Krab

A cross-platform desktop V2Ray/proxy client. Wails 3 + Go backend, React/Tailwind frontend, xray-core embedded as a Go library.

Forked from freeb5d/kite.

Download · Features · Building from source · Architecture

English · 中文

---

Downloads

Grab the latest build from the Releases page:

Platform	Download
Windows (x64)	krab-windows-amd64.exe
Linux (x64)	krab-linux-amd64
macOS (Apple Silicon)	krab-macos-arm64.dmg

Windows and Linux ship as portable executables; macOS ships as a DMG containing the Krab app bundle. No administrator rights are required for proxy mode. See Known gaps for unsigned-app warnings. Once installed, Krab checks for new releases on startup and can update itself in one click.

Features

• Link formats: vmess://, vless://, trojan://, ss://, hysteria2://, ssh:// — paste a share link and it's parsed and saved
• Subscription URLs — paste an http(s):// subscription link (the base64 link-list format used by V2RayN/V2RayNG/Shadowrocket) and every server it contains is imported at once, folded into one collapsible group in the list (subscriptions can carry hundreds of servers). The group shows plan/traffic/expiry info when the provider reports it (via the Subscription-Userinfo header, or the fake "info" entries some providers mix into the link list), and has its own buttons to sync, share (copy the subscription URL, or every server as a plain link list), edit (rename / change URL), and remove it. Besides the usual base64 link list, Clash/Mihomo YAML, sing-box JSON, Xray JSON and Shadowsocks SIP008 subscriptions are understood too, and subscriptions auto-sync on launch when the provider's Profile-Update-Interval has passed
• Share any server — copies its standard vless:// / vmess:// / trojan:// / ss://, hysteria2://, ssh:// link for use in another client
• xray-core, embedded as a Go library (not a shelled-out binary) — full lifecycle control and real traffic stats, no parsing stdout
• Transports: TCP (including headerType=http), WebSocket, gRPC, mKCP, HTTPUpgrade, XHTTP and HTTP/2, with TLS, REALITY, ECH and certificate pinning
• Outbound routing rules — attach independent block, proxy and direct rule groups to each server. Domain, IP/CIDR, geosite: and geoip: matches are supported, with deterministic priority: block first, proxy second, direct last
• System proxy integration — separately configure HTTP, HTTPS and SOCKS5 endpoints, then explicitly apply or clear the OS proxy. Terminal proxy environment variables can be copied with one click
• GeoData and DNS settings — manage geoip.dat / geosite.dat, custom hosts and upstream DNS servers from the UI
• TUN mode (Windows) — routes all system traffic through a virtual network adapter (xray-core's TUN with the bundled WinTun driver), instead of just apps that honor a proxy setting. Works with every server type, including headerType=http. DNS goes through the tunnel too. Needs administrator privileges; Krab can relaunch itself elevated with one click
• Kill switch (Windows) — blocks all outbound traffic except Krab's own while connected, by switching Windows Firewall's default outbound policy to block, so an app that ignores the system proxy (or a crashed xray process) can't leak traffic outside the tunnel. Same admin requirement as TUN mode
• System tray — closing the window hides it to the tray instead of quitting, so an active connection keeps running; the tray menu has Show Krab, Disconnect, and Quit Krab
• Launch at login — optional native startup registration on macOS, Linux and Windows
• Built-in diagnostics — a Test button makes a real request through the tunnel and reports the actual result; a log viewer surfaces xray-core's own debug log inline
• Traffic history — live upload/download counters plus persistent daily and per-server totals
• Self-updating — checks GitHub Releases on launch, one click downloads, swaps, and relaunches (About panel shows both Krab's and the embedded xray-core's version)
• Dark / light themes, with a searchable server list, inline rename, and one-click remove
• 2 languages, switchable from the sidebar:
  • 🇬🇧 English (default)
  • 🇨🇳 中文 (Chinese)
• SQLite persistence — profiles, application settings, outbound rules and traffic history live in ~/.krab/krab.db

Building from source

One-time toolchain setup

1. Go 1.27+ — https://go.dev/dl/. Windows also needs a C compiler for CGO (Wails 3 and some of its dependencies use it) — install TDM-GCC or winget install -e --id GoLang.Go plus MSYS2's mingw-w64-x86_64-gcc.
2. Node.js (LTS) — https://nodejs.org, or winget install OpenJS.NodeJS.LTS.
3. Wails 3 CLI:

   go install github.com/wailsapp/wails/v3/cmd/wails3@latest
   wails3 doctor   # confirms platform dependencies (WebView2 etc.) are present

