System-wide transparent proxy on Xray-core / sing-box for rooted Android, Linux and Windows.
- Android: a Magisk / KernelSU / APatch module. It runs the core as a root daemon and routes
traffic with
iptables/ip rule, not throughVpnService. - Desktop: a Tauri 2 app that brings up a real TUN. Proxy-only, system-proxy and PAC modes are also available.
Both run the same Rust backend and the same React UI.
Note
This is a fork of vincentng295/Magic_V2Ray. Most of the code was written by AI, so review it before you trust it.
- Two cores. Xray-core and sing-box, picked per profile. Supported protocols are VLESS, VMess, Trojan, Shadowsocks, SOCKS, HTTP, WireGuard, Hysteria2, TUIC, AnyTLS, Naive and ShadowTLS.
- Import. Subscription URLs, share links, mixed text and QR codes, plus Happ's
happ://add,happ://routingand encryptedhapp://crypt…crypt5links, and Incy's encryptedincy://crypt1links, pasted or scanned. An encrypted link is kept as given and decrypted on each update; an Incy link also names the subscription after its provider. - Subscriptions. Groups of servers that can be updated in one tap, or in the background with no UI open.
- Happ-compatible subscriptions, decoded by happ-sub:
- the provider's title, traffic and expiry, announcements and update interval, from headers and
#key:directives; - requests that identify like Happ (User-Agent, HWID, device headers): Android Happ on a phone, Happ desktop on Linux; editable per subscription or in Settings;
- or, per subscription, like Incy (its User-Agent,
x-headers and device ID; Incy desktop on Linux), the default for a subscription added from anincy://link; - changes the provider proposes (a new URL or domain, a fallback URL, routing profiles, tunnel tweaks) apply only after you review and accept them;
- JSON bodies: full Xray configs, once you allow them, keep only their outbounds and routing; sing-box configs become regular profiles.
- the provider's title, traffic and expiry, announcements and update interval, from headers and
- Honest status. An end-to-end probe tells connected apart from no internet and failed.
- Diagnostics. TCP ping, real ping and a speed test for each profile.
- Per-app routing on Android, plus a choice of TUN engine: tun2socks, hev-socks5-tunnel or sing-box.
- The root daemon is not killed by the low-memory killer, so the tunnel does not drop and leak your IP.
- Traffic is intercepted in the kernel (Netfilter) and never passes through a user-space
tun0. - Switching between Wi-Fi and mobile data reapplies the routing rules on the fly.
Tip
No root? Use an ordinary client from the Xray-core GUI list.
Download the file for your platform from the latest release.
| Platform | File | Notes |
|---|---|---|
| Android (root) | kasumi-proxy-module-vX.Y.Z.zip |
Flash it in Magisk / KernelSU / APatch, then reboot. Open the UI with the module's Action button or its WebUI entry. |
| Linux | .deb, .AppImage |
Asks for pkexec / sudo to set up the TUN and routes. |
| Linux, portable | kasumi-proxy-linux-portable-vX.Y.Z.zip |
Unzip and run ./kasumi-desktop. All state stays next to the binary. |
| Windows | -setup.exe, .msi |
Needs administrator rights (UAC) for the TUN. |
| Windows, portable | kasumi-proxy-windows-portable-vX.Y.Z.zip |
Unzip and run kasumi-desktop.exe. |
| Nix / NixOS | — | See docs/nix.md. |
On Android, state and logs live in /data/adb/kasumi-proxy/.
Verifying the AppImage signature
AppImages are signed with the key in release-signing-key.asc
(2AA0 03A9 D670 653C FAA8 F7B0 88BE 4761 6D49 65E9):
gpg --import release-signing-key.asc
./Kasumi*.AppImage --appimage-extract '.appimage_signature'
gpg --verify squashfs-root/.appimage_signature Kasumi*.AppImageBuild steps, checks and the repository layout are in CONTRIBUTING.md. Nix is
optional: plain cargo and bun are enough.
Kasumi Proxy ships prebuilt binaries from Xray-core, sing-box, tun2socks and hev-socks5-tunnel. See module/bin/README.md for their licenses.