diff --git a/docs/guide/custom-config.md b/docs/guide/custom-config.md
index c21e2e48f..f78fd306b 100644
--- a/docs/guide/custom-config.md
+++ b/docs/guide/custom-config.md
@@ -214,6 +214,13 @@ module.exports = {
 };
 ```
 
+#### quantumultXConfig.vmessAEAD
+
+- 类型: `boolean`
+- 默认值: `true`
+
+默认开启 Vmess AEAD 加密，如果您的服务器不支持 AEAD 加密，请关闭。
+
 ### clashConfig
 
 - 类型: `object`
diff --git a/docs/guide/env.md b/docs/guide/env.md
index 150ce954f..102e18735 100644
--- a/docs/guide/env.md
+++ b/docs/guide/env.md
@@ -31,9 +31,3 @@ sidebarDepth: 2
 ### `SURGIO_PROVIDER_CACHE_MAXAGE`
 
 - 默认值: `600000`（10 分钟）
-
-### `SURGIO_DISABLE_SURGE_VMESS_AEAD`
-
-- 默认值: `false`
-
-是否关闭 Surge Vmess AEAD 加密。默认开启，如果您的服务器不支持 AEAD 加密，请关闭（`SURGIO_DISABLE_SURGE_VMESS_AEAD=true`）。
diff --git a/lib/constant/env.ts b/lib/constant/env.ts
index 884a73074..eaf6cb53b 100644
--- a/lib/constant/env.ts
+++ b/lib/constant/env.ts
@@ -12,6 +12,3 @@ export const ENV_SURGIO_REMOTE_SNIPPET_CACHE_MAXAGE =
   'SURGIO_REMOTE_SNIPPET_CACHE_MAXAGE';
 
 export const ENV_SURGIO_PROVIDER_CACHE_MAXAGE = 'SURGIO_PROVIDER_CACHE_MAXAGE';
-
-export const ENV_SURGIO_DISABLE_SURGE_VMESS_AEAD =
-  'SURGIO_DISABLE_SURGE_VMESS_AEAD';
diff --git a/lib/generator/artifact.ts b/lib/generator/artifact.ts
index 6db63c7db..6ee0dd426 100644
--- a/lib/generator/artifact.ts
+++ b/lib/generator/artifact.ts
@@ -393,6 +393,7 @@ export class Artifact extends EventEmitter {
           nodeConfig.provider = provider;
           nodeConfig.surgeConfig = config.surgeConfig;
           nodeConfig.clashConfig = config.clashConfig;
+          nodeConfig.quantumultXConfig = config.quantumultXConfig;
 
           if (provider.renameNode) {
             const newName = provider.renameNode(nodeConfig.nodeName);
diff --git a/lib/misc/deprecation.ts b/lib/misc/deprecation.ts
index 7c6aaf825..5805d24da 100644
--- a/lib/misc/deprecation.ts
+++ b/lib/misc/deprecation.ts
@@ -3,3 +3,5 @@ export const DEP005 =
 export const DEP006 =
   'surgioConfig.surgeConfig.v2ray: "external" 已不推荐使用，请改为 "native"';
 export const DEP007 = 'patchYamlArray 已不推荐使用，请改为 clash';
+export const DEP008 =
+  'surgioConfig.clashConfig.ssrFormat: "legacy" 会在后续版本中移出，请使用原版 Clash 客户端';
diff --git a/lib/types.ts b/lib/types.ts
index b53f3319f..42e3f47ac 100644
--- a/lib/types.ts
+++ b/lib/types.ts
@@ -54,8 +54,11 @@ export interface CommandConfig {
     readonly shadowsocksFormat?: 'ss' | 'custom';
     readonly v2ray?: 'native' | 'external';
     readonly resolveHostname?: boolean;
+    readonly vmessAEAD?: boolean;
+  };
+  readonly quantumultXConfig?: {
+    readonly vmessAEAD?: boolean;
   };
-  readonly quantumultXConfig?: any;
   readonly clashConfig?: {
     readonly ssrFormat: 'native' | 'legacy';
   };
@@ -275,6 +278,7 @@ export interface SimpleNodeConfig {
   localPort?: number;
   surgeConfig?: CommandConfig['surgeConfig'];
   clashConfig?: CommandConfig['clashConfig'];
+  quantumultXConfig?: CommandConfig['quantumultXConfig'];
   hostnameIp?: ReadonlyArray<string>;
   provider?: Provider;
   underlyingProxy?: string;
diff --git a/lib/utils/config.ts b/lib/utils/config.ts
index df72f8a67..d5137cf89 100644
--- a/lib/utils/config.ts
+++ b/lib/utils/config.ts
@@ -4,7 +4,7 @@ import _ from 'lodash';
 import path from 'path';
 import { URL } from 'url';
