Client apps

Which app to recommend on each platform, what each one receives from the subscription, the one-tap add links and their fallbacks, and how to set the apps up in the admin and through MCP. kl!ck is the desktop app Mistgate recommends.

Mistgate has no client of its own. People connect with existing apps, and the panel hands each app what it reads. This page says which app fits which platform, what each one receives, how the one-tap Add button of the user page works, and how you set the apps up.

Which app where

Platform	Recommended	Also offered
Windows, macOS	kl!ck: Hysteria2, VLESS and AmneziaWG in one app	Happ; AmneziaVPN for keys
iOS, Android	Happ: Hysteria2	AmneziaVPN for keys
Linux	none by default	AmneziaVPN for keys; any app on the mihomo core you add

That is the list of a fresh panel (see A fresh panel). You can change it: any app can be added, removed, reordered and marked as recommended.

What each app receives

One subscription link serves every app. The panel picks the format by the app's User-Agent (the rules of Subscriptions → Who gets what, see Subscriptions).

App	Format	What is in it
kl!ck	Mihomo YAML (kl!ck sends User-Agent: mihomo/…, which the default rule mihomo takes)	Hysteria2, VLESS and AmneziaWG servers, one server group, a dns: section from the person's DNS preset.
Clash Verge Rev, FlClash, Clash Meta for Android	Mihomo YAML, when the app's User-Agent contains clash or mihomo (the two default rules)	The same as for kl!ck. An app that matches no rule gets the link list: add a rule with part of its User-Agent.
Happ	Link list (base64)	Hysteria2 and VLESS servers: Happ cannot carry AmneziaWG. Happ alone also gets the Routing header with the DNS preset and the load in the server names.
Hiddify	Mihomo YAML: its User-Agent contains ClashMeta, which the default rule clash takes before sing-box	The Mihomo YAML. Which of its servers the app uses depends on its version.
v2rayNG, v2rayN and other apps on the Xray core	Link list (base64), or Xray JSON by a rule of yours	Hysteria2 and VLESS servers. In the link list, whether the app reads hysteria2:// and vless:// (REALITY, XHTTP) links depends on its version. In Xray JSON, one config per server; no AmneziaWG, no Hysteria2 with Gecko.
sing-box apps (SFA, SFI, SFM)	sing-box JSON: their User-Agent starts with SFA (sing-box …, SFI (sing-box … or SFM (sing-box …, which the default rule sing-box takes	One switch with Hysteria2 (Let's Encrypt, no Gecko) and VLESS (TCP or WebSocket) servers and the person's DNS. See sing-box.
AmneziaVPN, AmneziaWG apps	No subscription: a key per device (vpn://, a .conf file or a QR code) from the person's page	AmneziaWG only.

The AmneziaWG servers reach an app on the mihomo core only when the person has the AmneziaVPN way switched on (Apps in the subscription on the user card or the group) and the group has an AmneziaWG profile on a node. The first fetch by such an app gives its device the AmneziaWG keys. The core must be new enough: the panel lists Mihomo 1.19.30 or newer for AmneziaWG 3.1 and 1.19.14 for 2.0, next to every key (AmneziaWG).

Which apps send a device ID

The device limit counts an app by the device ID it sends in the X-HWID header. An app with an ID gets a place and keys of its own; an app without one shares a place with the other such apps. The last column is what a person sees when the panel refuses the device (what the app shows).

App	Sends a device ID	What it shows on a refusal
kl!ck	Yes. The ID is a hash of the computer's identity and the host of the subscription, with the system and the computer's name.	The placeholder entry only: it does not read the announcement.
Happ	Yes, by default. The person can switch it off in the app's settings; then it counts as an app without an ID.	The announcement and the name of the entry.
v2RayTun, INCY, FlClashX, Koala Clash, Prizrak-Box, RenoarX, DeskBox	Yes.	v2RayTun reads X-Hwid-Limit; the others show the name of the entry.
Shadowrocket, Karing, Clash Mi, Throne	Able to, but switched off by default.	The name of the entry.
Hiddify, v2rayN, v2rayNG, Clash Verge Rev, FlClash, sing-box apps, Passwall	No (as of July 2026; requests for it are open at v2rayN, Hiddify and Passwall).	The name of the entry.
Streisand, V2Box	Not confirmed.	The name of the entry.

