Leak Audit | socksy

socksy status tells you what socksy configured. socksy check tells you what actually happens:

socksy check              # human-readable audit
socksy check --json       # same result, for scripts and CI
socksy check --strict     # exit non-zero on warnings too, not just failures

socksy check (what actually happens, not what was configured)

  ✔ relay    listening on 127.0.0.1:1081
  ✔ bind     bound to 127.0.0.1, loopback only
  ✔ desktop  system proxy points at the relay (127.0.0.1:1081)
  ✔ exit     requests leave as 91.140.29.82
  ✔ leak     relay exits as 91.140.29.82; unproxied traffic would leave as 31.152.249.41
  ! ipv6     reachable directly as 2a02:1388:...; apps that ignore the system proxy leave over IPv6
  ! dns      Firefox is installed and will resolve names locally; fix with 'socksy dns on'
  ✔ geo      exit is in GR, matching the -country-GR tag
  ✔ bypass   only loopback and private ranges skip the proxy
  ✔ creds    read from a 600 config file, not from gost's command line

2 warning(s), 8 ok, nothing failed.

Each row is an independent probe, so one failure never hides the rest:

check	what it catches
`relay`	the relay is not accepting connections, so proxied apps fail closed
`bind`	the relay listens off loopback, i.e. anyone on your LAN can use your paid proxy
`desktop`	the system proxy is aimed somewhere other than the relay, so nothing reaches the exit
`exit`	the upstream is unreachable or the credentials are wrong
`leak`	requests leave from the same address with and without the proxy: traffic is not being proxied
`ipv6`	a working direct IPv6 route, which anything ignoring the system proxy can still leave by
`dns`	Firefox is set to resolve names locally, leaking every hostname you visit
`geo`	the exit is not in the country the username asked for
`bypass`	a no-proxy entry that is neither loopback nor private, so that traffic skips the relay
`creds`	the upstream password is on gost's command line, readable by any local user in `ps`

The exit status is non-zero if anything failed, which makes it usable as a gate:

socksy check --json --strict || notify-send "socksy: proxy posture degraded"

The three endpoints it probes (ip_url, ipv6_url, geo_url) are config keys, so you can point them at your own hosts instead of the public defaults.