Entry protocols and exit identity stay separate
Hysteria2, REALITY, and Cloudflare Tunnel control how a client reaches the VPS. Direct routing, WARP, and fixed SOCKS5 control how traffic leaves it. Adding TCP fallback does not change the address seen by a service when traffic still exits directly from the VPS. This distinction prevents a common design mistake.
The reference uses Xray 26.3.27 on Ubuntu 24.04. Hysteria2 listens on UDP 24443, REALITY on TCP 443, and WARP on 127.0.0.1:40000. Private and link-local destinations are blocked before service routes. These are maintainer examples, not our measurements.
Chinese-only guides limit the audience
The README, WARP guide, SOCKS guide, and configuration comments are Chinese. No English translation is present. AGENTS.md is English, but it targets AI maintainers rather than ordinary users. An English-only operator may miss warnings about route order, credentials, or failure behavior.
The 10,831-character README explains five profiles, SSH bootstrap, server requirements, ports, fail-closed routing, secrets, and official references. It tells users what to omit as well as what to add. That matters because the full example contains more components than many personal nodes require.
What happened when we ran it
We did not run Personal Edge Proxy. GitHub reports no primary language, our harness found no supported ecosystem, and the repository has no Dockerfile. It contains Markdown and sanitized examples rather than a package with detectable install or test commands. We have no measured dependency count, build, test, timing, or audit result.
A JSONC file can parse while its network behavior remains wrong for one host, Xray version, firewall, or client. The example calls for 1 vCPU, 1 GB RAM, Ubuntu 24.04 or Debian 12+, public IPv4, TCP, and UDP. Our sandbox did not provision or verify those requirements.
Hysteria2 is the smallest useful profile
The maintainer recommends Hysteria2 as the everyday entry and says users can stop when UDP works and direct egress is acceptable. REALITY is an optional TCP backup. Cloudflare Tunnel is an emergency entry. The public example is a menu rather than a mandatory stack.
A minimal host still exposes UDP 24443 and needs authentication plus TLS material. Provider policy and client compatibility matter. The README suggests 1 vCPU and 1 GB RAM, then says line quality, packet loss, peak-hour behavior, and UDP availability matter more than an advertised speed.
WARP affects selected traffic only
The WARP guide leaves the Linux default route on the VPS network. Xray sends only selected traffic to the local SOCKS5 listener. SSH, system updates, ordinary downloads, and fixed upstream connections keep their intended routes. A WARP failure therefore has a smaller effect.
The example uses port 40000 and tells operators to compare direct and proxied exit addresses. It warns that warp-svc and its socket can remain present while requests fail. Monitoring should test an outbound request. Domain rules also need maintenance as service endpoints change.
Fixed SOCKS5 is stable but unencrypted
An optional route pins selected Claude or Anthropic domains to a fixed exit. The guide says Claude does not require residential IP, WARP is not residential, and no route guarantees account acceptance. Fixed egress only makes sense when one public address must survive VPS moves or WARP reconnections.
SOCKS5 does not encrypt the proxy hop. A remote upstream on port 1080 is not a VPN, even when HTTPS protects application content. Use a trusted provider or controlled encrypted path. Keep credentials out of shell history, process lists, logs, chats, and issues.
AI deployment begins after human SSH setup
The agent guide requires a human to log in, generate an Ed25519 key locally, install only the public key, and verify key login. Password access stays enabled until that succeeds. The agent should use an existing SSH agent or configuration rather than reading private keys.
The full example has placeholders for UUIDs, REALITY keys, Hysteria2 passwords, TLS files, Cloudflare tokens, and upstream credentials. A leaked value or wrong route can be costly. Keep provider-console recovery and make staged changes, even on the suggested 1 GB host.
The August 2026 push has no release history
The repository was pushed on August 25, 2026. GitHub showed no open issues or pull requests, and the latest-release endpoint returned no release. The README pins current versions and directs readers to official Xray and Cloudflare docs where commands can change. Users still have to reconcile versions.
Operational confidence must come from staged route verification because no public issue history shows how mistakes are handled. The MIT tree is easy to read, but our lab could not supply runtime evidence without a supported target.
Use the architecture, then own the result
Chinese-reading administrators get a useful reference for separating Hysteria2, REALITY, WARP, and fixed egress roles. Xray-core is the official schema source. Hysteria is simpler when one UDP proxy is enough. sing-box suits operators who prefer a different general proxy core.
No repository can guarantee access to OpenAI, Gemini, Claude, or a regional service. Confirm availability at the exit location and follow service terms. Personal Edge Proxy is a set of examples, not an operated product. Because we could not run it, final proof belongs to the administrator.