install separately. If you plan to deploy Throne on a server, read the headless guide first rather than assuming the desktop settings translate one to one.

The unsigned macOS app needs its quarantine flag removed by hand

Throne does not have a signed certificate, and macOS enforces a strict security policy against unsigned apps. To launch the downloaded app you have to remove the quarantine attribute yourself:

xattr -d com.apple.quarantine /path/to/throne.app

There is a second trap. Move Throne.app to /Applications before the first launch. The built-in privilege escalation opens Terminal to make the core setuid-root, and that step can fail while the app is still inside ~/Downloads. The consequence for readers is twofold: you are bypassing Gatekeeper for a binary that Apple has not notarized, and you are granting a component root rights so it can manage Tun routing. On a managed or shared Mac, both steps may be refused or may need an administrator.

The Homebrew cask handles both steps, but only from macOS 14.4

The Homebrew cask removes the quarantine and handles placement for you. It supports Apple Silicon and Intel Macs, but only macOS 14.4 or newer:

brew install --cask throneproj/tap/throne

Updates go through Homebrew as well, with brew upgrade --cask throne. On an older macOS release the cask is not an option, which puts you back on the manual route with xattr and the move to /Applications. Other platforms have their own channels. Portable ZIPs and installers for every platform are on GitHub Releases, and the installation guide at throneproj.github.io covers a Linux install script, APT and RPM repositories, the AUR and other package managers.

A protocol list that reaches past sing-box into Xray and OpenVPN

The protocol coverage is the main reason to pick Throne. Beyond SOCKS and HTTP(S), it supports Shadowsocks, Trojan, VMess, VLESS, TUIC, Hysteria and Hysteria2, AnyTLS, Mieru, Snell, NaiveProxy, Juicity, TrustTunnel, ShadowTLS, Wireguard, AmneziaWG, MASQUE and SSH. It also covers DNS tunnels through DNSTT, VayDNS and MasterDNS, Xray VLESS with XHTTP and XDrive, and OpenVPN and OpenConnect. For anything not on the list there are custom outbounds and custom configs for both sing-box and Xray, chained outbounds, and an Extra Core option. XTLS Xray-core appears in the credits next to sing-box. The cost of this breadth is that custom configs put you in charge of raw sing-box or Xray JSON, so a mistake there is yours to debug.

Clash and Shadowsocks subscriptions get only limited support

Subscription import is where provider compatibility can break down. Throne accepts share links, various JSON representations of sing-box configs, and the v2rayN link format. Shadowsocks and Clash formats, by contrast, get only limited support. If your provider hands out a Clash YAML subscription, expect that not every node or rule will carry over, and check the imported profiles before relying on them. Deeplinks are supported too, with details in the deeplinks page of the project documentation. The practical advice is to test your actual subscription URL during setup rather than after you have switched your system traffic to Throne.

The newest builds are 1.4.0 betas off a dev branch

The repository's default branch is dev, and the three most recent releases are all prereleases of 1.4.0: beta.3 on 2026-10-17, beta.4 on 2026-10-23 and beta.5 on 2026-11-02. The last push landed on 2026-11-02, so the project is moving. For readers that means the releases page leads with beta builds; if you want stability, pick a release deliberately rather than taking whatever the latest link points to, and read CHANGELOG.md before upgrading. Throne is licensed under GPL-3.0, and development is funded through GitHub Sponsors and crypto donations.

Editorial conclusion

Throne suits desktop users who want one GUI over sing-box covering a long protocol list, rule-based routing and both system proxy and Tun VPN modes, plus anyone who needs the same client headless on a server through thronectl. It is a weaker fit for people whose providers hand out Clash or Shadowsocks subscription formats, where support is limited, and for anyone unwilling to strip quarantine from an unsigned macOS app and grant a setuid-root core. Before installing, check which release you are getting, since the newest builds are 1.4.0 betas, and confirm your subscription format imports cleanly.

Frequently asked questions

Official sources

1. License: GPL-3.0
2. Project website
3. README
4. Releases
5. throneproj/Throne on GitHub