4. Linux desktop libraries (Ubuntu 24.04):

   sudo apt-get install libgtk-4-dev libwebkitgtk-6.0-dev build-essential pkg-config

Run it

go mod tidy                     # resolves dependencies into go.sum
corepack enable
cd frontend && pnpm install && cd ..
wails3 dev                      # generates frontend/bindings/* and starts hot reload

Build a release binary

wails3 build

Architecture

krab/
├── main.go / app.go        Wails 3 entrypoint + the App struct (Go methods
│                            exposed to the frontend via the JS bridge)
├── internal/
│   ├── database/             SQLite storage at ~/.krab/krab.db
│   ├── xray/                 xray-core lifecycle
│   │   ├── manager.go         Start/Stop a core.Instance (proxy or TUN mode),
│   │   │                      traffic counters from xray's stats.Manager
│   │   ├── config.go          Server profile -> xray-core JSON config
│   │   └── tun_windows.go     Writes the embedded wintun.dll next to the
│   │                          exe (TUN mode needs it alongside the binary)
│   ├── system/                per-OS HTTP/SOCKS system proxy toggling,
│   │                          launch-at-login and TUN support (Windows)
│   │   ├── proxy_windows.go   HKCU Internet Settings (no admin needed)
│   │   ├── proxy_darwin.go    networksetup
│   │   ├── proxy_linux.go     gsettings (GNOME)
│   │   ├── autostart_*.go     native launch-at-login registration
│   │   ├── elevate_windows.go Check/request administrator privileges
│   │   ├── route_windows.go   Exception route so xray's own upstream
│   │   │                      connection doesn't loop through the TUN
│   │   │                      adapter it's feeding (see that file's docs)
│   │   └── wintun/            Embedded Wintun driver DLL (dual GPLv2/MIT,
│   │                          see WINTUN_LICENSE.txt in that directory)
│   └── update/                self-update: check GitHub Releases, download
│                               + swap the running executable, relaunch
├── pkg/
│   ├── profile/               Profile models, parsing and SQLite storage
│   ├── xrayconf/              Shared xray-core configuration builder
│   ├── certpin/               TLS certificate pin resolution
│   ├── probe/                 TCP, HTTP and real-delay checks
│   └── sshbridge/             Local SOCKS-to-SSH bridge
├── frontend/                 Vite + React + Tailwind (CSS-variable theming
│                              for dark/light), talks to app.go via Wails 3
└── .github/workflows/         CI: builds + publishes GitHub Releases on
    release.yml                 any pushed `v*` tag

Every bound Go method on App (in app.go) becomes a callable JS function in the frontend once wails3 generate bindings creates frontend/bindings/github.com/krabt/krab/app.js.

Known gaps / next steps

• macOS is Apple Silicon (arm64) only — no Intel build. If that's needed, add a darwin/amd64 matrix entry in .github/workflows/release.yml alongside the darwin/arm64 one.
• TUN mode is Windows-only and IPv4-only for now — the exception route that keeps the engine's own upstream connection from looping through the TUN adapter (internal/system/route_windows.go) only covers resolved IPv4 addresses; a server that's only reachable over IPv6 won't work in TUN mode yet. Linux/macOS TUN support is possible (xray-core's TUN supports both) but the routing setup isn't wired up here.
• Linux system proxy only covers GNOME (gsettings) — other desktop environments need their own backend in internal/system/proxy_linux.go.
• Kill switch is Windows-only — implemented via netsh advfirewall rules (internal/system/killswitch_windows.go); Linux/macOS need their own backend (iptables/pfctl) and are unimplemented for now (the toggle is hidden there, same as TUN mode).
• The native minimize button still just minimizes to the taskbar — closing the window hides it to the tray, while minimizing keeps the normal platform behavior.
• No code-signing — Windows SmartScreen and macOS Gatekeeper will both warn on an unsigned binary; this is expected for now. On macOS, running the downloaded binary the first time may require right-clicking Krab in Applications and choosing Open to get past Gatekeeper, since it isn't notarized. On Windows, antivirus software (including Defender) sometimes quarantines wintun.dll right after Krab writes it next to itself for TUN mode, since a kernel-adjacent networking DLL like this gets flagged heuristically — the same thing WireGuard, v2rayN, and other Wintun-based apps run into. If TUN mode fails with a file-not-found-style error, add Krab's folder to your antivirus's exclusions.

Contributing

Issues and PRs welcome. See Known gaps above for what's actually left to do.

License

MIT