Mistgate

Name: mistgate
Author: Mistgate

Your own VPN for your people, without babysitting servers.

For family, friends, a community or a small team.
Hysteria2, AmneziaWG and VLESS REALITY on your own servers: add a server from the browser, give each person one link, and hear about an outage first.

Docs · Install · Screenshots · Compare · Русский · 简体中文

_{Beta. Mistgate runs in production, but until 1.0 expect rough edges, and the API, the stored settings and the node protocol may still change. Status and roadmap}

The Mistgate admin: six nodes with their health and throughput, one open problem, recent events

Why Mistgate

Mistgate is for people who run a VPN for others: family, friends, a community or a small team. You install one panel, add servers to it, and send each person a link. The panel then keeps the servers configured and checked.

One link per person, several protocols.
Apps on the Clash/Mihomo core (kl!ck, FlClash, Clash Verge Rev) get the Hysteria2, VLESS and AmneziaWG servers from the same link, so when one protocol is blocked on someone's network, the other is already in their app. Happ gets the Hysteria2 and VLESS servers; AmneziaVPN gets a key per device from the person's page. Client apps

VLESS REALITY, hidden behind a real site.
VLESS runs over TCP, with XHTTP or with RAW and Vision, or over TLS with XHTTP or WebSocket, direct or behind a CDN, and works on networks that throttle UDP. Anyone who is not a client sees a real site: by default the node's own, with its own Let's Encrypt certificate, or another site you name. Hysteria2 and VLESS can share a node, TCP 443 included. Check ports on the node page tests from another node whether a TCP port reaches Mistgate itself. VLESS REALITY · VLESS and Hysteria2 on one node

Add a server from the browser.
Type its IP and root password. The panel pins the SSH host key, checks the server, opens the ports in an active UFW or firewalld, installs the signed agent and waits for it to connect. The node gets its Let's Encrypt certificate itself, and Enable WARP gives it a Cloudflare exit. Install a node over SSH

You find out first.
Every 5 minutes the panel connects to every server the way an app does and loads a test page through the tunnel. On each node a doctor runs 17 host checks (disk, journal, resolver, clock, ports, BBR) and offers six fixes that run only after you confirm. Warnings go to Telegram. Health

Light and hidden.
Two static Go binaries, one for the panel and one for the node agent. SQLite and systemd: no Docker, no database server. On a small test server (1 vCPU / 1 GB) the panel alone idles at 16-20 MiB of private memory (3x-ui 68-74, PasarGuard 262-265, Remnawave 426-454); panel, node and database together on one 2 vCPU / 2 GB server take 57 MiB (the same three: 74, 297 and 761). In that test, adding and removing users and restarting the panel dropped no connections, while 3x-ui restarts its core when users change. A stranger who opens the panel's address sees a decoy site; the admin sits behind a secret path or host name. Releases are reproducible and signed offline, and nodes install only signed builds. Torrent protection blocks plaintext BitTorrent on the node; its events keep what matched and the destination port, and no address leaves the node. Security · Releases and signing · Benchmarks, including where Mistgate is slower

Let your AI agent help.
The panel has a built-in MCP server. Claude Code, Codex or another agent reads the fleet and changes it through plan → apply. Installing a node, a doctor fix or a server password change waits until you approve it in the admin. Agents never receive subscription links, device keys or passwords. AI agent guide · MCP

Coming soon, not in a release yet: Xray JSON and sing-box subscriptions, and a full Telegram bot for the fleet and for users. The edition of the panel that runs on Cloudflare Workers is in the releases since v0.1.36 as a preview and has not run on a real Cloudflare account yet.

Screenshots

_{A node. Status, WARP exit, load and 24 hours of traffic.}	_{Client-eye checks. Every protocol on every node, latency through the tunnel.}
_{A person. Quota, term, devices and the traffic that counts against the quota.}	_{Their link in a browser. Days left, traffic and their servers.}

The screenshots use invented demo data.

