VMess

VMess is the original V2Ray protocol. Each request is authenticated with the user’s UUID and the payload is encrypted. It is usually combined with TLS and a transport such as WebSocket so that it can sit behind a CDN or web server. MeowX implements VMess with AEAD header authentication, which is what current V2Ray / Xray servers use. UDP is supported, and with packet-encoding: xudp it is full-cone.

Examples

Minimal (plain TCP):

proxies:
  - name: vmess-basic
    type: vmess
    server: example.com
    port: 10086
    uuid: 00000000-0000-0000-0000-000000000000

WebSocket over TLS with UDP (all supported options):

proxies:
  - name: vmess-ws-tls
    type: vmess
    server: example.com
    port: 443
    uuid: 00000000-0000-0000-0000-000000000000
    cipher: auto
    udp: true
    packet-encoding: xudp
    tls: true
    servername: cdn.example.com
    alpn:
      - http/1.1
    skip-cert-verify: false
    network: ws
    ws-opts:
      path: /vmess
      headers:
        Host: cdn.example.com
    dialer-proxy: relay-group

Parameters

Field	Type	Required	Default	Description
`name`	string	yes	—	Node name.
`type`	string	yes	—	`vmess`
`server`	string	yes	—	Server domain or IP.
`port`	integer	yes	—	Server port.
`uuid`	string	yes	—	User ID. A standard UUID (32 hex digits, with or without hyphens), or any string of 1–30 characters, which is mapped to a UUID the same way Xray does.
`cipher`	string	no	`auto`	Body encryption: `chacha20-poly1305` (or `chacha20-ietf-poly1305`) selects ChaCha20-Poly1305. Any other value, including `auto`, `aes-128-gcm`, `none` and `zero`, selects AES-128-GCM.
`udp`	boolean	no	`false`	Relay UDP.
`packet-encoding`	string	no	—	`xudp` enables full-cone UDP over XUDP. Any other value (or none) uses plain VMess UDP, one destination per stream.
`tls`	boolean	no	`false`	Wrap the connection in TLS. See TLS and REALITY.
`servername` / `sni`	string	no	`server`	TLS server name (SNI). If both are set, `servername` wins.
`alpn`	list of strings	no	—	TLS ALPN protocols.
`skip-cert-verify`	boolean	no	`false`	Accept any server certificate.
`reality-opts`	map	no	—	REALITY instead of TLS: `public-key`, `short-id`. See TLS and REALITY.
`network`	string	no	`tcp`	Transport: `tcp`, `ws`, `grpc` or `xhttp`. See Transports.
`ws-opts`	map	no	—	WebSocket options (`path`, `headers`). Also supplies the path for `xhttp`.
`grpc-opts`	map	no	—	gRPC options (`grpc-service-name`).
`dialer-proxy`	string	no	—	Connect to the server through another proxy or group.

About `cipher` and `alterId`

MeowX always uses the AEAD request header, which is the same as alterId: 0. alterId is not read. A server that only accepts legacy (MD5-based, alterId greater than 0) authentication will not work. Current Xray releases no longer support legacy authentication at all.

The body cipher is chosen by the client and announced in the request, and VMess servers accept whichever one the client picks. Mapping none / zero to AES-128-GCM therefore does not affect compatibility. It only means the payload is always encrypted.

Transports and security

TLS — tls: true. With a direct connection the system TLS stack is used; through dialer-proxy MeowX’s own TLS 1.3 client is used. See TLS and REALITY.
REALITY — add reality-opts with a public-key.
Transports — ws, grpc and xhttp. h2 and httpupgrade are not supported. See Transports.

UDP

UDP requires udp: true.

Without packet-encoding, each UDP flow opens its own VMess stream bound to one destination. This works with every VMess server, but it is not full-cone.
With packet-encoding: xudp, one VMess stream carries datagrams for many destinations and replies from any of them (full-cone NAT). The server must support XUDP (Xray and current V2Ray-compatible servers do).

UDP keeps working when the node uses dialer-proxy, because VMess carries UDP inside its TCP stream.

Validation

Problem	Result
`uuid` missing or empty	The whole configuration is rejected.
`uuid` is not a valid UUID and not a 1–30 character string	The node is skipped when the connection starts (reason in the log).
`network` value MeowX does not know (for example `h2`, `http`, `httpupgrade`)	No warning. The node connects without any transport framing and will fail against such a server.