claude-switcher is a GitHub project that wraps the Claude desktop app in a gate. Before Claude opens, it runs a battery of network and environment checks, and if any fail, launch is blocked. It also keeps separate login snapshots for several accounts and kills the app if your proxy tunnel drops. The repository has about 1,100 stars, and its main README is written in Chinese (an English version sits alongside).
This is a grey-area tool, so this post states the risks plainly alongside the features. If you are weighing it, the key question is not "does it work" but "does it fit within Anthropic's rules for your situation".
TL;DR: questions readers ask first
| Question | Answer |
|---|---|
| What does it do? | Audits proxy, DNS, IP, timezone and WebRTC before launching Claude; isolates up to four account snapshots; kills the app if the tunnel drops |
| Platforms? | macOS first; Windows and Linux are beta with separate READMEs |
| License? | MIT |
| Needs? | A proxy client in TUN mode (Clash Verge, Shadowrocket, sing-box, ClashX or Surge), the Claude desktop app, python3 |
| Safe from bans? | No. The README says it does not guarantee accounts will not be restricted |
| Terms risk? | Real. See the terms section below |
Agents that act on your behalf need rules. Agentbeam stops the dangerous actions →
What does claude-switcher actually do?
According to the README, it combines five ideas.
A pre-launch audit. Checks run before the app starts, and any failure blocks launch (a "fail-closed" design).
A WebRTC leak probe. A custom STUN client, written with only the standard library, compares results from global and mainland-China STUN servers to see whether your real IP escapes through the browser layer.
A kill switch. A daemon checks tunnel health every 10 seconds and kills the protected app if the tunnel is down. The README is candid that this is process-level, not a firewall, and that a time-of-check to time-of-use gap exists between checks.
Account snapshots. Accounts A through D each get separate device fingerprints and credentials, swapped on switch. Archiving uses renames and APFS or reflink copy-on-write where available, so switching is fast.
A config drift watchdog. It periodically restores settings that software updates reset, such as the TUN toggle and system timezone, and logs each correction. Pinned routing also forces Claude-related domains through the proxy ahead of third-party rule sets.
Extras include encrypted snapshot export and import, a web-based check page, a fingerprint check covering fonts, GPU and VM detection, a Claude CLI info command, and an isolated "open-safe" browser for links that discards its session on close.
Why a fail-closed design matters, and where it falls short
Most VPN and proxy tools fail open: if the tunnel drops, traffic quietly continues over your real connection. claude-switcher inverts that. Launch is refused when a check fails, and a running app is terminated when the tunnel dies. For anyone whose threat model is "my real IP must never reach this service", that is the right default, and it explains the project's appeal.
The limits are structural. A process-level kill is not a firewall rule, so packets sent in the gap between 10-second health checks can still leave on the wrong path. Checks run on your machine, so they can show that your setup looks consistent, but they cannot see what the service's own fraud and abuse systems consider suspicious. Providers typically combine many signals, including payment details, phone numbers, usage patterns and device history, and a clean network audit addresses only one of them. The README's own wording, that local checks do not change server records, is the honest summary.
There is also a maintenance cost. Pinned routing, Fake-IP DNS and TUN toggles all depend on third-party proxy clients that change their settings across updates. The config drift watchdog exists because those settings reset themselves, and each reset is a window where your checks pass on stale assumptions. Anyone running this should expect to babysit it after every proxy client update.
The 14 checks
The repo description says 11 checks, but the README body lists 14:
- Proxy core is running
- TUN virtual interface is active
- Exit IP country or region is acceptable
- Exit IP is consistent with the last check
- System timezone matches the IP location
- System locale matches the target region
- IPv6 does not bypass the proxy
- DNS uses Fake-IP, with no plaintext DNS leak
- WebRTC STUN cross-check
- Kill-switch guardian is online
- Pinned routing rules are in place for ecosystem domains
- JavaScript-visible language matches the target
- IP is residential rather than datacenter (ASN check)
- claude.ai and api.anthropic.com are reachable
Notice what the list is about. Almost every item compares your machine's apparent location, language and network identity against a target region. That is the tool's purpose, and it is also the source of the terms problem.
