Import

Chute can import proxy configuration written for other clients. Two kinds of input are accepted: single-node share links (ss://, vmess://, …), and whole profiles in Clash/mihomo YAML or sing-box JSON. Both are converted into native Chute configuration — what you get afterwards is an ordinary Chute profile with [Proxy], [Proxy Group] and [Rule] sections, not a foreign file that Chute keeps interpreting.

http:// and https:// addresses are never treated as share links. They are subscription addresses: the content is downloaded first, then imported according to what the body turns out to be.

Share Links

Most links use the userinfo@host:port?query#name shape. Two are different: vmess:// carries a base64-encoded JSON object (the v2rayN format, with the add / ps / scy / net / aid field names), and ss:// accepts both SIP002 (base64(method:password)@host:port) and the older whole-body base64(method:password@host:port) form. Base64 payloads may be unpadded and may use the URL-safe alphabet.

trojan://[email protected]:443?sni=example.com&alpn=h2,http/1.1#Tokyo%20Node

converts to:

[Proxy]
Tokyo Node = trojan, example.com, 443, password=password, tls=true, sni=example.com, alpn=h2|http/1.1

The text after # is percent-decoded and becomes the policy name; vmess:// takes it from the ps field instead. A link with no name is named host:port. Characters the configuration format reserves — =, ,, [, ], ", tab and newline — are replaced with spaces in the name.

Trojan, Hysteria2, TUIC and AnyTLS are TLS-only protocols, so tls=true is added even when the link does not spell it out.

Multiple links. A payload can be many share links separated by newlines, optionally wrapped in one outer layer of base64. Every line that parses becomes a policy, and repeated names get a 2, 3 … suffix so that rules and groups can still address each node individually. Lines that cannot be parsed are reported as warnings while the rest of the payload is still imported; the import only fails when nothing at all could be converted.

A link whose scheme is not in the table above is not recognized as a share link. A link with a known scheme but missing required fields is rejected with a message naming that scheme.

Supported Parameters

Only the query parameters below are read; anything else in a link is ignored.

A Shadowsocks plugin value is read as name;key=value;…. obfs-local / simple-obfs / obfs become obfs and obfs_param; v2ray-plugin in its (default) websocket mode becomes ws=true with ws-path and ws-headers. Any other plugin produces a warning and is not carried over — the resulting policy will not connect to a server that requires it.

Notice: A non-zero VMess aid (alterId) is reported as a warning. Chute speaks VMess AEAD only, and a server still requiring the legacy MD5 handshake will not authenticate.

Profile Import

Three formats are recognized:

The format is detected from the content, with the filename used only as a hint. Content starting with { is treated as sing-box JSON whatever the file is called (a sing-box profile saved as .yaml still parses as YAML, so the name alone cannot be trusted). Otherwise a .conf extension means native, .json means sing-box, and .yaml / .yml means Clash. When there is no usable filename — a subscription body, for instance — the first meaningful line decides: #!MANAGED-CONFIG or a [Section] header means native, and proxies:, proxy-groups:, rules:, proxy-providers: or rule-providers: means Clash. Anything else is treated as native.

A document that parses but contains none of the sections that define its dialect is rejected rather than reported as a successful import of nothing: Clash YAML needs at least one of proxies, proxy-groups, rules, proxy-providers or rule-providers, and sing-box JSON needs outbounds, endpoints or route.

A single unconvertible entry never fails the import. Each proxy, group and rule is converted on its own; the ones with no Chute equivalent are skipped and reported. The result carries the converted configuration, a list of warnings, and a list of the source fields that were skipped. The same warnings are also written into the converted text as comments, next to the section they came from:

[Proxy]
HK 01 = ss, example.com, 8388, aes-128-gcm, password
# KL-CONVERT-WARNING [proxies[3]]: proxy type 'snell' was skipped — Snell is a Surge-proprietary protocol KLNEKit does not implement

Finally, the converted text is re-parsed with Chute's own parser. Any line the parser rejects is commented out as # KL-CONVERT-DROPPED: … and reported, so a profile that is 95% convertible still imports and runs.

Node names are rewritten where they would break the configuration format: , becomes a space and = becomes -, and a name that then collides with another one gets a numeric suffix. Group members and rule destinations are rewritten to match, so every reference keeps pointing at the same node. direct proxies/outbounds are mapped onto the built-in DIRECT, and reject / block / dns onto REJECT.

Notice: A converted profile is a static snapshot. Chute re-downloads a subscription and parses it as a native profile, so a profile that had to be converted is saved without an auto-update URL and will not refresh itself.

