One panel generates profiles for several proxy clients
BPB Worker Panel turns a Cloudflare Worker or Pages deployment into a password-protected configuration panel. It produces VLESS, Trojan, and Warp subscriptions for clients built on Xray, sing-box, Clash or Mihomo, WireGuard, and Amnezia. Operators can set DNS-over-HTTPS, routing rules, chain proxies, proxy IPs, clean IPs, protocol choices, and custom domains without hand-editing every client profile.
That convenience is most useful when one person has several devices or client applications. The panel can aggregate other proxies and publish them in a single subscription. Version 5.1.1 also adds Telegram commands, request monitoring, in-panel updates, settings import and export, and a supported-client section. More controls mean more generated combinations, so compatibility must be tested rather than inferred from a successful panel login.
A 10-second build had no test suite behind it
We cloned commit 9b2e33e into an unprivileged Debian container with 3 CPUs and 8 GB of RAM. The 1.6 MB checkout held 130 files and about 10,661 source lines. Npm installed 204 packages in 29 seconds, using 93 MB on disk. The build succeeded in 10 seconds, which makes the source inexpensive to inspect and package.
There was no test script, so our harness skipped tests. The repository also had 2 CI workflow files, no Dockerfile, and no tests directory. Npm audit found 0 known vulnerabilities at critical, high, moderate, or low severity in the installed dependency tree. A clean audit is welcome, but it does not exercise authentication, subscription encoding, Cloudflare APIs, or client compatibility.
What happened when we ran it
Our sandbox result was a 29-second install and a 10-second build, both successful. The install added 204 packages and occupied 93 MB. We did not deploy the Worker, sign into Cloudflare, use the BPB Wizard, open the panel, generate a subscription, connect a proxy client, test DNS, or measure network speed or availability.
Because the package has no test target, there is no lab pass count to report. Claims about connectivity, privacy, firewall behavior, request capacity, and supported clients come from project documentation or issue reports, not our runtime verification. An evaluator should create a disposable Cloudflare deployment and test one client and one network path before migrating any existing configuration.
Version 5.1.1 depends on the hosted Wizard
The latest release was v5.1.1, published July 19, 2026. Its notes say this version can be deployed only through the online BPB Wizard; manual deployment and BPB Wizard client deployment do not work. The Wizard creates a private link for later management and generates a random secure path for the panel. Losing those links can make administration harder, while exposing them weakens the intended access boundary.
The release also moves fixed values such as VLESS UUID, Trojan password, panel path, proxy IPs, NAT64 prefixes, and fallback domain out of Cloudflare environment variables and hardcodes them into the generated script. The project says this avoids D1 delay and infrastructure inconsistencies. Operators should understand the consequence: generated Worker source becomes sensitive configuration and belongs under the same protection as credentials.
The 100,000-request limit keeps this personal
The README states that each Worker supports 100,000 requests per day for VLESS and Trojan, which it describes as suitable for 2 to 3 users. Warp configurations are described as not having that limit. This is not a capacity model for a public or departmental service. Request behavior varies with client traffic, and Cloudflare's current terms and limits should be checked directly before deployment.
UDP is the other hard boundary. Worker-based VLESS and Trojan do not handle it properly, so UDP is disabled by default and UDP DNS is unsupported. The README names Telegram video calls as an affected use case and uses DoH instead. A profile that browses the web successfully may still fail voice, gaming, or another UDP-heavy application. Test the actual application, not just an IP-check page.
Client matrices age faster than the panel
The README lists minimum client versions and marks Fragment and Warp Pro support separately. Some clients support one but not the other. Release v5.1.1 specifically tells users to update their clients, naming v2rayNG 2.2.3, MahsaNG 16, v2rayN 7.22.5, sing-box 1.12.0, and Streisand 1.6.71 as minimums in that release note. Those requirements should be treated as a compatibility snapshot.
Issue 1423 reports that a v5.1.1 sing-box import link is rejected by sing-box 1.13.18 and NekoBox 1.4.2, while manually importing the embedded HTTPS URL works. Issue 1424 reports a custom domain failing to save on 2 panels. Neither report proves every installation is affected. Both justify a post-update checklist covering panel login, subscription refresh, direct import links, custom domain output, and every core in use.
July activity is healthy, while support is bilingual
GitHub showed 13,238 stars, 10 combined issues and pull requests, and a last push on July 20, 2026. The README is in English and links a Farsi version; much of the current issue discussion is in Farsi, with the issue template presenting both languages. English documentation exists, but an English-only operator may need translation for community troubleshooting.
The GPL-3.0 license allows use and modification under its terms. BPB is a polished convenience layer for a narrow deployment model, not a general VPN service. The 0-advisory npm audit and quick build support a trial. The missing tests, Cloudflare dependency, Wizard-only installation, UDP limit, and client-specific edge cases are reasons to keep the user count small and the original configurations recoverable.