File Locations (macOS)
Where Chute Mac keeps its data, what each file is for, and what is safe to delete. Nothing here needs to be read to use Chute — it is for the moment a support request asks for a file, disk space becomes a question, or you want to know what a diagnostic bundle is drawn from.
On macOS the proxy engine runs inside the Chute Mac application itself, so everything below is written by the app under your own user account. The PacketTunnel system extension used by Enhanced Mode only moves packets and keeps no data of its own.
The data folder: ~/Chute
Chute Mac creates it, with an empty Content/, before the engine first starts; the engine adds Tmp/ and Share/ when it starts. The three subfolders have three different lifetimes.
Content/ — kept across runs
| Path | What it holds |
|---|---|
GeoLite2-Country.mmdb |
The GeoIP database behind GEOIP rules. Chute Mac ships a copy inside the app and uses that when this file is absent; a file placed here replaces it. |
GeoLite2-ASN.mmdb |
The ASN database behind IP-ASN rules. Chute Mac ships a copy inside the app and uses that when this file is absent; a file placed here replaces it, which is how to use a newer database. |
tailscale/ |
Fallback storage for this device's Tailscale node keys, with owner-only permissions, used only when the login Keychain is unavailable. Chute Mac keeps the keys in the Keychain (service com.r3.klnekit.tailscale) and moves any it finds here into it, so deleting this folder does not reset the node: delete those Keychain items to have the device join the tailnet as a new node. |
Tmp/ — scratch space
Rebuilt whenever it is missing; safe to delete while the engine is stopped.
| Path | What it holds |
|---|---|
rule_sets/ |
Downloaded RULE-SET files. Refetched on the rule set's update-interval, or on the next start when the cache is gone. |
ICON/ |
Icons of the applications shown in the process and traffic views. |
MitM/ |
The per-host certificates HTTPS decryption issues with your CA, kept in a folder per CA and reused across runs. Missing ones are issued again. |
db.connect |
The local socket Chute Dashboard uses to talk to the running engine. Exists only while the engine runs. The Mac app itself does not go through it — it hosts the engine in-process and calls it directly. |
A second cache, for proxy-provider subscriptions, lives under the system temporary directory as kl_proxy_providers/.
Share/ — what each run produced
| Path | What it holds |
|---|---|
control-token |
The token the HTTP Control API generated when the configuration names no external-http-secret. Owner-only permissions; reused across restarts. Delete it to have a new one generated. |
last-run.json |
The run marker: written when the engine starts, refreshed every 30 seconds with the current memory footprint, deleted by a clean stop. Finding it at the next start is how Chute knows the previous run was killed — this is what the console's Previous exit card and last_exit report. |
<run id>/ |
One folder per engine start, named by an 8-character run id. The Log and Traffic windows and the web console read from the current one. The most recent 10 are kept; older run folders are deleted when the engine starts. |
Inside a run folder:
| Path | What it holds |
|---|---|
<start time>.log, <start time>.1.log, … |
The session log, split into shards of 8 MiB. At most 8 shards are kept, so a long session holds its last 64 MiB; the first line of every shard says which run and shard it is. Neither the Log tab's Export nor the menu's Save Diagnostic Bundle… carries the shards whole: Export saves the entries the tab is showing — its filtered view of at most the last 2,000 — and the bundle takes the last 512 KiB of each shard. Attach the .log files themselves when the whole log is needed. |
tunnel.db |
An SQLite database of the run's connections — request and response headers, timing, the rule and policy that handled each, rewrite attribution — plus the events table. The console's History tab, /api/connections/history and the HAR export read it. Not created when disable-db-record is on. |
DUMP/ |
Request and response bodies. The folder is created at every start, but it holds files only while [Replica] recording is on: <connection id>_send.dump, <connection id>_receive.dump, and a .idx frame index beside each. They are deleted when the engine stops. |
Application files
| Path | What it holds |
|---|---|
~/Library/Application Support/com.R3Studio.Chute-Mac/Profiles/ |
Profiles imported from a subscription URL or a share link, and converted profiles. A configuration file imported from disk is referenced where it is, not copied here — see Getting Started. |
~/Library/Preferences/com.R3Studio.Chute-Mac.plist |
The app's settings: the active configuration, the outbound mode, window state, the list of recent run ids. |
~/Library/Application Support/com.R3Studio.Chute-Mac.key |
The license certificate. Revoke License in About deletes it and brings back the license window. |
Chute.app/Contents/Library/LaunchDaemons/com.R3Studio.ChuteHelper.plist |
The privileged helper's launchd job on macOS 13 and later, registered from inside the app bundle with SMAppService. The helper is started at every engine start, not only for the Helper utun flavour of Enhanced Mode, because it is also what sets the system proxy. |
/Library/PrivilegedHelperTools/com.R3Studio.ChuteHelper, /Library/LaunchDaemons/com.R3Studio.ChuteHelper.plist |
Where the helper is installed on macOS 12 and earlier. On macOS 13 and later Chute replaces a helper found here: it asks first (Helper Update Required), and Update Helper removes these files and installs the new one. |
/Library/Application Support/Chute/PreviousDNSInfo_<interface>.json |
The DNS servers a network service had before Enhanced Mode pointed it at Chute, one file per interface, written by the helper and read back to restore them on teardown. |
What is safe to delete
Tmp/entirely, while the engine is stopped. Rule sets and icons are fetched again as needed.- Any
Share/<run id>/folder except the one the running engine is writing to. Deleting a run removes its log, its connection history and its recorded bodies together. Share/control-token, if you want a fresh token; bookmarks and saved console sessions stop working.Content/GeoLite2-Country.mmdbandContent/GeoLite2-ASN.mmdb: the copies inside the app take over.
Do not delete ~/Chute while the engine is running: the log, the connection database and the control socket of the current run live there.