 import { deprecate } from 'util';
-import { DEP005, DEP006 } from '../misc/deprecation';
+import { DEP005, DEP006, DEP008 } from '../misc/deprecation';
 
 import { CommandConfig } from '../types';
 import { PROXY_TEST_INTERVAL, PROXY_TEST_URL } from '../constant';
@@ -13,6 +13,7 @@ import { ensureConfigFolder } from './index';
 
 const showDEP005 = deprecate(_.noop, DEP005, 'DEP005');
 const showDEP006 = deprecate(_.noop, DEP006, 'DEP006');
+const showDEP008 = deprecate(_.noop, DEP008, 'DEP008');
 
 export const loadConfig = (
   cwd: string,
@@ -72,10 +73,14 @@ export const normalizeConfig = (
       shadowsocksFormat: 'ss',
       v2ray: 'native',
       resolveHostname: false,
+      vmessAEAD: false,
     },
     clashConfig: {
       ssrFormat: 'native',
     },
+    quantumultXConfig: {
+      vmessAEAD: true,
+    },
     proxyTestUrl: PROXY_TEST_URL,
     proxyTestInterval: PROXY_TEST_INTERVAL,
     checkHostname: false,
@@ -112,6 +117,11 @@ export const normalizeConfig = (
     showDEP006();
   }
 
+  // istanbul ignore next
+  if (config.clashConfig?.ssrFormat === 'legacy') {
+    showDEP008();
+  }
+
   return config;
 };
 
@@ -162,8 +172,11 @@ export const validateConfig = (userConfig: Partial<CommandConfig>): void => {
       shadowsocksFormat: Joi.string().valid('ss', 'custom'),
       v2ray: Joi.string().valid('native', 'external'),
       resolveHostname: Joi.boolean().strict(),
+      vmessAEAD: Joi.boolean().strict(),
+    }).unknown(),
+    quantumultXConfig: Joi.object({
+      vmessAEAD: Joi.boolean().strict(),
     }).unknown(),
-    quantumultXConfig: Joi.object({}).unknown(),
     clashConfig: Joi.object({
       ssrFormat: Joi.string().valid('native', 'legacy'),
     }).unknown(),
diff --git a/lib/utils/env-flag.ts b/lib/utils/env-flag.ts
index 0b87b4378..2e92ead85 100644
--- a/lib/utils/env-flag.ts
+++ b/lib/utils/env-flag.ts
@@ -3,7 +3,6 @@ import ms from 'ms';
 import {
   ENV_NETWORK_RESOLVE_TIMEOUT,
   ENV_NETWORK_TIMEOUT_KEY,
-  ENV_SURGIO_DISABLE_SURGE_VMESS_AEAD,
   ENV_SURGIO_NETWORK_CLASH_UA,
   ENV_SURGIO_NETWORK_CONCURRENCY,
   ENV_SURGIO_NETWORK_RETRY,
@@ -43,8 +42,3 @@ export const getProviderCacheMaxage = (): number =>
   process.env[ENV_SURGIO_PROVIDER_CACHE_MAXAGE]
     ? Number(process.env[ENV_SURGIO_PROVIDER_CACHE_MAXAGE])
     : ms('10m');
-
-export const getSurgeVmessAEADDisabled = (): boolean => {
-  const value = process.env[ENV_SURGIO_DISABLE_SURGE_VMESS_AEAD];
-  return value === 'true' || value === '1';
-};
diff --git a/lib/utils/index.ts b/lib/utils/index.ts
index 57889b9a7..4999032fb 100644
--- a/lib/utils/index.ts
+++ b/lib/utils/index.ts
@@ -29,7 +29,6 @@ import {
 } from '../types';
 import { ConfigCache } from './cache';
 import { ERR_INVALID_FILTER, OBFS_UA } from '../constant';
-import { getSurgeVmessAEADDisabled } from './env-flag';
 import { validateFilter } from './filter';
 import httpClient from './http-client';
 import { formatVmessUri } from './v2ray';
@@ -415,10 +414,10 @@ export const getSurgeNodes = function (
               configList.push(`test-url=${config['testUrl']}`);
             }
 
-            if (getSurgeVmessAEADDisabled()) {
-              configList.push('vmess-aead=false');
-            } else {
+            if (nodeConfig?.surgeConfig?.vmessAEAD) {
