ThirdFlare One

Appearance

ThirdFlare OneYour warp-cli control plane

Unofficial Cloudflare One client for Linux, macOS, and headless setups. Install once, connect from the tray or terminal, route specific apps through WARP, and script everything over a guarded local API — without replacing Cloudflare's daemon.

Install in 2 minutes
App routing guide
API cookbook
ThirdFlare One
⌨️

CLI-first workflow

thirdflare for daily connect/disconnect and tray control. thirdflare-one to install, package, and run the full test suite from your checkout.

🎯

App routing

Turn on local proxy mode, pick apps from a dropdown, and get WARP shortcuts in your app menu — no manual SOCKS settings per application.

🔌

Guarded HTTP API

GET /api/snapshot for status and settings. POST /api/action for approved warp-cli mutations only. Secrets redacted in every response.

🎛️

Simple and expert UI

Native shell opens a connect-focused layout. Expert mode adds split tunnel, Gateway DNS, kill switch, diagnostics, and a live warp-cli console.

🖥️

PyQt6 tray on Linux

StatusNotifierItem on KDE Plasma embeds the full Web UI. thirdflare --no-open runs API-only when you do not need the panel.

🔒

Always On (opt-in)

nftables kill switch blocks leaks if WARP drops. Off by default; enable from Settings when you want Windows-style Always On on Linux.

Before you start

Install Cloudflare WARP and register with warp-cli. ThirdFlare One wraps that install — it is not affiliated with Cloudflare.

Install and launch ​

bash
git clone https://github.com/bodencrouch/thirdflare-one.git
cd thirdflare-one
./thirdflare-one install
thirdflare --version   # 0.2.7+
thirdflare             # tray + native panel on Linux

User install path: ~/.local/share/thirdflare-one · CLI symlinks in ~/.local/bin

Verify after reinstall:

bash
npm run verify:install

App routing in three steps ​

The Split Tunnel page includes an App routing panel:

  1. Turn on app routing — sets MASQUE + local proxy mode (enableLocalProxy).
  2. Choose an app — dropdown of .desktop entries on your system.
  3. Create WARP shortcut — launches that app through 127.0.0.1:40000.
bash
# Same flow from the API
curl -X POST http://127.0.0.1:4173/api/action \
  -H 'Content-Type: application/json' \
  -d '{"action":"enableLocalProxy"}'
curl -s http://127.0.0.1:4173/api/apps | jq

Real warp-cli reports proxy mode as Mode: WarpProxy on port 40000 — ThirdFlare normalizes that for the UI. See WARP internals.

API-only and automation ​

bash
thirdflare --no-open
curl -s http://127.0.0.1:4173/api/health | jq
curl -s http://127.0.0.1:4173/api/snapshot | jq '.status, .settings.Mode'

Default HTTP port is 4173 (launcher tries up to 30 ports if busy). Confirm with thirdflare --status or GET /api/config.

Pick your surface ​

GoalEntry
Daily desktop (KDE)thirdflare → left-click tray
Browser UITHIRDFLARE_WEBUI=1 or enable in Settings → http://127.0.0.1:4173
Scripts / CIAPI cookbook
Packages./thirdflare-one build appimage
Plasma network listNetworkManager profiles

Web UI is off by default in the systemd user unit.

What ships in 0.2.7 ​

  • Guarded warp-cli bridge (/api/snapshot, /api/action)
  • Account / Zero Trust registration UI (/api/account)
  • Split tunnel guides, route lists, and app routing shortcuts
  • Expert log dock with warp-cli command history (/api/logs)
  • Kill switch with polkit helper (opt-in)
  • Client updates (stable/beta) from GitHub releases
  • AppImage, deb, rpm, Flatpak, Snap, Homebrew tap

Documentation map ​

Unofficial client — not affiliated with Cloudflare.

ThirdFlare One contributors · MIT