• This comes from the documentation and sources of the apps and of other panels, not from a test of every app, and a new version can start or stop sending the header. The panel goes by what an app sends: an app that sent no ID appears in the user card under Apps without a device ID.
• A person on an app without an ID is not left out in the default mode: those apps share one place. In Strict they cannot connect, and the message sends them to Happ or kl!ck.
• The panel reads an ID in capitals (INCY sends one) or without dashes (the alternative ID of Happ on a desktop) as the same device as its ordinary form.

Xray JSON reaches an app only by a rule (Subscriptions → Who gets what). v2rayNG reads it, and v2rayN is documented to from version 6.40; for v2RayTun, Streisand and the like it is not confirmed. Happ is listed as able to read it too, but stays on the link list. Before you write a rule, try the app with ?format=xray-json added to a subscription link (see Subscriptions).

One-tap add links

The Add button on the user page opens the app with the subscription already in it. It is the app's own link scheme with the subscription link filled into the "Add" link template of the app (placeholders {url}, {url_enc}, {name_enc}: see Subscriptions). When the template is empty, or the app does not understand the link, the page offers Copy link: paste it in the app's add-subscription screen.

These are the templates of the known apps. Each scheme is confirmed by the app's own documentation or source code, except Happ's (see the note below).

App	Platforms	Template
kl!ck	Windows, macOS	klick://add?url={url_enc}&name={name_enc}
Happ	iOS, Android, Windows, macOS	happ://add/{url}
Clash Verge Rev	Windows, macOS, Linux	clash-verge://install-config?url={url_enc}&name={name_enc}
FlClash	Android, Windows, macOS, Linux	flclash://install-config?url={url_enc}
Clash Meta for Android	Android	clashmeta://install-config?url={url_enc}&name={name_enc}
Hiddify	Android, iOS, Windows, macOS, Linux	hiddify://import/{url}#{name_enc}
v2rayNG	Android	v2rayng://install-sub?url={url_enc}
sing-box	iOS, Android, macOS	sing-box://import-remote-profile?url={url_enc}#{name_enc}
AmneziaVPN	all	none: a key per device, not a subscription

• Happ's own documentation does not describe happ://add/. It is the form subscription pages of other panels use, and the one Mistgate has shipped by default. If the button does nothing on a phone, the person copies the link instead.
• Not offered in the picker, because their schemes are not confirmed: Streisand and Shadowrocket (leave the template empty and people paste the link).
• The clash:// scheme is claimed by several Clash apps, so the system may open another one. Use the app's own scheme, as above.

kl!ck

kl!ck is an open-source desktop client for Windows and macOS by vbu00, written in Rust with Tauri around an unmodified Mihomo core. Mistgate recommends it on the desktop and credits its author: the app is not part of Mistgate.

Why it is the desktop recommendation. It reads the Mihomo YAML, the one format that carries all three protocols: a person with Hysteria2, VLESS and AmneziaWG gets all their servers from the one subscription in the one app, with the DNS section of their preset. On Windows and macOS the alternative is Happ for Hysteria2 and VLESS plus AmneziaVPN for keys, two apps and two ways to add.

What the panel needs. Nothing special: kl!ck fetches the subscription as mihomo/1.19.31, so the default rule mihomo serves it the Mihomo YAML. The app entry is of the kind By subscription link. For the AmneziaWG servers, see the switch above. kl!ck sends a device ID, so each computer with kl!ck takes a place of its own in the device limit.

Download. The releases page: https://github.com/vbu00/klick/releases/latest. The Windows and macOS builds are released separately and the file names carry the version, so the panel links the page, not a file. At the time of writing (October 2026) the latest release is 0.4.0 with a Windows installer; the macOS port is merged in the source, and the macOS package appears on the same page when it is released.