               configList.push('vmess-aead=true');
+            } else {
+              configList.push('vmess-aead=false');
             }
 
             return [config.nodeName, configList.join(', ')].join(' = ');
@@ -1101,6 +1100,9 @@ export const getQuantumultXNodes = function (
             `password=${nodeConfig.uuid}`,
             ...(nodeConfig['udp-relay'] ? ['udp-relay=true'] : []),
             ...(nodeConfig.tfo ? ['fast-open=true'] : []),
+            ...(nodeConfig.quantumultXConfig?.vmessAEAD
+              ? ['aead=true']
+              : ['aead=false']),
           ];
 
           switch (nodeConfig.network) {
diff --git a/test/snapshots/cli.test.ts.md b/test/snapshots/cli.test.ts.md
index 6c45830cd..a871bd5fa 100644
--- a/test/snapshots/cli.test.ts.md
+++ b/test/snapshots/cli.test.ts.md
@@ -23,9 +23,9 @@ Generated by [AVA](https://avajs.dev).
     🇺🇸US 4 = ss, us.example.com, 80, encrypt-method=chacha20-ietf-poly1305, password=password, obfs=http, obfs-host=www.bing.com␊
     🇺🇸US 1 = ss, us.example.com, 443, encrypt-method=chacha20-ietf-poly1305, password=password, udp-relay=undefined, obfs=tls, obfs-host=gateway-carry.icloud.com␊
     🇺🇸US 2 = ss, us.example.com, 443, encrypt-method=chacha20-ietf-poly1305, password=password, udp-relay=undefined␊
-    测试 1 = vmess, 1.1.1.1, 8080, username=1386f85e-657b-4d6e-9d56-78badb75e1fd, encrypt-method=auto, ws=true, ws-path=/, ws-headers="host:example.com|user-agent:Mozilla/5.0 (iPhone; CPU iPhone OS 13_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.1.1 Mobile/15E148 Safari/604.1", vmess-aead=true␊
-    测试 2 = vmess, 1.1.1.1, 8080, username=1386f85e-657b-4d6e-9d56-78badb75e1fd, encrypt-method=auto, vmess-aead=true␊
-    测试 tls = vmess, example.com, 443, username=1386f85e-657b-4d6e-9d56-78badb75e1fd, encrypt-method=auto, ws=true, ws-path=/, ws-headers="host:example.com|user-agent:Mozilla/5.0 (iPhone; CPU iPhone OS 13_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.1.1 Mobile/15E148 Safari/604.1", tls=true, tls13=false, skip-cert-verify=false, sni=example.com, vmess-aead=true␊
+    测试 1 = vmess, 1.1.1.1, 8080, username=1386f85e-657b-4d6e-9d56-78badb75e1fd, encrypt-method=auto, ws=true, ws-path=/, ws-headers="host:example.com|user-agent:Mozilla/5.0 (iPhone; CPU iPhone OS 13_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.1.1 Mobile/15E148 Safari/604.1", vmess-aead=false␊
+    测试 2 = vmess, 1.1.1.1, 8080, username=1386f85e-657b-4d6e-9d56-78badb75e1fd, encrypt-method=auto, vmess-aead=false␊
+    测试 tls = vmess, example.com, 443, username=1386f85e-657b-4d6e-9d56-78badb75e1fd, encrypt-method=auto, ws=true, ws-path=/, ws-headers="host:example.com|user-agent:Mozilla/5.0 (iPhone; CPU iPhone OS 13_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.1.1 Mobile/15E148 Safari/604.1", tls=true, tls13=false, skip-cert-verify=false, sni=example.com, vmess-aead=false␊
     ss1 = ss, server, 443, encrypt-method=chacha20-ietf-poly1305, password=password, udp-relay=true␊
     ss2 = ss, server, 443, encrypt-method=chacha20-ietf-poly1305, password=password, udp-relay=false, obfs=tls, obfs-host=www.bing.com␊
     ss4 = ss, server, 443, encrypt-method=chacha20-ietf-poly1305, password=password, udp-relay=false, obfs=tls, obfs-host=example.com␊
@@ -51,9 +51,9 @@ Generated by [AVA](https://avajs.dev).
