Native VPN - Aphrody Bun

Control a Mullvad VPN tunnel with the bun vpn command and the Mullvad daemon of the vpn plugin.

Bun ships the Mullvad VPN daemon and a native client for its management interface as the vpn plugin, the bun-vpn executable, downloaded on first use. The bun vpn command runs the daemon or sends it requests. There is no JavaScript module for the VPN; it is available only through the CLI.

Commands

bun vpn daemon       # run the Mullvad daemon of the vpn plugin
bun vpn status       # print the tunnel state reported by the daemon
bun vpn connect      # request a connection using the current Mullvad settings
bun vpn disconnect   # request a disconnect
echo 1234567890123456 | bun vpn login --stdin   # log in with a Mullvad account number
bun vpn login --from-env MULLVAD_ACCOUNT        # same, read from an environment variable

bun vpn accepts exactly one subcommand. status, connect, disconnect and login talk to a running Mullvad daemon (either bun vpn daemon or an installed Mullvad app) over its local management endpoint. They do not bypass the daemon's IPC authorization.

login --stdin reads the 16-digit account number from standard input, never from the command line, so it does not appear in the process list or shell history. login --from-env NAME reads the same value from the named environment variable (upper-case letters, digits and _); only the variable name is an argument, and the value is never printed.

connect and disconnect are requests: they print connect requested: <changed> or disconnect requested: <changed> and return before the tunnel state changes. Run bun vpn status afterwards to see the resulting state.

Exit status is 0 on success, 1 when the request fails and 2 on invalid usage.

Daemon

bun vpn daemon starts the same daemon implementation as the Mullvad app inside the Bun process, using Mullvad's standard settings, cache and resource paths. It handles the tunnel lifecycle, routing, DNS and leak protection. Bun's build excludes Mullvad's in-app updater.

The daemon needs the privileges and native resources of its platform:

Windows: access to the Windows Filtering Platform (WFP), plus the winfw library and WireGuard/Wintun resources used by Mullvad.
Linux: privileges to manage network interfaces, routes, DNS and firewall rules.
Android: bun vpn is not supported.

A Mullvad account is required to connect.

Licensing

The Mullvad sources are licensed under GPL-3.0-or-later and keep their upstream notices in vendor/mullvad. Distribute those notices with bun-vpn; the bun executable no longer contains them.