Quick start

You need a fresh Linux server (amd64 or arm64) with systemd, a domain that points directly at it (here panel.example.com), TCP ports 80 and 443 free, and either openssh-client with ssh-keygen -Y verify support or OpenSSL 3.2 or newer. On the server, run:

curl -fsSL https://mistgate.app/install.sh | sudo bash -s -- --public-url https://panel.example.com

The installer verifies the signed panel manifest, runs setup and starts Mistgate under systemd. It prints the admin URL and a one-time setup link that expires in 30 minutes. It does not change firewall rules. Add --yes for a non-interactive run or --dry-run to verify the release without changing the server. See Install the panel for manual installation and the other options.

Then:

Open the setup link and create the owner: a passkey, or a password with an authenticator code.
Add servers in Nodes → Add node, over SSH or with a one-time command (Add a node).
Follow First users. Install the panel also covers manual installation, the hidden admin host, your own certificate and your own decoy site.

Or let an AI agent install it. Claude Code, Codex CLI or any agent that can run ssh on your computer can do the steps above: copy the install prompt from the AI agent guide. It asks before every change, and you create the owner account yourself.

Compared with other panels

	Mistgate	3x-ui	Remnawave	Hiddify	PasarGuard	s-ui
Runs without Docker	✅	✅	❌	✅	partial	✅
Database	SQLite	SQLite or PostgreSQL	PostgreSQL + Redis	MySQL + Redis	SQLite, MySQL, MariaDB or PostgreSQL	SQLite
Panel RAM, idle	16-20 MiB¹	68-74 MiB¹	426-454 MiB¹	not measured	262-265 MiB¹	not measured
One-line installer	✅	✅	❌	✅	✅	✅
Add a node from the panel (SSH)	✅	❌	❌	❌	❌	?
Hysteria2	✅	✅	partial	✅	✅	✅
AmneziaWG	✅ 2.0 and 3.1	✅ 3.1	?	?	?	?
VLESS REALITY	✅	✅	✅	✅	✅	?
VMess, Trojan, Shadowsocks	❌	✅	partial	✅	✅	✅
Xray JSON or sing-box subscriptions	soon	Xray JSON	✅ both	✅ both	sing-box	sing-box
Health checks and alerts	✅ client-eye checks, doctor with fixes	✅ tunnel monitor (opt-in)	✅ status, Prometheus	partial	partial	?
Telegram bot	alerts only, full bot soon	✅	partial	✅	✅	?
HWID device limit	device count only	✅	✅	?	✅	?
Built-in MCP server for AI agents	✅	?	❌	?	?	?

¹ Private memory of the whole panel group, idle, 0 to 200 users, no node attached, on a 1 vCPU / 1 GB test server (3x-ui includes its Xray core and fail2ban). Method, versions and limits: Benchmarks. "?" means the project's own README and docs do not say.

Others are ahead in protocol breadth, community size, HWID limits and full Telegram bots. The full table with sources, checked on 2026-10-09, is in Comparison with other panels.

Status and roadmap

Mistgate is in beta. The current release is v0.1.36, and it runs in production. Until 1.0 the API, the stored settings and the node protocol may still change. Linux binaries for amd64 and arm64 are on GitHub Releases.

Next: the first run of the Cloudflare Workers edition (a preview) on a real account and bringing it on par with the VPS panel, then Xray JSON and sing-box subscriptions; later a Telegram bot for the fleet and for users. Some defaults lean towards users in Russia (Yandex DNS for nodes in Russia, the doctor's control domains, split-DNS presets); all of them are settings. Details and the known limits: Status and roadmap.

Documentation

Everything is at mistgate.app, and the same pages are in docs/. Good places to start:

Overview and Requirements
Install the panel, Install a node over SSH, First users
Health, Updates, Encrypted backups, Troubleshooting
CLI, API, MCP, Architecture

Contributing

Bug reports, fixes and documentation are welcome. CONTRIBUTING.md has the build, the code map, the checks CI runs and the conventions. Coding agents start with AGENTS.md; the AI agent guide has a ready prompt for contributing.

Security

Report vulnerabilities privately: see SECURITY.md. Back up the panel's data directory (/var/lib/mistgate): it holds the database, the master key and the CA your nodes trust. Encrypted backups to Cloudflare R2 do this on a schedule.

Licence

Mistgate is free software under the GNU Affero General Public License v3.0 only. If you run a modified panel for others, its admin shows a "Source code" link (serve --source-url) that should point to your source.