     shadowsocks=us.example.com:80, method=chacha20-ietf-poly1305, password=password, obfs=http, obfs-host=www.bing.com, tag=🇺🇸US 4␊
     shadowsocks=us.example.com:443, method=chacha20-ietf-poly1305, password=password, obfs=tls, obfs-host=gateway-carry.icloud.com, tag=🇺🇸US 1␊
     shadowsocks=us.example.com:443, method=chacha20-ietf-poly1305, password=password, tag=🇺🇸US 2␊
-    vmess=1.1.1.1:8080, method=chacha20-ietf-poly1305, password=1386f85e-657b-4d6e-9d56-78badb75e1fd, obfs=ws, obfs-uri=/, obfs-host=example.com, tag=测试 1␊
-    vmess=1.1.1.1:8080, method=chacha20-ietf-poly1305, password=1386f85e-657b-4d6e-9d56-78badb75e1fd, tag=测试 2␊
-    vmess=example.com:443, method=chacha20-ietf-poly1305, password=1386f85e-657b-4d6e-9d56-78badb75e1fd, obfs=wss, obfs-uri=/, obfs-host=example.com, tag=测试 tls␊
+    vmess=1.1.1.1:8080, method=chacha20-ietf-poly1305, password=1386f85e-657b-4d6e-9d56-78badb75e1fd, aead=true, obfs=ws, obfs-uri=/, obfs-host=example.com, tag=测试 1␊
+    vmess=1.1.1.1:8080, method=chacha20-ietf-poly1305, password=1386f85e-657b-4d6e-9d56-78badb75e1fd, aead=true, tag=测试 2␊
+    vmess=example.com:443, method=chacha20-ietf-poly1305, password=1386f85e-657b-4d6e-9d56-78badb75e1fd, aead=true, obfs=wss, obfs-uri=/, obfs-host=example.com, tag=测试 tls␊
     shadowsocks=server:443, method=chacha20-ietf-poly1305, password=password, udp-relay=true, tag=ss1␊
     shadowsocks=server:443, method=chacha20-ietf-poly1305, password=password, obfs=tls, obfs-host=www.bing.com, tag=ss2␊
     shadowsocks=server:443, method=chacha20-ietf-poly1305, password=password, obfs=ws, obfs-host=server, obfs-uri=/, tag=ss3␊
@@ -467,9 +467,9 @@ Generated by [AVA](https://avajs.dev).
     `getSurgeNodes␊
     🇺🇸US 1 = ss, us.example.com, 443, encrypt-method=chacha20-ietf-poly1305, password=password, udp-relay=undefined, obfs=tls, obfs-host=gateway-carry.icloud.com␊
     🇺🇸US 2 = ss, us.example.com, 443, encrypt-method=chacha20-ietf-poly1305, password=password, udp-relay=undefined␊
-    测试 1 = vmess, 1.1.1.1, 8080, username=1386f85e-657b-4d6e-9d56-78badb75e1fd, encrypt-method=auto, ws=true, ws-path=/, ws-headers="host:example.com|user-agent:Mozilla/5.0 (iPhone; CPU iPhone OS 13_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.1.1 Mobile/15E148 Safari/604.1", vmess-aead=true␊
-    测试 2 = vmess, 1.1.1.1, 8080, username=1386f85e-657b-4d6e-9d56-78badb75e1fd, encrypt-method=auto, vmess-aead=true␊
-    测试 tls = vmess, example.com, 443, username=1386f85e-657b-4d6e-9d56-78badb75e1fd, encrypt-method=auto, ws=true, ws-path=/, ws-headers="host:example.com|user-agent:Mozilla/5.0 (iPhone; CPU iPhone OS 13_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.1.1 Mobile/15E148 Safari/604.1", tls=true, tls13=false, skip-cert-verify=false, sni=example.com, vmess-aead=true␊
+    测试 1 = vmess, 1.1.1.1, 8080, username=1386f85e-657b-4d6e-9d56-78badb75e1fd, encrypt-method=auto, ws=true, ws-path=/, ws-headers="host:example.com|user-agent:Mozilla/5.0 (iPhone; CPU iPhone OS 13_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.1.1 Mobile/15E148 Safari/604.1", vmess-aead=false␊
+    测试 2 = vmess, 1.1.1.1, 8080, username=1386f85e-657b-4d6e-9d56-78badb75e1fd, encrypt-method=auto, vmess-aead=false␊
+    测试 tls = vmess, example.com, 443, username=1386f85e-657b-4d6e-9d56-78badb75e1fd, encrypt-method=auto, ws=true, ws-path=/, ws-headers="host:example.com|user-agent:Mozilla/5.0 (iPhone; CPU iPhone OS 13_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.1.1 Mobile/15E148 Safari/604.1", tls=true, tls13=false, skip-cert-verify=false, sni=example.com, vmess-aead=false␊
     ----␊
     getNodeNames␊
     🇺🇸US 1, 🇺🇸US 2, 测试 1, 测试 2, 测试 tls␊
@@ -477,9 +477,9 @@ Generated by [AVA](https://avajs.dev).
