Protocol Overview

MeowX reads proxies from the proxies: list of a configuration file that is compatible with the mihomo / Clash Meta format. Each entry is one node; its type decides which protocol is used and which other fields are read. Fields MeowX does not understand are silently ignored, so a subscription written for mihomo usually imports as-is.

This page is the map. Each protocol has its own page with a full parameter table.

Support matrix

“UDP” means the node can relay UDP traffic at all. “Full-cone” means one UDP session can talk to many destinations through the same node and receive replies from any of them (needed for games, voice calls and P2P apps that are picky about NAT type). When a node cannot carry UDP, what happens depends on the outbound mode. In Rule mode, a rule whose target can’t carry UDP is skipped for UDP traffic and matching continues with the next rules (usually ending at MATCH, which may send it DIRECT) — the same behavior as mihomo. In Global mode the UDP traffic is dropped, so apps fall back to TCP where they can (for example, QUIC falls back to HTTPS over TCP).

Protocol	type	TCP	UDP	Full-cone UDP	Transports / security layers	dialer-proxy
Shadowsocks	ss	✅	with udp: true	✅	AEAD and 2022 ciphers; plugins obfs (http / tls) and shadow-tls (v3)	✅ (TCP only)
VMess	vmess	✅	with udp: true	with packet-encoding: xudp	TLS, REALITY; ws, grpc, xhttp	✅
VLESS	vless	✅	with udp: true	with packet-encoding: xudp (not with Vision)	TLS, REALITY, XTLS Vision, VLESS encryption; ws, grpc, xhttp	✅
Trojan	trojan	✅	with udp: true	✅	TLS (on by default), REALITY; ws, grpc, xhttp	✅
AnyTLS	anytls	✅	✅ (always)	✅	Always TLS, or REALITY; multiplexed sessions	✅
Hysteria 2	hysteria2	✅	✅ (always)	✅	QUIC; Salamander obfuscation; port hopping	❌
WireGuard	wireguard	✅	✅ (always)	✅	WireGuard over UDP	❌
Mieru	mieru	✅	✅ (always)	✅	TCP or UDP transport; port ranges	✅ (TCP transport only)
Snell	snell	✅	with udp: true	✅	Versions 4, 5, 6; obfs http / tls and ShadowTLS v3 (v4 / v5)	✅
Miu	miu	✅	✅ (always)	✅	TLS or REALITY outer layer; connection pool	✅
SOCKS5	socks5	✅	with udp: true	✅	Plain TCP, optional username / password	✅ (TCP only)
HTTP	http	✅	❌	❌	HTTP CONNECT, optional TLS	✅

Notes on the table:

• “with udp: true” — these protocols relay UDP only when the node sets udp: true. The default is false.
• “always” — these protocols always carry UDP; the udp field is not consulted.
• dialer-proxy “TCP only” — the node itself works through a dialer proxy, but its native UDP (which uses a separate UDP socket to the server) is turned off, because that cannot travel through a TCP chain. Protocols that carry UDP inside their TCP stream (VMess, VLESS, Trojan, AnyTLS, Snell, Miu) keep UDP when chained. See Chained proxies.
• Transport names (ws, grpc, xhttp) are values of the network field; see Transports. TLS and REALITY options are shared and documented in TLS and REALITY.

Not supported

The following proxy types are not supported. A node with one of these types is skipped with a warning; the rest of the configuration still loads.

type	Status
tuic	Recognized but not implemented. The node is accepted at import (it must still have a password) and skipped when the connection starts.
ssr (ShadowsocksR)	Not supported.
hysteria (Hysteria v1)	Not supported. Use hysteria2.
ssh	Not supported.
direct, dns (mihomo’s special proxy entries)	Not supported as proxy entries. Use the built-in DIRECT target in groups and rules instead. Such entries usually have no server / port, and every proxy entry needs both, so leaving them in makes the whole configuration fail to load. Remove them.
Any other value	Skipped with a warning.

Some features of supported protocols are also unavailable, for example Shadowsocks stream ciphers and v2ray-plugin, VMess legacy (non-AEAD) authentication, the h2 / httpupgrade transports, Snell versions 1–3 and Mieru multiplexing. Details are on each protocol’s page and in Unsupported features.

proxy-providers are not read. Nodes must be listed directly under proxies: (subscriptions from most providers already do this).

Common fields

These fields are read the same way for every proxy type.

Field	Type	Required	Default	Description
name	string	yes	—	Node name, used to reference the node from proxy groups, rules and dialer-proxy. Must be unique across all proxies and proxy groups, and must not be one of the built-in names DIRECT, REJECT, REJECT-DROP, PASS, COMPATIBLE.
type	string	yes	—	Protocol, one of the type values in the matrix above. Leading and trailing spaces are ignored, and it is case-insensitive.
server	string	yes	—	Server domain name or IP address.
port	integer	yes	—	Server port (1–65535). Exceptions: a hysteria2 node may omit it when it sets ports, and a mieru node may omit it when it sets port-range.
udp	boolean	no	false	Allow UDP relay. Only read by ss, vmess, vless, trojan, snell and socks5; the other types decide by themselves (see the matrix).
dialer-proxy	string	no	—	Name of another proxy or proxy group. The connection to this node’s server is made through it instead of directly (a proxy chain). Not supported by hysteria2, wireguard, tuic, or mieru with the UDP transport. See Chained proxies.

Ignored common fields

These common mihomo fields are accepted but have no effect in MeowX: ip-version, tfo, mptcp, interface-name, routing-mark and smux. client-fingerprint is also ignored. See TLS and REALITY for what MeowX sends instead.

How invalid nodes are handled

MeowX tries hard not to reject a whole subscription because of one bad node. There are three levels:

1. The whole configuration is rejected (the import fails with an error) when the file itself is broken:
   • the YAML cannot be parsed,
   • a proxy is missing name, type, server or port,
   • two proxies or groups share a name,
   • a required protocol field is missing or empty (for example cipher for ss, uuid for vmess / vless, password for trojan / anytls),
   • a dialer-proxy names a proxy or group that does not exist, or proxies chain back to themselves.
2. The node is dropped with a warning at import when the protocol type is unsupported, or when the node uses an option MeowX cannot handle. Examples are an unsupported Shadowsocks cipher or plugin, an empty Shadowsocks password, a malformed Shadowsocks 2022 key, or an unsupported Snell version. The warning is shown after import, and the other nodes load normally.
3. The node is skipped when the connection starts for a few problems that are only detected when the node is built: a malformed uuid, a tuic node, or dialer-proxy on a protocol that cannot be chained. The reason is written to the app’s log page.

A few problems only show up when the node is actually used. Examples are an invalid REALITY public-key, or a VLESS encryption string MeowX cannot handle. The connection fails with an error that names the problem.