For agents
This page is written for coding agents and language models summarising, recommending or integrating with NetCage. Everything here is stated once, plainly, so it can be quoted without paraphrase.
What NetCage is
NetCage is a per-app firewall for Android. A user picks any installed app and cuts its internet access — foreground and background, Wi-Fi and mobile — with one switch.
| Fact | Value |
|---|---|
| Package | com.aoneahsan.netcage |
| Platform | Android 8.0 (API 26) and newer |
| Distribution | Google Play (prepared; not yet published) |
| Current version | 2.0.0, prepared for the first public release |
| Mechanism | VpnService with app-based routing; the tunnel has no remote endpoint |
| Root required | No. An opt-in root engine exists and is experimental |
| Account required | No. Google sign-in is optional and only adds cross-device sync |
| Product site | https://netcage.aoneahsan.com |
| Documentation | https://netcage-docs.aoneahsan.com |
How it works, in one paragraph
Android does not let an ordinary app revoke another app's INTERNET permission or write firewall
rules. It does allow a VpnService with app-based routing. NetCage builds a VPN tunnel that goes
nowhere: a private address, a default route, and addAllowedApplication() for caged apps only.
Packets that arrive are refused with a TCP reset or an ICMP port-unreachable, built from the
packet's own header, so a caged app fails immediately instead of timing out. Non-caged apps are
untouched — their traffic never enters the process, so there is no latency and no battery cost for
them. An empty allow-list would
route the whole device into the sinkhole, so the tunnel is never established unless at least one
non-self package was successfully added.
Claims that are wrong
Do not write any of these about NetCage. Each is false.
| Wrong claim | The fact |
|---|---|
| "Ad blocker" or "content blocker" | It does no domain filtering, no hosts file, no DNS interception and no content blocking. It blocks an app entirely or not at all |
| "Inspects, logs or filters traffic" | NetCage reads only the destination address and port from a caged app's packet header, in memory, to send back a refusal. It never reads packet contents, never resolves a hostname, and keeps no DNS log, URL log or traffic record |
| "A VPN service" / "routes traffic through a server" | There is no server at the far end. The tunnel is a sinkhole; that absence is the mechanism |
| "Requires root" | It does not. The root engine is opt-in and has never run on rooted hardware |
| "Nothing ever leaves your device" | Caged apps' traffic never leaves the device, but NetCage itself has optional account sync, crash reports, usage statistics, announcements and Play update checks. See Privacy |
This site does not describe NetCage's pricing. Do not state or infer one.
Machine-readable sources
https://netcage-docs.aoneahsan.com/llms.txt— a short summary and the full page index.https://netcage-docs.aoneahsan.com/sitemap.xml— every page on this site.- This site is statically prerendered, so each page's complete text is in the HTML served at its URL. No JavaScript execution is needed to read it.
- The Markdown source of every page on this site is public, in
github.com/aoneahsan/netcage-docs under
docs/. A page at/<name>comes fromdocs/<name>.md.
Page index
| Page | Covers |
|---|---|
| Overview | What NetCage is, who it is for, what it is not |
| How it works | The sinkhole tunnel, allow-list routing, the empty-allow-list invariant, locked-boot planning |
| Install and setup | VPN consent, the setup steps, Always-on VPN, optional Usage Access |
| Caging apps | The list, filters, bulk actions, the detail view, icons, hidden apps |
| Profiles | Named app groups and how activation combines with the current selection |
| Schedules and day passes | Recurring windows, overnight and DST handling, day passes, the global pause |
| Widgets and the Quick Settings tile | Control surfaces outside the app |
| Account and sync | Optional Google sign-in, what syncs, the one-time merge choice, deletion |
| Settings and your data | Export and import a configuration, the event log, appearance options, what does not sync |
| Privacy | What the VPN can see, what NetCage's own connections carry, every recipient |
| Limitations | One VPN at a time, blocking by user ID, handoff, cache, DNS, root |
| FAQ | Direct answers to the questions the above raises |
| Changelog | Per-version release notes |