The firewall your Android never had.
Control every connection per app, block malicious domains, inspect traffic, and ask an AI about threats. All on your phone, no root, no cloud.
Blocked c2.badhost.topAllowed api.chat.exampleOne app. The whole security stack.
Everything below runs on-device. Nothing goes to a server we operate.
Offline AI assistant
Ask why an app is calling an unknown server. Local models (Qwen, SmolLM, Gemma) answer without sending data anywhere.
No-root firewall
Allow or block internet per app on Wi-Fi and mobile data. Emergency lockdown cuts everything except your whitelist.
Domain sinkhole
Check a domain against a sample blocklist. DoH and DNSCrypt supported.
Encrypted P2P mesh
Tunnel through your home PC, another phone or a VPS. AES-256-GCM or ChaCha20-Poly1305, no open ports.
SOCKS5 and chaining
Route through Shadowsocks, v2rayNG or a corporate gateway, with UPnP and NAT-PMP.
Packet inspection
Decrypt HTTPS with your own CA, export PCAP for Wireshark, replay requests.
Private by design
No accounts, no analytics. Read every line on GitHub.
Antivirus Shield Scanner
Run Quick, Full or Deep scans across installed apps, network traffic and files, with YARA rules for the deepest sweeps.
Protected in three steps
Install
Download the signed APK and accept Android's VPN prompt. Traffic is filtered locally.
Set your rules
Pick apps to block, turn on the sinkhole, or whitelist only what you trust.
Watch and respond
See live connections, ask the AI, and export packets when something looks off.
See it in action
Real screens from the KotSafe app. Tap one to enlarge it.
Home
Firewall, antivirus and SOC status at a glance, with an Ask AI shortcut.
Traffic
A live flow graph and per-app connections, with filters for user apps, system and DNS.
Firewall
Live throughput, packets checked and threats blocked, with a dynamic threat blocklist mode.
Shield Scanner
Quick, Full and Deep scans across apps, network traffic and files, with YARA rules.
Try the firewall
Flip an app to red and watch KotSafe block its traffic. This demo uses made-up apps and domains, but the idea is the same as in the real app: you choose what gets online.
0
This is a live demo. Flip an app to red and watch its traffic get blocked.
Follow a packet through KotSafe
Select a stage, or watch it play. Every stage runs on your phone.
Two editions today. A third on the way.
Both share the core. Full-Power adds protections that need extra Android permissions. KotSafe Business for teams is coming soon.
KotSafe Business
A corporate edition of the APK for teams that need central policies, visibility and managed deployment, built on the same private-by-design core.
Get KotSafe
Signed APKs are published on GitHub Releases. Android 7.0 or newer.
Docs
Blog
Engineering notes and release stories. Full articles are coming soon.
Introducing KotSafe
Why we built a firewall that needs no root and no cloud.
Inside the KotEngine core
How the native engine filters packets fast.
Route your phone through your home PC
An encrypted tunnel without opening ports.
Built in the open
KotSafe is GPL-3.0 and needs people who know security. Threat data, protocol parsers (HTTP/3, QUIC, gRPC), and code audits of the native engine are all welcome.
FAQ
Does KotSafe need root?
No. It uses Android's VPN service to filter traffic locally on your device.
Does it send my data anywhere?
No telemetry. AI models run on the phone, and cloud AI is only used if you add your own key.
Why isn't it on the Play Store?
Signed APKs are distributed through GitHub Releases so you can verify and audit what you install.
Is it stable?
It is in active development and in beta. Report anything odd on GitHub.