Xray

XTLS/Xray-coreReviewed by AI

What it does

Xray-core is the connection engine that dozens of proxy apps use. It speaks protocols such as VLESS, VMess, Trojan, Shadowsocks, REALITY and WireGuard, and it is meant to carry traffic past network filtering. The downloads are a single command-line file for Windows, macOS and Linux, with no window and no server included: you write a JSON configuration by hand and point it at a server you rent or run yourself. It is aimed at technical users and at the people who build the client apps; everyone else usually installs one of the graphical clients listed in the README instead.

How easy it is to install

D · terminal, several tools or a specific graphics card · Windows

Windows D
macOS D
Linux D

Every release has a ready 14 to 16 MB zip for Windows, macOS and Linux, but the file inside is a terminal program with no window, and the README gives no end-user setup: for configuration it links to other repositories (XTLS/Xray-examples) and to the official website, and for installation it points to third-party scripts, Docker images and web panels. Linux is the best served of the three because the project ships an official install script and Docker image, and macOS has `brew install xray`, yet on all three you still have to write a JSON configuration and have your own server before anything connects.

Coming soon: install in 1 click with the RepoPicks app.

Numbers on GitHub

Stars: 42,525on Oct 31, 2026
Downloads: 47,662,601428,079 this week
Growth: +178stars in 5 days

Stars over time

Facts

Runs on: Windows, macOS, Linux
You need to install: Nothing extra
To build from source: Go
Disk space: 16 MB–48 MB · from the installer
Accounts or keys: None
Cost: Free · The program costs nothing and the code is MPL-2.0. The server it connects to is a separate expense: you rent it or host it yourself. The README also lists sponsors and crypto donation addresses.
License: MPL-2.0 (Copyleft)
Can replace: Surge, Proxifier
Last update: Oct 31, 2026

Risk signals (5)

Attentionproxy tool restricted in some countries
The repository's own topics are "anticensorship, dns, network, proxy, reality, shadowsocks, socks5, tls, trojan, tunnel, utls, vision, vless, vmess, vpn, wireguard, xhttp, xray, xtls, xudp" and the description is "Xray, Penetrates Everything". The README's tutorial list includes "XTLS-Iran-Reality" and "Xray REALITY with 'steal oneself'", and it runs Telegram channels in Russian and Persian. These protocols are built to hide traffic from network filtering, and running or distributing such tools is restricted or forbidden in some countries, so the legal position depends on where you are.
AI review
Attentiontraffic passes through whoever owns the server
The program's whole job is to carry your connection to a remote server. Whoever runs that server sees the traffic, and the README is about protocols and panels, saying nothing about who operates the servers people use. Its sponsor banners include a commercial VPN link (BlancVPN, blanc.link).
AI review
Infoneeds a server and a config file you write
The README has no configuration section of its own: under "Usage" it only links to example repositories such as https://github.com/XTLS/Xray-examples and to third-party tutorials. The release zips contain the xray program and nothing else, so it does nothing until you supply a JSON config and the address of a server you rent or run.
AI review
Infowindows zip bundles a closed source driver
README, "Bundled Third-Party Components Redistribution": "This distribution contains unmodified official precompiled and pre-signed Wintun binaries" (wintun.dll), under the "Prebuilt Binaries License (PBL)", included in the Windows 32, 64 and arm64 packages. That part is not open source and is loaded at run time for the TUN feature.
AI review
Infocrypto donations and nfts in readme
The README's "Donation & NFTs" section lists wallet addresses for TRX/USDT/USDC, TON, BTC, XMR, SOL and ETH and sells "Project X NFT" items on OpenSea. Nothing in the program requires paying, but the project's funding is asked for in crypto, which leaves no trace of who received it.
AI review

Evidence is shown in its original language.

What Radar could not check

Whether a connection really works on each of Windows, macOS and Linux, which depends on your server and your network
Whether the downloaded zip matches the .dgst checksum file published beside it, unless you check it yourself
What the owner of the server you connect to does with your traffic or logs
Real disk use after unzipping, estimated at 16 to 48 MB
Whether the bundled wintun.dll in the Windows packages is the untouched file from wintun.net