![]()
Secure by Design · Light by Nature · Beautiful by Choice
A Mihomo GUI.
5 minutes to get started:
That's it. Your traffic is now routed through the selected proxy.
Transparency Notice: All content in this project is AI-generated (including this text). Security measures are implemented—see Security Design—but should not be assumed to be fully verified. Please assess risks before use. Security issue reports are welcome.

More Screenshots
| Dark Mode | Settings |
|---|---|
![]() |
![]() |
Zephyr was born from frustration. Every Mihomo GUI I found looked like a temporary tool. So I vibe coded one.
Visual Experience. Frosted glass cards. Gradient icons. Dark mode. Animation details. Typography that breathes. A proxy client that feels designed, not assembled.
Security Boundaries. Explicit constraints on subscriptions, configs, scripts, files, updates, and deep links. Defense in depth.
Rule Capabilities. Prism Engine brings declarative rule patches, smart node selection, and script sandbox. More power, less complexity.
See FEATURES.md for the complete feature list.
Zephyr is gaining attention from developers and users.
<img alt="Star History Chart" src="https://api.star-history.com/chart?repos=Juwan-Hwang/Zephyr&type=timeline&legend=top-left" width="450" />
Zephyr includes a rule engine based on clash-prism-* crates to enhance Mihomo configuration:
| Feature | Description |
|---|---|
| Declarative Rule Patches | .prism.yaml supports $prepend, $append, $filter, $override, and __when__ conditions |
| Rule Library Management | CRUD operations, grouping, import, auto-apply, file watching |
| Smart Node Selection | EMA scoring and adaptive scheduling based on latency, success rate, stability |
| Failover | Automatic node switching on failure, with thresholds, cooldown, and rollback strategies |
| Script Sandbox | QuickJS execution environment with time, memory, string length, loop, and recursion limits |
| Plugin System | Plugin discovery, loading, lifecycle hooks, and fine-grained permission control |
| KV Storage | Persistent key-value storage capabilities |
Zephyr implements defense-in-depth security measures:
| Layer | Protection | Implementation |
|---|---|---|
| Encryption | Machine-bound encryption | Hardware fingerprint-derived keys for subscription metadata; proxy configs support optional encryption (v2.3.7+) |
| Network | SSRF Protection | DNS validation before subscription/rule URL downloads; redirects to private addresses blocked |
| Network | DNS Leak Prevention | TUN mode auto-injects dns-hijack, capturing all DNS traffic to Mihomo |
| Config | Config Sanitization | Recursive removal of dangerous YAML fields, provider path traversal limits |
| Script | Permission Control | Script execution constrained by resource limits and permission restrictions |
| Input | Input Validation | IPC command entry points with length, format, and UTF-8 safety checks |
| Rate Limit | Dual Rate Limiting | Fixed cooldown for standard commands + sliding window for Prism commands |
| File | File Security | Secure permissions, UUID temp files, archive path traversal protection, symlink rejection, zip bomb detection |
| Update | Update Integrity | SHA256 verification + Minisign Ed25519 signature verification, trusted host restrictions, atomic updates with auto-rollback |
| Deep Link | Deep Link Security | Restricted clash:// protocol entry points and URL schemes |
| Build | CSP & Hardening | Limited script and connection sources; release builds with LTO, strip, panic=abort |
clash:// deep link subscription import/etc/sysctl.d/| Layer | Technology | Description |
|---|---|---|
| Desktop Framework | Tauri v2 | Lightweight desktop application framework |
| Backend | Rust 1.92+ | IPC, system integration, core management, security boundaries |
| Frontend | Native JavaScript | No frontend framework dependencies |
| Styling | Tailwind CSS v4 | Modern atomic CSS system |
| Editor | CodeMirror 6 | Prism DSL editing experience |
| Rule Engine | clash-prism-* | Rule patches, plugins, script sandbox, smart selection |
| Package Manager | pnpm workspace | apps/* + packages/* monorepo |
| Proxy Core | Mihomo | Clash Meta core |
| Platform | Minimum Version |
|---|---|
| Windows | Windows 10 1809+ |
| macOS | macOS 10.15 (Catalina)+ |
| Linux | glibc 2.31+ (Ubuntu 20.04+, Debian 11+, Fedora 34+) |
Hardware: ~300MB RAM, ~50MB disk space (Full version)
Get the appropriate package from GitHub Releases.
| Type | Description | Use Case |
|---|---|---|
| Full | Includes Mihomo core and GeoIP/GeoSite data | First-time install, offline use |
| Lite | Smaller size, no core resources | Already have local core resources |
| Portable | Unzip and run, data stored in program directory | USB drive use, multi-device use |
Zephyr-windows-portable.zip or Zephyr-linux-portable.tar.gz.portable in the directory (or it will be auto-created on first run)Portable Limitations: No auto-start on boot or in-client updates. See PORTABLE.md for details.
pnpm install
pnpm run dev
pnpm run build
pnpm run typecheck
pnpm run test
pnpm run lint
pnpm run check:i18n
Desktop package commands:
pnpm --filter @zephyr/desktop typecheck
pnpm --filter @zephyr/desktop test
pnpm --filter @zephyr/desktop lint
pnpm --filter @zephyr/desktop build:css
Rust-side verification:
cd apps/desktop/src-tauri
cargo check
cargo test
cargo clippy --all-targets --all-features
.
├── apps/
│ └── desktop/ # Tauri desktop application
│ ├── src/ # Native JS frontend, styles, UI modules
│ └── src-tauri/ # Rust backend, IPC, system integration, Prism capabilities
├── packages/
│ ├── shared/ # Frontend shared code
│ └── scripts/ # Project scripts, e.g., i18n check
├── FEATURES.md # Current feature list
├── package.json # Workspace root scripts
└── pnpm-workspace.yaml # pnpm workspace configuration
Is it safe to use?
Zephyr implements defense-in-depth security: SSRF protection, script sandboxing, update integrity verification, and more. The codebase is scanned by CodeQL and Semgrep in CI. See Security Design for details.
However, all content is AI-generated. Security, stability, and performance should not be assumed to be fully verified—please assess risks before use. If you discover security issues, please refer to SECURITY.md.
Will my PR be merged?
This project serves personal use cases first. PRs are not guaranteed to be merged. If you have different needs, forking and modifying directly is usually faster.
What's the difference between Full and Lite?
Full includes Mihomo core and GeoIP/GeoSite data—ready for first-time install or offline use. Lite is smaller but requires existing local core resources.
Note: This project serves personal use cases first. PRs are not guaranteed to be merged. For specific needs, forking is often faster.
Welcome contributions:
This project uses MIT License.
Conjured by Juwan
$ claude mcp add Zephyr \
-- python -m otcore.mcp_server <graph>