Marram Software 切换到中文

Products

The iVex client family

iVex applications open an encrypted tunnel and route traffic through a rule engine on the device, across four platforms that share one network core.

Client applications

Each client is written natively for its own platform, because how an operating system hands over the network differs on every one of them.

macOS

Shipping

macOS 12 Monterey and later · Universal Binary, Apple Silicon and Intel

A native macOS application that runs the network core in a background system service. Routing and geolocation data ship with it, so a first connection needs no extra download.

Android

Shipping

Android 7.0 and later · 64-bit ARM

A native Android application that establishes the tunnel through the system's own VPN service and runs the network core inside the application itself.

iOS

In development

iOS 17 and later · iPhone and iPad

A native iPhone and iPad application running the same network core as the other platforms. It is in development and has not been released.

Linux

In development

Linux with systemd · single static binary, no runtime dependencies

A single static binary carrying both a command-line and a full-screen terminal interface, alongside a background service that runs the core. It is in development and has not been released.

Status as of August 2026.

The network core

Four applications. One engine underneath them.

That engine is mihomo, also known as Clash.Meta, and it is open source rather than something we wrote. We run a modified build of it, maintained and extended by us, and all four applications share that one build.

One line, not a branch per platform
Every platform builds from the same line of the core. A split once left one platform months behind, still shipping a defect the others had fixed, so the rule is now written down rather than left to habit.
Configuration is rewritten before the core starts
Server-issued configuration never reaches the core as sent; each platform rewrites it locally against the same contract. Node credentials sit on disk as AES-256-GCM ciphertext and are decrypted only as the core loads them.
Fail-closed where the failure would be invisible
Traffic can take a second hop through a proxy the customer supplies. Where that chain cannot be made safely, the client refuses to connect rather than quietly falling back to the direct route.

The platform behind the clients

A client is the visible half. The other half runs on our own servers and at the network edge.

Basilica — control plane

Our own control plane: a Go application with a web console. It runs server inventory, node deployment, fleet monitoring, client releases, device registration and a support desk.

Pieta — node backend

The backend that runs on every proxy server, applying the account list the control plane sends it, metering traffic and enforcing bans and speed limits.

iVexboard — account and subscription API

A Go rewrite of the account and subscription API the clients authenticate against. It is built and tested but not yet cut over, so the system it replaces is still the one in service.

Edge services on Cloudflare

Our public-facing services and the device registry run on Cloudflare's edge platform, along with the access policies that gate our internal tools.