Bastion
Close your router's backdoors, see where your traffic goes, speed up your Wi-Fi, and let AI agents watch your network for you.
Desktop app for Windows and macOS. Free, open source, no account.
Download · Build from source · Privacy · Security policy
Screenshot placeholder: add docs/screenshots/home.png (recommended 2880x1840, dark UI) before the first public release.
What Bastion does
Finds the doors into your home network, and helps you close them.
One scan checks your router from the inside and explains each finding in plain language, with the evidence it observed and the exact steps to fix it.
| Check | What it looks for |
|---|
| Provider remote management (TR-069) | The CWMP port (7547) answering on your router, which lets your ISP, or whoever compromises it, reconfigure the router remotely |
| UPnP | Whether any program on your network can open ports on the router, and which port mappings are open right now |
| Telnet / SSH | Unencrypted or unnecessary remote shells on the router |
| Plain-HTTP admin page | A router admin panel that sends your password unencrypted |
| Router admin page | Whether the router's admin page is reachable from this computer and what it identifies as. Bastion never submits a login or tries any password |
| Plain-text DNS | Whether this computer's DNS lookups go out unencrypted, readable by your ISP and anyone on the path |
| WPS | Push-button / PIN pairing, a common way in |
| Wi-Fi security | Open, WEP or WPA (1) networks |
| Location mapping | Whether your Wi-Fi name opts out of public location databases |
| MAC privacy | Whether this computer uses a private (randomized) hardware address |
| Unknown devices | Devices on your network you may not recognize |
Encrypted DNS. Shows which DNS servers this computer really uses, whether they are your router or ISP, and whether lookups are encrypted. Then guides you to encrypted DNS (Cloudflare, Quad9, Google, or your own choice) in the way your system allows: Windows 11 has a DNS over HTTPS option in Settings; Windows 10 and macOS have no Settings switch for it, so the guide covers turning on encrypted DNS on your router or installing the provider's DNS over HTTPS profile or app.
Wi-Fi channel tuning. Surveys nearby networks, shows how crowded each channel is, and recommends a quieter channel with the numbers behind it ("4 networks on your channel now, 0 on channel 44"). Plus a real speed test: ping, jitter, download and upload.
Device list. Everything your computer can see on the local network, with vendor names, gateway and this-computer markers, and a flag for randomized addresses.
Where your traffic goes. Live connections from this computer: which program talks to which address and port.
AI watchers with your own key. Connect Claude (Anthropic), ChatGPT (OpenAI) or Grok (xAI) with your own API key. Agents read a snapshot of your scan results and answer questions like "is anything here dangerous?" or "why is my Wi-Fi slow in the evening?". They answer and suggest steps; you carry out any change yourself. Agents cannot change anything on your computer or router.
Use your Claude or ChatGPT subscription
No API key? If you pay for Claude or ChatGPT, Bastion can ask through the official command-line tools you are already signed in to on this computer:
| Provider in Bastion | Needs | Install | Sign in |
|---|
| Claude (my subscription) | Claude Code | npm install -g @anthropic-ai/claude-code | claude auth login |
| ChatGPT (my subscription) | Codex CLI | npm install -g @openai/codex | codex login |
Open Settings → Use your subscription: Bastion finds the CLI (also in the usual install folders when it was started from the Dock or Start menu), shows its version and sign-in state, and has a Test button. Once it is ready, it appears first in the Agents tabs and the Home agent menu, and Auto prefers it over API keys. Answers count against your plan's usage limits.
Bastion runs the CLI with the same privacy-minimised snapshot it sends to the APIs, passes it on stdin, switches every tool off (Claude Code: --tools "" plus --disallowedTools "*" and dontAsk, with your hooks and plugins not loaded; Codex: --sandbox read-only, approvals never, shell, code and browser tools disabled, your config.toml not loaded, and Bastion checks with codex features list that they really are off before the first question) and starts it in a fresh empty folder, so the model can only answer. Signed in to Codex or Claude Code with an API key instead of a plan? Bastion labels it, because those answers are billed to the key. Quitting Bastion stops any CLI still answering. Bastion never reads your login.
What it does NOT do
Bastion is honest about what one computer can and cannot see. Where it cannot measure something, it says unknown and tells you how to find out yourself. It never shows made-up numbers.
This is the beginning of the README. Read the rest at the original. Read the full README ↗
