Cloudflare-Tools: generate WARP MASQUE node configs for Clash and Mihomo

What Cloudflare-Tools actually does, and who it is for

The repository describes itself as tools for obtaining free Cloudflare WARP proxy nodes. There is one tool inside it: a one-click WARP script that registers a WARP account, screens WARP MASQUE endpoints for the better ones, and emits a YAML file that Clash or Mihomo can load. That is the whole scope.

The intended user is someone who already runs a Clash-family client and wants WARP endpoints inside it without doing the account registration and endpoint selection by hand. The README states that no Cloudflare account is needed, because the script registers the WARP account itself. It also states the script runs fully automatically, with no manual intervention, and drops the resulting YAML in the current directory.

That framing matters. This is not a proxy client, not a dashboard, and not a service. It is a generator. If you were hoping for something that starts a tunnel, the repository does not offer it. The output is a file you import elsewhere.

The pipeline: register, screen endpoints, emit warp-multi.yaml

The README's function list gives the mechanism in three steps. First, the script registers a WARP account on its own. Second, it selects preferred WARP MASQUE protocol nodes. Third, it writes a Clash/Mihomo-compatible YAML configuration. The file is named warp-multi.yaml and lands in the directory the script was run from.

The repository layout is thin: LICENSE, README.md, and a script/ directory. The README points to script/windows.bat and script/Warp_MASQUE_Endpoint_macOS.sh. The project credits warpscout as the open source project some of its functionality is based on, which is the honest way to describe a wrapper: the endpoint discovery work comes from elsewhere, and this repository packages it for a one-click flow with YAML output.

The primary language listed for the repository is Batchfile, which tells you where the author's effort went. The macOS path is a shell script, and the README says Linux and Android versions are only being considered for a later update based on how the tool is used. There is no release artifact, so you take the scripts from the repository directly.

Running it on Windows: download windows.bat and double-click

The Windows path is deliberately plain. The README tells you to download script/windows.bat, create a new folder (English name recommended, to avoid compatibility problems with non-English paths), put the batch file inside, and double-click it. No command line is required, and the README gives no batch invocation command, so there is nothing to copy into a terminal for this platform.

When the run finishes, the README states that warp-multi.yaml is in the script's directory and can be imported into a Mihomo or Clash-compatible client. The thing to look for after the run is exactly that file next to windows.bat. If it is not there, the run did not complete the generation step, and the README documents no rollback, no log location and no retry flag.

macOS: architecture detection and the chmod step

On macOS the README supports Intel (x86_64) and Apple Silicon (arm64) machines, listing M1, M2, M3, M4 and MacBook Neo. Download script/Warp_MASQUE_Endpoint_macOS.sh, put it in a new folder with an English name, right-click the folder and choose to open a terminal there. Then the README gives two commands, and both matter.

chmod +x ./Warp_MASQUE_Endpoint_macOS.sh
./Warp_MASQUE_Endpoint_macOS.sh

The first grants execute permission; without it the second line fails. The README notes that the script detects the Mac's CPU architecture and downloads the matching warpscout build, so you do not choose Intel or Apple Silicon yourself. That download is a network dependency the README does not discuss in terms of failure: it does not say what happens if the download fails, or where the downloaded binary is placed. The result is the same as on Windows, warp-multi.yaml in the script's directory, ready for a Mihomo or Clash client.

Where Cloudflare-Tools is the wrong tool

The limits are structural, not cosmetic. There is no Linux script and no Android script; the README says those platforms are being considered for a future update, which is not a commitment. If your Clash client runs on a Linux box or a router, this repository gives you nothing to run there.

There is also no GUI, no installer, and no release artifact. You are downloading a batch file or a shell script from the repository and executing it, which means the trust boundary is the script itself. The README does not document what the script writes outside the YAML, whether it stores the registered WARP account anywhere, or how to remove it. Anyone who needs an auditable setup will find that gap uncomfortable.

The third limit is the output itself. warp-multi.yaml is a config file. The tool does not test that the endpoints work from your network after generation, does not update the file later, and does not keep the endpoint list fresh. Endpoint quality changes over time, and the README presents selection as a one-shot step during the run. If your endpoints degrade next week, the documented answer is to run the script again, not to expect an automatic refresh.

How this differs from using warpscout directly

The real alternative is the upstream project the README credits: warpscout. The difference in approach is packaging, not capability. warpscout is the component that does endpoint discovery, and Cloudflare-Tools is a wrapper that adds WARP account registration and YAML generation around it so that a Windows user can double-click a batch file and a macOS user can run one shell script.

Choosing warpscout directly means you handle the account registration and the Clash/Mihomo config writing yourself, but you also get the upstream project's own interface, whatever platform support it has, and its release cadence rather than this repository's. Choosing Cloudflare-Tools means accepting the narrower platform list and the thinner documentation in exchange for not having to assemble the pieces. Neither path gives you a managed service. Both produce endpoints you then point a client at.

A second comparison point is simply doing nothing: importing no WARP endpoints and using whatever your Clash client already has configured. Cloudflare-Tools only makes sense if WARP MASQUE endpoints specifically are what you want in that client.

Maintenance, licence and what the repository does not say

The repository is not archived, and the last push was on 2026-09-04, so it is recent by the only measure available here. That is a statement about the commit history, not a promise about future releases. There are no releases retrieved for this repository, so there is no versioned artifact to pin and no changelog to read before upgrading. Upgrading means re-downloading the script, which also means re-running a process that registers a WARP account and writes a new YAML over the old one. The README does not describe a backup step, so keep your own copy of warp-multi.yaml if you have edited it.

The licence is MIT, which is permissive and places few conditions on reuse or redistribution. Because the tool depends on warpscout, that project's own licence applies to the component it contributes; the README credits the project and its developers but does not restate the licence terms. If you plan to redistribute a modified version, check warpscout's licence separately. Nothing here is legal advice.

The README also does not document logging, error handling, proxy or network configuration, or a way to inspect the endpoints before the YAML is written. Those omissions are the maintenance cost: when a run fails, your diagnostic material is the terminal output and nothing else.

Editorial conclusion

Adopt it if you are on Windows or macOS and want a Clash/Mihomo YAML of WARP MASQUE endpoints without hand-registering a WARP account or picking endpoints yourself. Do not adopt it if you need Linux or Android, if you want a maintained GUI, or if you expect the tool to tunnel traffic on its own: it only produces a config file. Before trusting a run, check that the generated warp-multi.yaml appears in the script's own directory, that the path contains no non-English characters, and read the macOS script's architecture detection because the README states it downloads a matching warpscout build automatically.

Frequently asked questions

Official sources

1. Issues
2. License: MIT
3. n0de-sudo/Cloudflare-Tools on GitHub
4. README