One-tap add, and its limit. kl!ck handles klick://add?url=<percent-encoded https link>&name=<optional name> (also klick://add/<link>). It adds nothing by itself: it opens its Add screen with the subscription filled in, showing only the domain of the link, and the person confirms. The link must be https://. This handler was added to kl!ck after 0.4.0, so one-tap needs a kl!ck build newer than 0.4.0. Older builds do not know the scheme: the person copies the link from the page and adds it in kl!ck by hand.

sing-box

The official apps are SFA (Android), SFI (iOS) and SFM (macOS), from the sing-box project. Windows and Linux have no official sing-box app, so the picker has none there. Mistgate's profile needs sing-box 1.12 or newer.

What the panel needs. Nothing: the apps send a User-Agent of the form SFA (sing-box 1.14.3; language en_US), and the default rule sing-box serves them the sing-box JSON (see Subscriptions). They are not on the user page of a fresh panel; add them with Known app → sing-box.

What they get. One switch with every server they can carry, the first one chosen, and the person's DNS preset. Hysteria2 only with a Let's Encrypt certificate and without Gecko; VLESS over TCP (RAW + Vision) or WebSocket. No AmneziaWG, no VLESS over XHTTP and no self-signed Hysteria2: what works where.

Device ID. SFA and SFI send no device ID. With the device limit on Strict they are refused and see "This app does not report a device ID".

Download. Android: Google Play (https://play.google.com/store/apps/details?id=io.nekohasekai.sfa). iOS: the App Store (https://apps.apple.com/app/sing-box-mt/id6785326793, named "sing-box MT"). macOS: the releases page of the project (https://github.com/SagerNet/sing-box/releases/latest), where SFM is a separate package.

One-tap add. sing-box://import-remote-profile?url=<percent-encoded https link>#<name> imports the subscription as a remote profile. The scheme comes from the sing-box documentation and the apps' sources; it has not been tried on a device yet.

Set the apps up in the admin

Subscriptions → User page → Apps on the page is the list of cards the page shows (see Subscriptions). To add an app:

1. Under the list choose a Platform.
2. Choose a Known app: kl!ck, Happ, AmneziaVPN, Clash Verge Rev, FlClash, Clash Meta for Android, Hiddify, v2rayNG or sing-box. The list holds the apps that exist on that platform. Custom app, fill in by hand keeps the old way: you pick the kind (Takes) and fill the fields yourself.
3. Press Add app. The card is filled with the name, the kind, the download link of that platform and the "add" link template. Edit any field, add a description (80 characters), switch Recommended on.
4. Move the card with the arrows: the recommended app leads its platform, and among equals the first in the list does. Press Save.

To make kl!ck the desktop recommendation on an existing panel: add it for Windows and for macOS, switch Recommended on, and switch it off on Happ for those two platforms. Look at the result in the preview on the same tab.

A fresh panel

A panel that has not saved its subscription settings yet shows these defaults:

• Windows and macOS: kl!ck first and recommended (the releases page, klick://add?url={url_enc}&name={name_enc}), then Happ.
• iOS and Android: Happ, recommended, with happ://add/{url}.
• All five platforms: AmneziaVPN for keys (from the store on phones, from the AmneziaVPN site elsewhere).
• Three rules: mihomo and clash, both to the Mihomo YAML, and sing-box to the sing-box JSON.

The defaults are only what an unsaved panel shows. Once you have saved the settings, the panel keeps your list exactly as saved: an update never rewrites it.

Through MCP

An agent with Operator access or higher manages the same list with subscription_settings_get, subscription_app_upsert_plan / subscription_app_upsert_apply and subscription_app_remove_plan / subscription_app_remove_apply. Every change to the page waits for the owner: the owner approves it in Integrations → Waiting for you, and the card shows each field in full. A worked example that adds kl!ck for Windows and macOS is in MCP. The prompt of the AI agent guide includes the step.

---

_{Edit this page · View on mistgate.app}