Clash / mihomo Conversion Notes

Notice: dialer-proxy is converted to underlying-proxy. Chute parses and preserves that option but does not implement proxy chaining — a policy carrying it logs a warning and connects directly to its own server. Traffic that was chained under mihomo is not chained after the import.

• Proxy types converted: ss, ssr, vmess, vless, trojan, http, socks5, hysteria2, tuic, anytls, wireguard, ssh. Types Chute has no implementation for — snell, hysteria (v1), mieru, juicity, shadowquic, trusttunnel, openvpn, sudoku, vmess-http — are skipped with a warning naming the protocol. Two more are skipped although Chute supports the protocol: a masque proxy, because the mihomo field layout differs, and a tailscale proxy, which is configured once in the [Tailscale] section and used through the built-in TAILSCALE policy.
• mihomo's two fingerprint keys mean different things and are kept apart: client-fingerprint becomes fingerprint (the uTLS ClientHello profile) and fingerprint becomes cert-fingerprint-sha256 (a certificate pin).
• udp: false becomes udp-relay=false, tfo becomes tfo=true, and an enabled smux block becomes mux=true.
• Group types select, url-test, fallback and load-balance are converted with their health-check options. A relay group is skipped — it is chaining, which is not implemented. use: members become policy-provider:<name> references, and include-all / include-all-proxies / include-all-providers are expanded into an explicit member list.
• filter and exclude-filter are carried over quoted, but a pattern containing a comma or a quote cannot survive the configuration line format and is dropped with a warning.
• Rule types are renamed where the names differ: MATCH → FINAL, DST-PORT → DEST-PORT, SRC-IP-CIDR → SRC-IP. REJECT-DROP and REJECT-TINYGIF collapse onto REJECT; a rule targeting PASS or COMPATIBLE is skipped.
• An inline rule-provider (type: inline with a payload list) is expanded into the equivalent concrete rules, since a Chute [Rule Provider] line cannot embed a payload.
• General keys are mapped where an equivalent exists: mixed-port becomes the HTTP port (SOCKS5 needs its own socks-port), allow-lan becomes allow-wifi-access, log-level is mapped onto loglevel, external-controller/secret become the external HTTP controller options, and an enabled sniffer becomes sniffing-enabled.

sing-box Conversion Notes

• Outbound types converted: shadowsocks, vmess, vless, trojan, hysteria2, tuic, anytls, shadowtls, wireguard, http, socks, ssh. selector and urltest become select and url-test policy groups.
• detour produces a warning for the same reason as dialer-proxy: outbound chaining is not implemented, and the outbound dials its own server directly.
• route.rule_set entries become [Rule Provider] lines (type=http for remote, type=file for local, always read as classical mihomo-YAML rule lists). A rule set in the binary .srs format is rejected — Chute reads text rule payloads only.
• Route rules follow the action key: route/bypass use the named outbound, reject becomes REJECT, and hijack-dns, sniff and resolve emit nothing because Chute controls those from [General].
• multiplex settings and dns.rules (per-domain DNS routing) have no equivalent and are reported as dropped.

Limitations

• Proxy chaining is not implemented. mihomo dialer-proxy, sing-box detour and Clash relay groups all describe a chain; none of them produce chained traffic in Chute.
• Options with no Chute equivalent are dropped with a warning rather than silently: per-proxy ip-version, interface-name, routing-mark and mptcp; per-group exclude-type, disable-udp, interface-name, routing-mark and icon; and the General keys bind-address, tcp-concurrent, geodata-mode, geox-url, find-process-mode, unified-delay, authentication, tproxy-port, redir-port and others.
• Rule types with no equivalent are skipped: GEOSITE, IP-SUFFIX, SRC-IP-SUFFIX, SRC-GEOIP, SRC-IP-ASN, DSCP, UID, SUB-RULE, PROCESS-PATH-REGEX, PROCESS-NAME-WILDCARD, PROCESS-PATH-WILDCARD and IP-ACCEPT. A rule carrying mihomo's src modifier is skipped as well, rather than matching on the wrong endpoint. mihomo sub-rules (nested rule trees) are dropped.
• Protocol details that Chute manages itself are not carried over: Hysteria2 port hopping (ports), TUIC heartbeat, AnyTLS session-pool tuning, WireGuard peers lists (a single peer is configured) and workers.
• Transports Chute does not implement are reported instead of converted: h2, http obfuscation, httpupgrade, the v2ray-http-upgrade WebSocket variant, WebSocket max-early-data, and XHTTP extra (XMUX / download-settings).
• Clash's operating mode is a runtime switch in Chute, not a configuration key; a profile in global or direct mode converts to rule mode with a warning.
• YAML is read with a standard parser, so anchors and the << merge key work. A value written as a multi-line scalar is folded onto one line, because a newline would split the configuration line it lands on.