Windows engine catalog
| Engine | Type | Notes |
|---|---|---|
sni | DPI bypass stack | Windows-only native DLL-backed SNI path with local XRay listeners. |
xray | Proxy core | Supports current Windows XRay runtime behavior, including client-side REALITY handling. |
gdpi | TCP handling | legacy is the stable default; native is experimental. |
psiphon | VPN/proxy client | Current runtime is backed by blackout_warp.dll. |
warp | VPN/proxy client | Current runtime is backed by blackout_warp.dll. |
tun | System tunnel | Requires admin rights on Windows. |
tor | Proxy client | Uses a supplied Tor runtime. |
mhrv | HTTP relay | Embedded HTTP relay; HTTPS CONNECT is intentionally unsupported. |
ikev2, wireguard, openvpn, softether | VPN paths | Depend on their respective runtime/setup requirements. |
appsscript | HTTP relay | HTTP relay path only. |
hysteria2, tuic | QUIC proxy | Run through the native sing-box-backed proxy engine path. |
legend | Composite target | Connect/start target that is separate from the legend security mode name. |
Linux engine catalog
| Engine | Supported? | Notes |
|---|---|---|
xray | Yes | Uses the managed blackout-engine runtime. |
tun | Yes | Requires root and Linux networking prerequisites. |
hysteria2 | Yes | Managed runtime path through blackout-engine. |
tuic | Yes | Managed runtime path through blackout-engine. |
| Everything else | No | Windows-only or otherwise unsupported on Linux. |
Read the capability matrix
Run blackout demo for a safe simulation or blackout capabilities for the full catalog with local state.
Ready means local prerequisites passed. Blocked means a local runtime, setting, permission, port, or compatible saved configuration is missing. Unsupported means this platform has no shipped runtime path. A cataloged target remains visible even when it is unsupported here.
Automatic GitHub release downloads are staged and require matching SHA-256 metadata before promotion. Manual or user-supplied runtimes are labeled unverified and are the user's responsibility.
Golden path
blackout demo → blackout doctor --local-only → blackout capabilities → blackout route → blackout setup → blackout ready <engine> → blackout connect
The guided setup is read-only in JSON and non-interactive modes. When Blackout Kit changes a local system proxy, it records ownership and restores or clears it only while the current proxy still matches the recorded target.
Boundary reminder
Engine availability does not prove that the selected upstream server or filtered network will work. Blackout Kit distinguishes local readiness from remote success.