Manage every VPN from your terminal.
One dashboard for your xray proxy and every full-tunnel VPN on the machine — WireGuard, Outline, OpenVPN, Check Point… Auto-detected, grouped into cards, each with a live flag, ping and traffic. Connect or disconnect with a keypress.
brew install vpncli/tap/vpn Self-contained binary, no Node, no jq. Only the xray proxy needs the xray binary.
A full-tunnel VPN and xray, at the same time
Most VPNs are full tunnels — they grab the one OS default route, so all traffic goes through them and only one can run at a time. xray is a local proxy: it routes each connection by rules and never touches the routing table, so it layers on top of anything. Keep your work tunnel up and run a flexibly-routed xray over it.
api.openai.com your xray server *.ru — local sites direct everything else 🌐 ALL TRAFFIC Work VPN → Office Full tunnel
WireGuard, Outline, OpenVPN, Check Point… Rewrites the routing table, captures everything. Mutually exclusive — only one at a time.
xray proxy
A local SOCKS/HTTP proxy. Apps opt in; xray routes each connection by rules. Never touches routing — coexists with any tunnel.
- Full tunnels are mutually exclusive — connect one and vpncli drops the others for you.
- xray always layers on top — it's a proxy, it coexists.
- Every card is tagged 🌐 ALL TRAFFIC or ⚡ BY RULES, so you always know what grabs what.
Every VPN, one dashboard
xray servers and full-tunnel app-VPNs, auto-detected and grouped by type. No xray syntax to learn.
Every VPN, one screen
xray servers plus full-tunnel app-VPNs — auto-detected and grouped by type, each a card.
Tunnel vs proxy, marked
Full tunnels capture all traffic; xray routes by rules and coexists. Every card says which.
Connect / disconnect anything
Each service is a card; a master Disconnect all up top drops every tunnel and xray at once.
Subscriptions, no vendor app
Paste any subscription link — even a Happ / v2RayTun deep-link — and vpncli fetches the whole list. Open source (MIT): you control every line that runs, not an opaque client.
Live everything
Country flag (geo of the exit IP), latency, and live up/down traffic — per service, in real time.
xray routing, no syntax
A guided wizard plus toggleable presets — direct / proxy / block, validated before it applies.
Brings your VPNs together
vpncli auto-detects what's already installed and lets you drive it from one place.
Each up service shows its country flag, latency and live ↑/↓ traffic.
Check Point, without the clunky GUI
Corporate Check Point Endpoint Security usually means a heavy GUI plus a separate OTP app. vpncli detects the trac client and connects it without leaving the terminal — Enter in the dashboard, or vpn connect "Check Point" from the shell, walks you through it. It's a full tunnel, so it drops the other tunnels — but your xray proxy keeps running on top, so per-rule routing still applies over the corporate link.
- 1 Username
you@corp - 2 Password
•••••••• - 3 One-time code
418 920
No browser, no second app — password and OTP right in the dashboard.
The xray panel
Tab into the xray card for a focused panel.
- Your real vs VPN IP up top — see at a glance what the world sees.
- Every server is a card with its flag and ping — Enter switches, Tab edits, renames or removes.
- Subscriptions — no vendor app — show as their own block (📡 name · N servers); paste any link, even a Happ deep-link, Tab in to pick a server. Refreshed on open like a VPN client, no restart.
- A Routing widget right there — shape direct / proxy / block without leaving the panel.
Routing without the xray syntax
The Add rule wizard walks you through it — a website, a known service (OpenAI, Netflix, Telegram…), a whole country, or an IP/subnet. Every rule lands in one of three buckets.
Bypass the proxy — local sites, corporate hosts, your work tunnel's traffic.
Force through the xray server — a service blocked in your region.
Drop it entirely — ads and trackers.
block → proxy → direct. Then private and localhost always go direct, and anything unmatched goes through the proxy.
Every generated config is validated with xray -test before anything is applied.
Install in one line
Pick your platform. Homebrew pulls in xray automatically.
brew install vpncli/tap/vpncurl -fsSL https://vpncli.github.io/vpn/key.gpg | sudo gpg --dearmor -o /etc/apt/keyrings/vpn.gpg
echo "deb [signed-by=/etc/apt/keyrings/vpn.gpg] https://vpncli.github.io/vpn stable main" \
| sudo tee /etc/apt/sources.list.d/vpn.list
sudo apt-get update && sudo apt-get install vpn
bash -c "$(curl -fsSL https://github.com/XTLS/Xray-install/raw/main/install-release.sh)"curl -fsSL https://raw.githubusercontent.com/vpncli/vpn/main/install.sh | bash $ vpn # open the dashboard — manage everything $ vpn add vless://… # add & activate an xray server $ vpn on # turn the xray proxy on $ vpn off # turn it off xray is only needed for the xray proxy — managing your full-tunnel VPNs needs nothing extra.
First run, nothing configured? Just vpn — paste your vless:// link and you're connected, without ever leaving the TUI.
Scriptable end to end
Everything in the app is also a plain command — including connecting the app-VPNs and Check Point.
vpn interactive dashboard vpn on · off · restart xray proxy: connect / disconnect / reconnect vpn services list every detected VPN (● = connected) vpn connect <name> connect an app-VPN / Check Point vpn disconnect <name>|all disconnect one service, or everything vpn status · ip · log [N] live status · IPs · last log lines vpn add <vless://…> [name] add a server vpn add <subscription-url> add every server from a subscription / deep-link vpn sub ls · update · rename · rm manage subscriptions vpn ls · use · show · rm [name] manage servers vpn route add|rm direct|proxy|block <rule> edit routing vpn preset ls · on|off [name…] toggle presets vpn lang en|ru set language vpn init auto-source the proxy env in new terminals vpn connect "Check Point" prompts for your password + OTP (or pass --user/--password/--otp for scripts). App-VPNs keep their own clients — vpn detects and drives them.
