CCBaga: A Cross-Platform Toolkit for Claude Identities and Browser Checks
CCBaga combines encrypted local Claude identity archives, a fingerprinted companion browser, and system-region controls in a native macOS, Linux, and Windows toolkit.
Managing several local Claude Code or Claude Desktop setups can be risky: switching accounts may overwrite useful state, cleanup can remove more than intended, and browser or system settings may not match the region you selected. CCBaga brings these jobs together in a native desktop workflow, with explicit controls for what gets archived, what remains in the workspace, and which environment checks have actually passed.
The project is an independent, MIT-licensed Rust and Tauri application for macOS, Linux, and Windows. Its stated intended use is for people residing or traveling abroad to manage their own Claude identities; use that violates Anthropic’s terms of service is prohibited.
Two applications, with separate responsibilities
CCBaga is split into two cooperating apps. CCBaga-A manages local identities, system settings, and environment checks. CCBaga-B is a companion Fingerprint Chromium browser with a dedicated profile. Browser measurements return to the host through a local session, rather than giving the browser test page access to Tauri commands.
That separation matters: a configured setting and a verified result are not the same thing. CCBaga can apply a timezone or browser fingerprint, then measure what the browser and machine actually report.
The everyday workflow starts with a region selector and four common actions: clear browser cache, rotate the fingerprint, reset timezone and language, or archive the current identity. Advanced controls live in Network, Claude identities, Browser, and Computer. The interface supports English and Simplified Chinese; changing the UI language does not alter the computer or browser language.
Switch Claude identities without discarding the outgoing state
The identity manager handles the default local data directories for Claude Code and Claude Desktop. Every switch saves the outgoing identity before restoring a saved one or starting with an empty workspace. Before a switch, users can expand Keep in workspace to choose whether skills and commands, plugins, MCP configuration, personal settings, project records, conversation history, and caches or logs stay in place or move with the identity. Login data always travels with an archived identity.
Archives are compressed, authenticated, encrypted .baga containers stored outside Claude’s working directories. A local SQLite database tracks identity names, retention policies, and recovery state. CCBaga verifies an archive before changing the workspace; failed switches roll back, and interrupted switches expose a recovery path. Recovery itself first saves the pre-recovery state.
Saved identities can be exported and imported between devices running the same operating system. Exports are password-protected, and importing adds an archive without switching identities or overwriting existing accounts. Optional fingerprint settings can be included, but browser cookies, passwords, and proxy settings are excluded. The repository also describes encrypted device transfers and safety checks for identity backups.
There are important boundaries. Project source outside Claude’s own data directories is not scanned. Custom CLAUDE_CONFIG_DIR locations are not automatically included. Direct deletion of the selected current data creates no archive; deleting a saved card removes that archive. Both require explicit confirmation. Filesystem ownership or administrator access is not an absolute secrecy boundary, and expired or revoked server-side logins may still require authentication.
Measure the browser environment—not just its configuration
CCBaga’s browser checks cover network exit and estimated country, timezone, language, platform, CPU count, browser engine version, and location settings. The success page appears only when checks match, the report reaches the cleaner, and no measurement error remains.
The distinction between cache cleanup and a full reset is especially important. Clear cache retains sign-ins and personal browser data. Clear all browser data permanently resets the current identity’s entire browser profile, including saved passwords, encryption metadata, bookmarks, history, extensions, settings, and website sessions. It does not affect other identities’ profiles or the identity vault, and it requires separate confirmation without creating a backup.
A green result is limited evidence, not a promise of anonymity or account acceptance. DNS and WebRTC leak checks are not independently verified, and IP geolocation is an estimate from external services. Selecting a region changes language, timezone, and regional settings; it does not change the public IP. Fingerprint rotation closes and restarts CCBaga-B, so save unfinished browser work first.
Optional, approval-based network setup
The Network section offers a three-step guide—get a VPS, get a residential proxy, install the Skill—and a copyable prompt for a selected coding agent: General, Codex, Cursor, OpenCode, or Copilot. The separate ccbaga-network Skill follows the Agent Skills specification and can be installed with:
npx skills add liseami/CCBaga --skill ccbaga-network --global
The Skill supports authorized Debian 12 or 13 servers using root key login on port 22. Given a VPS address, matching PEM/PPK/PUB key files or a downloaded key bundle, and residential SOCKS5 connection details, it can configure Xray/Reality, check the SSH identity and fixed SOCKS5 exit, and provide a private local import file after server self-checks pass. Remote changes happen only after approval of the actual changes. Client setup uses TUN ON, System Proxy OFF, and an empty explicit browser proxy; TUN and browser behavior still need separate verification.
The subscription URL uses HTTP and contains credentials, so the project recommends preferring the file retrieved over SSH. The app itself does not collect SSH keys or proxy credentials and does not deploy to servers. Network setup is optional: local identity and browser maintenance does not require a VPS or proxy subscription. Data supplied to a coding agent is subject to that provider’s data-handling practices.
Installation and development
Official platform targets are macOS 12 or later on Apple Silicon, Linux x86_64, and Windows 10/11 x86_64. Intel Macs and Linux ARM64 are not supported. Linux builds include DEB, RPM, and AppImage packages built on Ubuntu 22.04 (glibc 2.35), plus a separate package for current Arch/pacman systems; the packages include the companion browser. Windows uses an NSIS installer containing both apps. It is not Authenticode signed and may trigger SmartScreen or be blocked by managed security policy.
On macOS, download the official CCBaga-<version>-macos-arm64.dmg. One disk image contains both CCBaga-A.app and CCBaga-B.app; there is no separate browser download. Drag both into Applications and launch CCBaga-A, which starts the companion browser.
For a macOS source build, the repository documents Bun, Rust, Xcode Command Line Tools, and a separately fetched browser engine. The fetch script downloads the pinned Fingerprint Chromium 148.0.7778.215 macOS arm64 engine, verifies its SHA-256, and preserves bundle structure and notices. A basic development sequence is:
bun install --frozen-lockfile
python3 scripts/fetch-browser.py
sh scripts/make-icons.sh
sh scripts/package-browser.sh
bun run tauri dev
Useful checks include bun run build, bun test, Rust tests via cargo test --manifest-path src-tauri/Cargo.toml, browser-signing tests, and offline Network Skill tests. The project’s CI runs frontend, native Rust, Skill, and installation checks on Ubuntu, macOS, and Windows. Its documented workflow uses a read-only token, no signing secrets, and no artifact uploads; full engine and installer validation happens separately.
CCBaga’s architecture combines Rust and Tauri 2 for native commands and transaction boundaries, React 19 and TypeScript for the UI, platform-specific bridges for operating-system integration, and a dedicated Chromium runtime for real browser readings. Its key design principle is observability with explicit boundaries: archive before switching, ask before destructive actions, distinguish applied settings from measured results, and make platform limitations visible rather than implying that every environment or account state is covered.