Home / Egress and tunnels
wgcf
github.com/ViRb3/wgcfTool (wireguard transport)egress/wgcfJSONcomparereport an errorprovider JSON
- Free allowance
- No service and no account; a CLI that registers with Cloudflare and writes a profile
- Verdict
- self-hosted, last resortverdict qualifies-with-caveat: usable, with a named limit or an unprobed read path. Self-hosted options are listed last, because this site is for users who have no hardware.
- Cost
- not statedsee Price below
- Identity
- anonymousno card, no phone
- Binding limit
- noneno named constraint binds
- Evidence
- documented4 sources; a first-party page was read and the sentence quoted
- Freshness
- stale on 2026-11-23checked 2026-10-23 (live); stale on 2026-11-23
| Free tier | no service and no account; a CLI that registers with Cloudflare and writes a profile unit none; metered on none |
|---|
| Price | USD 0 |
|---|
| Binding | none the tool adds no limit; the limit that matters is whatever WARP applies, and its record carries none published |
|---|
| Identity | anonymous no account and no card; "wgcf register" creates the Cloudflare device registration from the CLI |
|---|
| Egress | not stated by this tool; the profile reaches Cloudflare WARP, whose allowance is recorded at egress/cloudflare-warp as no published cap; ingress: none free allowance: none published |
|---|
| Interface | cli wgcf register / generate / status / trace |
|---|
| Tooling | single static binary; outputs a wg-quick profile |
|---|
| Composes with | generates the .conf that cloudflare-warp's record describes, and the profile can then be fed to a router, gluetun, or a kernel interface. |
|---|
| Reliability | usque reports that WARP+ over WireGuard stopped working for some accounts (wgcf issue 459); the generated MTU of 1280 is conservative and can be raised |
|---|
| Notes | The yes case for the router question: it emits an ordinary .conf, so a router that accepts a standard WireGuard profile can be driven from it with no wrapper. The WARP endpoint is UDP, so the router must have UDP egress. usque's README reports that WARP+ over WireGuard may have stopped working for some accounts, citing wgcf issue 459, which is the reason to keep usque as the fallback. |
|---|
| Evidence note | documented a probe that brings the generated profile up and moves bytes would raise it to measured |
|---|
| Parsed numbers | |
|---|
Evidence 4
| date | source | what it proved |
|---|
| 2026-10-23 | github.com/ViRb3/wgcf | the register / generate / license-key feature list and the wgcf-profile.conf output |
| 2026-10-23 | github.com/ViRb3/wgcf | "To ensure maximum compatibility, the generated profile will have a MTU of 1280" and --keepalive adds PersistentKeepalive |
| 2026-10-23 | github.com/ViRb3/wgcf | release v2.3.1 published 2026-10-11; last push 2026-10-20; 8826 stars |
| 2026-10-23 | github.com/ViRb3/wgcf | the Warp+ binding is capped: "there is a limit of 5 maximum devices linked at a time" |
More fields 9
| wg path | registration-api |
|---|
| wg detail | "wgcf register" saves wgcf-account.toml and "wgcf generate" writes wgcf-profile.conf, which is a standard WireGuard profile with MTU 1280 |
|---|
| ingress | none |
|---|
| volume stated | not stated by this tool; the profile reaches Cloudflare WARP, whose allowance is recorded at egress/cloudflare-warp as no published cap |
|---|
| bytes transit | yes |
|---|
| transit note | traffic exits through Cloudflare's network once the profile is up |
|---|
| hosting requirement | none; runs on the device and emits a .conf |
|---|
| last release | v2.3.1 2026-10-11 |
|---|
| stars | 8826 |
|---|
Unknown values 3
- egress metered: egress metering was not published
- per object cap stated: the field does not apply to this kind of offer
- retention stated: the field does not apply to this kind of offer