Release Notes

Home

A new dashboard of cards over an animated gradient that changes each launch. When you scroll, the Start button collapses into a capsule in the toolbar.

• Activity charts upload and download for the last 60 seconds, with peak speed, request count, total traffic, and open connections.
• Network shows the SSID, outbound mode, latency to the router and to the internet, and local and router addresses.
• External IP shows your public address and location, NAT type, carrier, and ASN.
• Bandwidth keeps the latest speed test. DNS shows average lookup time, whether DNS is encrypted, and recent queries, with a button to flush the cache.
• Usage covers today, this month, and last month, split into proxy and direct, with an hourly breakdown.
• Top Traffic ranks domains or policies by traffic, each with its site icon.
• Policy Latency plots every policy on one shared scale.
• Events surfaces warnings and errors on Home, with a warnings-only filter.

Design

• Configure, policy group cards, banners, and menus use Liquid Glass.
• Policy group cards take SF Symbols or emoji icons. Tap a card to expand it in place and pick a policy. Touch and hold to edit the group or change its icon.
• Menus anchored to the row replace most action sheets, so options open instantly where you tapped, with a description under each choice.
• Every editor opens with a Settings-style header that says what the page controls.
• Surge reopens on the tab you last used, and each tab keeps its own navigation stack.
• The More tab gives every item a colored icon.
• Lucid is now the only style, and it no longer needs a Feature Subscription. The Gradient theme is removed.

Requests

• Filter bar pinned to the top of the list. Show only HTTP or only active requests in one tap, and turn custom filters on or off. Add filters with the Add Filter button, and touch and hold a filter to invert it, so it hides matching requests instead of showing only them.
• Site icons are fetched and cached, and also appear in DNS results, traffic statistics, and Top Traffic.
• Image thumbnails appear for captured image responses.
• Request details are redesigned. Protocol, status, traffic, timing, and the matched rule fit on the first screen, and you can add a rule from there.

Status

Protocol

Profile History

• Every saved version of a profile is kept on the device, labeled with where the change came from: the app, text mode, or another source such as iCloud sync.
• When you save in text mode, Surge shows how many lines changed. Choose Review Changes to step through each one, with changed words highlighted.
• Switch between side-by-side and unified views. Unchanged sections fold away, and arrows jump between changes.
• Compare any version with the current profile, copy it as a patch, or roll back.
• Versions are kept for up to one year, within 100 MB in total.
• The text editor checks profiles and modules as you type. Lines with errors or warnings are marked and listed in a menu, and Surge asks before saving a profile that fails to parse.
• Error messages say why a profile line is invalid, not just where it is.
• Comments in a profile stay next to their entries when you add or remove entries in the app.

iPad and iPhone Duo

• Surge switches between a tab bar and a split layout based on window width, on rotation, in Split View, and when iPhone Duo unfolds. It keeps your current tab across the switch.
• Home cards flow into two columns once the area reaches 640 pt.
• On the iPhone Duo outer screen, content stays centered in the safe area, clear of the side tab bar and status bar.

MCP Server

The HTTP API can now serve a Model Context Protocol endpoint. Agents such as Claude Code get the same capabilities as surge-cli, including control of Surge on another device. MCP apps on the same iPhone, such as FlowDown and Minis, can drive Surge directly through http://127.0.0.1:6171/v1/mcp.

• The endpoint is /v1/mcp, using stateless Streamable HTTP. It shares the HTTP API key, sent as X-Key or Authorization: Bearer.
• Agents edit the profile one section at a time. Each write is validated against the whole profile, and with #!include only the file that holds the section changes.
• Each tool is marked as read-only, test traffic, settings change, or destructive, so clients can ask for confirmation first.
• Tools cover status and network summary, policies and groups, rule match explanations, DNS and GeoIP lookups, requests and captured bodies, logs, live events, policy and network tests, temporary rules, profiles and modules, capture filters, and scripts.

# Turn on the endpoint
[General]
http-api = examplekey@0.0.0.0:6171
http-api-mcp = true

# Add it to Claude Code
$ claude mcp add --transport http surge \
    http://192.168.1.10:6171/v1/mcp \
    --header "X-Key: examplekey"

// Or in a client that reads JSON config
{
  "mcpServers": {
    "surge": {
      "type": "http",
      "url": "http://192.168.1.10:6171/v1/mcp",
      "headers": { "X-Key": "examplekey" }
    }
  }
}

The MCP endpoint is off by default. The API key grants full control of Surge, including running scripts and stopping Surge. Only expose the listening port on networks you trust.

Engine

Surge for iOS 6.0 shares these engine updates with Surge for Mac 6.11.

Tailscale exit node and subnet routes

• Other tailnet devices can connect to this device, or use it as an exit node or subnet router. Incoming traffic goes through your rules and policies, and shows up in Requests under the peer's name.

[Tailscale home]
auth-key = tskey-auth-xxxx
advertise-exit-node = true
advertise-routes = 192.168.1.0/24

WireGuard listen port

• With listen-port set, Surge listens for WireGuard clients such as phones and laptops. It follows peers when their address changes.

[WireGuard home]
self-ip = 10.8.0.1
listen-port = 51820
peer = (public-key = <phone>, allowed-ips = 10.8.0.2/32)

Adaptive QUIC blocking

• Surge blocks QUIC so the client falls back to TCP. If it doesn't fall back within one second, QUIC is allowed for that hostname, so QUIC-only apps keep working. The result is remembered per hostname.
• auto now uses this mode for policies that support UDP relay.

Proxy = trojan, ..., block-quic=adaptive

UDP over SOCKS5 Wi-Fi Access

• The SOCKS5 server for Wi-Fi Access supports UDP ASSOCIATE. Each association is matched against your rules once, using the destination of its first packet.

[General]
allow-wifi-access = true
wifi-access-socks5-port = 6153

No rule set limit

• DOMAIN-SET and RULE-SET were capped at one million entries. The cap is gone, so large ad-blocking lists work as is.

Capture filters and section editing

• Capture filters, which decide which requests are recorded, can be read and changed with surge-cli and the HTTP API.
• Profiles can be read and written one section at a time.

surge-cli capture-filter
surge-cli profile section Rule
GET /v1/capture/filters

Other Improvements

• Surge iOS 6 requires a license. The free tier is no longer available.
• VMess, TUIC v4, and Shadowsocks ciphers older than AEAD can no longer be set up in the proxy editor. Existing proxies of these kinds keep working and can be edited in text mode.
• Remote Control uses the same dashboard cards as Home. Device management is redesigned, with a new device details page.
• Nearly every view is redesigned for Surge iOS 6.
• Wi-Fi Timeline, Traffic Statistics, External Resources, and Modules are rebuilt. Module updates show only what changed.
• Real-Time Statistics is redesigned. It charts each policy's traffic by hour, and can hide policies that only carried proxy tests.
• The script editor, Add Rule, DNS settings, and Subnet Overrides are redesigned in the Surge iOS 6 style.
• Traffic from proxy tests is counted separately per policy, and policy statistics survive engine restarts.
• The HTTP API can list policies loaded by external policy groups with include_external=true.
• New settings screens for QUIC blocking mode and the [Testing] section.