Why Mistgate
Mistgate is for people who run a VPN for others: family, friends, a community or a small team. You install one panel, add servers to it, and send each person a link. The panel then keeps the servers configured and checked.
One link per person, several protocols. Apps on the Clash/Mihomo core (kl!ck, FlClash, Clash Verge Rev) get the Hysteria2, VLESS and AmneziaWG servers from the same link, so when one protocol is blocked on someone's network, the other is already in their app. Happ gets the Hysteria2 and VLESS servers; AmneziaVPN gets a key per device from the person's page. Client apps
VLESS REALITY, hidden behind a real site. VLESS runs over TCP, with XHTTP or with RAW and Vision, or over TLS with XHTTP or WebSocket, direct or behind a CDN, and works on networks that throttle UDP. Anyone who is not a client sees a real site: by default the node's own, with its own Let's Encrypt certificate, or another site you name. Hysteria2 and VLESS can share a node, TCP 443 included. Check ports on the node page tests from another node whether a TCP port reaches Mistgate itself. VLESS REALITY · VLESS and Hysteria2 on one node
Add a server from the browser. Type its IP and root password. The panel pins the SSH host key, checks the server, opens the ports in an active UFW or firewalld, installs the signed agent and waits for it to connect. The node gets its Let's Encrypt certificate itself, and Enable WARP gives it a Cloudflare exit. Install a node over SSH
You find out first. Every 5 minutes the panel connects to every server the way an app does and loads a test page through the tunnel. On each node a doctor runs 17 host checks (disk, journal, resolver, clock, ports, BBR) and offers six fixes that run only after you confirm. Warnings go to Telegram. Optionally, the panel also checks whether each node is reachable from Russia: through Globalping probes there, against public block lists, and from one of your own nodes inside Russia. Each source is off by default. Health · Reachability
Light and hidden. Two static Go binaries, one for the panel and one for the node agent. SQLite and systemd: no Docker, no database server. On a small test server (1 vCPU / 1 GB) the panel alone idles at 16-20 MiB of private memory (3x-ui 68-74, PasarGuard 262-265, Remnawave 426-454); panel, node and database together on one 2 vCPU / 2 GB server take 57 MiB (the same three: 74, 297 and 761). In that test, adding and removing users and restarting the panel dropped no connections, while 3x-ui restarts its core when users change. A stranger who opens the panel's address sees a decoy site; the admin sits behind a secret path or host name. Releases are reproducible and signed offline, and nodes install only signed builds. Torrent protection blocks plaintext BitTorrent on the node; its events keep what matched and the destination port, and no address leaves the node. Security · Releases and signing · Benchmarks, including where Mistgate is slower
Let your AI agent help. The panel has a built-in MCP server. Claude Code, Codex or another agent reads the fleet and changes it through plan → apply. Installing a node, a doctor fix or a server password change waits until you approve it in the admin. Agents never receive subscription links, device keys or passwords. AI agent guide · MCP
Coming soon, not in a release yet: a full Telegram bot for the fleet and for users. The edition of the panel that runs on Cloudflare Workers is in the releases since v0.1.36 (six Workers since v0.1.41) as a preview and has not run on a real Cloudflare account yet.
Screenshots
The screenshots use invented demo data.
Quick start
You need a fresh Linux server (amd64 or arm64) with systemd, a domain that points directly at it (here panel.example.com), TCP ports 80 and 443 free, and either openssh-client with ssh-keygen -Y verify support or OpenSSL 3.2 or newer. On the server, run:
curl -fsSL https://mistgate.app/install.sh | sudo bash -s -- --public-url https://panel.example.com
The installer verifies the signed panel manifest, runs setup and starts Mistgate under systemd. It prints the admin URL and a one-time setup link that expires in 30 minutes. It does not change firewall rules. Add --yes for a non-interactive run or --dry-run to verify the release without changing the server. See Install the panel for manual installation and the other options.
Then:
- Open the setup link and create the owner: a passkey, or a password with an authenticator code.
- Add servers in Nodes → Add node, over SSH or with a one-time command (Add a node).
- Follow First users. Install the panel also covers manual installation, the hidden admin host, your own certificate and your own decoy site.
Or let an AI agent install it. Claude Code, Codex CLI or any agent that can run ssh on your computer can do the steps above: copy the install prompt from the AI agent guide. It asks before every change, and you create the owner account yourself.
Compared with other panels
¹ Private memory of the whole panel group, idle, 0 to 200 users, no node attached, on a 1 vCPU / 1 GB test server (3x-ui includes its Xray core and fail2ban). Method, versions and limits: Benchmarks. "?" means the project's own README and docs do not say.
Others are ahead in protocol breadth, community size and full Telegram bots. The full table with sources, checked on 2026-10-09, is in Comparison with other panels.
Status and roadmap
Mistgate is in beta. The latest release runs in production. Until 1.0 the API, the stored settings and the node protocol may still change. Linux binaries for amd64 and arm64 are on GitHub Releases.
Next: the first run of the Cloudflare Workers edition (a preview) on a real account and bringing it on par with the VPS panel; later a Telegram bot for the fleet and for users. Some defaults lean towards users in Russia (Yandex DNS for nodes in Russia, the doctor's control domains, split-DNS presets); all of them are settings. Details and the known limits: Status and roadmap.
Documentation
Everything is at mistgate.app, and the same pages are in docs/. Good places to start:
- Overview and Requirements
- Install the panel, Install a node over SSH, First users
- Health, Updates, Encrypted backups, Troubleshooting
- CLI, API, MCP, Architecture
Contributing
Bug reports, fixes and documentation are welcome. CONTRIBUTING.md has the build, the code map, the checks CI runs and the conventions. Coding agents start with AGENTS.md; the AI agent guide has a ready prompt for contributing.
Security
Report vulnerabilities privately: see SECURITY.md. Back up the panel's data directory (/var/lib/mistgate): it holds the database, the master key and the CA your nodes trust. Encrypted backups to Cloudflare R2 do this on a schedule.
Licence
Mistgate is free software under the GNU Affero General Public License v3.0 only. If you run a modified panel for others, its admin shows a "Source code" link (serve --source-url) that should point to your source.