FAQ
Why do profile changes need a VPN restart?
MintFlow profiles are not interpreted directly by the running VPN tunnel.
When you activate a profile, MintFlow compiles the text profile into an internal runtime database. That compiled database is what the packet tunnel, DNS server, routing engine, L3 VPN interfaces, L4 proxies, and HTTP engine load while the VPN is running.
Because the running tunnel keeps this compiled runtime state in memory, changing the profile text or app settings does not automatically replace all active routes, DNS policies, proxy chains, VPN peers, and HTTP engine rules in the live tunnel. Restarting VPN is the explicit handoff point: MintFlow stops the old runtime, compiles the current profile again, and starts the tunnel with a consistent database snapshot.
This avoids partially applied configurations, stale routes, stale DNS policy, and mismatches between the UI profile and the runtime networking stack.
Some explicit runtime controls apply live, including starting/stopping an HTTP capture and changing Tailscale Accept Routes or exit-node selection. These controls do not mean that arbitrary profile edits apply live.
Does MintFlow 2.0.0 support Tailscale?
Yes, experimentally, with an active Pro entitlement, including an eligible active subscription trial. You can log in through a browser or an auth key and choose which IPv4 traffic enters the tailnet. See Tailscale setup and login for a complete profile and the initial integration's limitations.
Why am I still logged into Tailscale after deleting and reinstalling MintFlow?
Tailscale machine state is stored in device-local Keychain, not ordinary app sandbox files. On the same device, restoring the same profile through enabled iCloud profile sync can therefore reuse the existing login. The state is keyed by the profile UUID and login server; a newly created profile with similar text is not necessarily the same identity.
iCloud restores the profile, not the Tailscale machine state. That state is device-only, so another device needs its own login. Reinstalling is not a reliable logout or a guaranteed identity backup. Explicit logout, device erasure, missing Keychain state, or tailnet revocation may require you to authenticate again.
Use Tools → Tailscale → Identity → Log Out when you want to log out. Clear Bootstrap Auth Key only removes the saved enrollment key. Forget Local Identity is for recovery and does not remove the old node from the Tailscale admin console.
What happens to Tailscale when my Pro trial expires?
Without another active Pro entitlement, the feature locks. When compiling the profile, MintFlow excludes the Tailscale interface and turns routes that target it into REJECT, preventing an unintended fallback to Direct. Check compilation diagnostics and deliberately choose another output if needed. Expiry itself does not erase the Keychain identity; a renewed entitlement may reuse it if it remains valid.
Can I ask an AI agent to create an HTTP rewrite?
Yes. Export stopped captures as an Agent Analysis Bundle, then give the agent a specific task and the included MFHRB specification. Import the returned .mfhrb file from HTTP → Rewrite, review the disabled rule, test it, and explicitly enable it before restarting VPN. The complete guide explains the archive, privacy options, script API, and repeat imports.
Is an Agent Analysis Bundle anonymous?
No. Analysis mode redacts query values and known credential headers, but included bodies and optional current rules are not automatically redacted. Inspect them before sharing. Original Database mode preserves original capture data. MintFlow does not automatically upload either export to an AI service.