If your provider gives you a WireGuard config, you can route individual Mac apps through it. Here's the short version for each.
If your provider hands you a WireGuard config, VPNonly can route a single app through it. Most providers now have a dedicated walkthrough:
AirVPN's config generator (sign in first) builds a WireGuard .conf. Its configs include a preshared key, which VPNonly handles without any extra step.
A VPS with WireGuard costs a few dollars a month and gives you an exit IP nobody else shares. Use the client config you generated when you set the server up.
In VPNonly: open the ⋯ menu, choose Import WireGuard config…, and pick either a single .conf or the zip Mullvad gives you. The zip becomes one entry — pick a country from the menu at the bottom, the same way you would with NordVPN. Then flip the switch next to any app.
The exact privileged engine used by the app is public for inspection. The historical command-line prototype is retained on GitHub for reference, but it is not the current app engine.
Providers hand out wg-quick configs, which include Address, DNS and sometimes MTU lines. Plain wg setconf rejects those, so anything importing them has to strip them out and apply the address separately. If you're scripting this yourself, that's the first thing to get right.
Second: an IPv6-only config won't work with a tool that routes IPv4. Most provider configs include both, so this rarely comes up, but it's worth knowing if a config is refused.
The app’s exact privileged engine source is public and MIT licensed.