How to install it
Per the README:
- Download the latest release from GitHub Releases. For a first install, use the installer-kit ZIP.
- Unzip and double-click
installer/安装.command, or clone the repo and run the same installer. - The macOS build is ad-hoc signed and not notarized, so you may need to allow it under Privacy and Security.
- Open the "Claude切换器" desktop app and wait for the checks.
- If everything passes, pick an account to launch. If something fails, use the one-click repair.
An ad-hoc signed, un-notarized app that edits your proxy client's global script and restarts it deserves care. "Fix" can restart Clash Verge and modify its global script, and changing the WebRTC policy also requires running fix. Read the installer and scripts before you run them, because you are giving a young project control over your network configuration and a folder of Claude credentials.
The terms-of-service problem
The README says users must follow Anthropic's terms and prohibits resale, sharing, bulk registration and evading regional restrictions. The features pull the other way: a consistent in-region identity, managing multiple accounts, and recovering from bans.
Two Anthropic rules matter here. First, Anthropic's Supported Regions policy limits its products to listed countries and regions, and it applies to people physically located in an unsupported region, so a proxy that shows a supported location does not change where you are. Second, the Consumer Terms bar sharing your account login or credentials with anyone else. A search of those sources found no text mentioning VPNs directly, and the Supported Regions page showed conflicting effective dates in different copies, so read the current wording yourself.
For context, we have covered how Anthropic enforces access rules: its usage policy on abusive behavior, its ID verification rollout, and its threat intelligence report. The direction is toward more verification, not less. A fingerprint-matching tool is a bet that enforcement stays shallow, and the README's own disclaimer concedes it offers no guarantee.
This is not legal advice. If you are in a supported region and only want clean separation between a work and a personal account, you do not need a location-masking stack, and the simpler route is separate OS user profiles or Claude's own account switching.
Other risks beyond the terms
- Credential handling. Snapshots hold login state for several accounts. A bug or a malicious update could expose them. The README notes cross-identity sharing of config files is off by default and carries correlation risk.
- Supply chain. Un-notarized binaries from a 51-commit repo are a classic supply-chain risk. The same worry applies to the wider ecosystem of Claude Code proxies and wrappers we have examined.
- Proxy dependence. It assumes a specific class of proxy clients and, per its own checks, mainland-China STUN comparisons. It is not a general-purpose tool.
- False confidence. A green checklist can feel like safety. The README says the checks reduce leak risk but do not guarantee it.
- Maintenance. The main README and installer are in Chinese (an English README exists), and community support runs through a WeChat group and a Chinese forum, so English-speaking users may struggle to get help.
What this says about the Claude account market
The tool's popularity shows how much demand there is for multi-account setups and for access from places Anthropic does not serve. Rate limits are the other driver: when a plan's usage runs out, running several accounts is tempting. Our guides on Claude Code usage limits and token efficiency cover legitimate ways to stretch a single plan, and the Claude Code commands reference shows how to manage context so you hit limits later.
Should you use it?
Our read: if you are in a supported region, you do not need it, and it adds credential and supply-chain risk. If you are outside a supported region, using it to present a supported location would run against the restriction in Anthropic's terms, and we do not recommend that. (The README's own stated purpose is for users who are physically in supported regions, such as travelers.) Either way, do not treat a green checklist as permission, and do not enter payment details or credentials into any tool you have not audited.
Related reading
- Anthropic usage policy on abusive behavior
- Anthropic ID verification with Persona
- Anthropic threat intelligence report, September 2026
- free-claude-code proxy: terms and data risks
- Claude Code token efficiency and prompt caching
- Claude Code commands reference
- Official: claude-switcher repository and Anthropic supported regions
Star counts and features are accurate as of October 27, 2026 and may change. Check Anthropic's current terms before relying on this summary.