Connect to Mullvad VPN.

Optionally set the relay location before connecting. If no location parameters are provided, connects using the currently configured relay.

Args: country: Two-letter country code (e.g. "se", "us"). city: Three-letter city code (e.g. "got", "nyc"). hostname: Specific server hostname (e.g. "se-got-wg-004").

Returns: Current VPN status after the connect attempt, including connection state, relay hostname, country, city, and IP addresses.

Disconnect from Mullvad VPN.

Idempotent — returns current status even if already disconnected.

Returns: Current VPN status after the disconnect attempt.

Reconnect to Mullvad VPN.

Disconnects and reconnects, optionally to a new relay location.

Args: country: Two-letter country code (e.g. "se", "us"). city: Three-letter city code (e.g. "got", "nyc"). hostname: Specific server hostname (e.g. "se-got-wg-004").

Returns: Current VPN status after the reconnect attempt.

Get current Mullvad VPN connection status.

Returns: Dict with connection state, relay details, protocol, IP addresses, country, city, and whether traffic is locked down.

Check if your connection is protected by Mullvad VPN.

Queries am.i.mullvad.net to verify whether traffic exits through a Mullvad server. Use this to confirm the VPN is working correctly.

Returns: Dict with your visible IP, country, city, whether traffic exits through a Mullvad server, the exit hostname, and a leak_detected boolean (True means traffic is NOT going through Mullvad).

List all available Mullvad VPN countries with server counts.

Returns: Dict with a countries key containing a list of dicts, each with name, code, city_count, and server_count.

List available cities for a given country.

Args: country: Two-letter country code (e.g. "se", "us", "de").

Returns: Dict with a cities key containing a list of dicts, each with name, code, coordinates, and server_count.

List available Mullvad VPN servers with optional filters.

Args: country: Filter by two-letter country code (e.g. "se"). city: Filter by three-letter city code (e.g. "got"). Requires country to also be set. owned_only: If True, only show Mullvad-owned servers.

Returns: Dict with a servers key containing a list of server dicts, each with hostname, country, city, ips, provider, ownership, and protocol.

Set preferred VPN connection location.

Args: country: Two-letter country code (e.g. "se") or "any" for automatic. city: Three-letter city code (e.g. "got"). hostname: Specific server hostname (e.g. "se-got-wg-004").

Returns: Current relay constraints after the change.

Get Mullvad account information.

Returns: Dict with masked account number (last 4 digits visible), expiry date, and device name.

Get information about devices registered to the Mullvad account.

Returns: Dict with a devices list of device names registered on the account.

Get all current Mullvad VPN settings as a structured object.

Returns: Dict with keys: killswitch, dns, tunnel, relay, and anti_censorship, each containing the relevant settings.

Enable or disable the kill switch (lockdown mode).

When enabled, all network traffic is blocked unless the VPN is connected.

Args: enabled: True to enable, False to disable.

Returns: Dict with enabled boolean confirming the new state.

Enable or disable DAITA (Defence Against AI-guided Traffic Analysis).

DAITA adds padding to WireGuard traffic to defeat traffic analysis.

Args: enabled: True to enable, False to disable.

Returns: Current tunnel settings after the change.

Enable or disable multihop (chained VPN connections).

When enabled, traffic is routed through an entry server before reaching the exit server, adding an extra layer of privacy.

Args: enabled: True to enable, False to disable. entry_country: Two-letter country code for the entry server. entry_city: Three-letter city code for the entry server.

Returns: Current relay constraints after the change.

Configure DNS settings.

Args: mode: "default" for Mullvad DNS (with optional blocking), or "custom" to use your own DNS servers. servers: List of DNS server IPs when mode is "custom". block_ads: Block ad domains (default DNS mode only). block_trackers: Block tracker domains (default DNS mode only). block_malware: Block malware domains (default DNS mode only). block_adult_content: Block adult content domains (default DNS mode only). block_gambling: Block gambling domains (default DNS mode only). block_social_media: Block social media domains (default DNS mode only).

Returns: Current DNS settings after the change.

Configure WireGuard tunnel protocol options.

Note: Mullvad CLI 2026.1 is WireGuard-only. This tool configures WireGuard-specific options like quantum resistance and IPv6.

Args: quantum_resistant: Enable quantum-resistant key exchange ("on" or "off"). ipv6: Enable IPv6 in the tunnel ("on" or "off").

Returns: Current tunnel settings after the change.

Set anti-censorship / obfuscation mode.

Controls how Mullvad disguises VPN traffic to bypass censorship.

Args: mode: One of "auto", "off", "wireguard-port", "udp2tcp", "shadowsocks", "quic", or "lwo".

Returns: Current anti-censorship settings after the change.