     getQuantumultXNodes␊
     shadowsocks=us.example.com:443, method=chacha20-ietf-poly1305, password=password, obfs=tls, obfs-host=gateway-carry.icloud.com, tag=🇺🇸US 1␊
     shadowsocks=us.example.com:443, method=chacha20-ietf-poly1305, password=password, tag=🇺🇸US 2␊
-    vmess=1.1.1.1:8080, method=chacha20-ietf-poly1305, password=1386f85e-657b-4d6e-9d56-78badb75e1fd, obfs=ws, obfs-uri=/, obfs-host=example.com, tag=测试 1␊
-    vmess=1.1.1.1:8080, method=chacha20-ietf-poly1305, password=1386f85e-657b-4d6e-9d56-78badb75e1fd, tag=测试 2␊
-    vmess=example.com:443, method=chacha20-ietf-poly1305, password=1386f85e-657b-4d6e-9d56-78badb75e1fd, obfs=wss, obfs-uri=/, obfs-host=example.com, tag=测试 tls␊
+    vmess=1.1.1.1:8080, method=chacha20-ietf-poly1305, password=1386f85e-657b-4d6e-9d56-78badb75e1fd, aead=true, obfs=ws, obfs-uri=/, obfs-host=example.com, tag=测试 1␊
+    vmess=1.1.1.1:8080, method=chacha20-ietf-poly1305, password=1386f85e-657b-4d6e-9d56-78badb75e1fd, aead=true, tag=测试 2␊
+    vmess=example.com:443, method=chacha20-ietf-poly1305, password=1386f85e-657b-4d6e-9d56-78badb75e1fd, aead=true, obfs=wss, obfs-uri=/, obfs-host=example.com, tag=测试 tls␊
     ----␊
     getSurgeNodes␊
     ␊
@@ -691,9 +691,9 @@ Generated by [AVA](https://avajs.dev).
     `getSurgeNodes␊
     🇺🇸US 1 = ss, us.example.com, 443, encrypt-method=chacha20-ietf-poly1305, password=password, udp-relay=undefined, obfs=tls, obfs-host=gateway-carry.icloud.com␊
     🇺🇸US 2 = ss, us.example.com, 443, encrypt-method=chacha20-ietf-poly1305, password=password, udp-relay=undefined␊
-    测试 1 = vmess, 1.1.1.1, 8080, username=1386f85e-657b-4d6e-9d56-78badb75e1fd, encrypt-method=auto, ws=true, ws-path=/, ws-headers="host:example.com|user-agent:Mozilla/5.0 (iPhone; CPU iPhone OS 13_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.1.1 Mobile/15E148 Safari/604.1", vmess-aead=true␊
-    测试 2 = vmess, 1.1.1.1, 8080, username=1386f85e-657b-4d6e-9d56-78badb75e1fd, encrypt-method=auto, vmess-aead=true␊
-    测试 tls = vmess, example.com, 443, username=1386f85e-657b-4d6e-9d56-78badb75e1fd, encrypt-method=auto, ws=true, ws-path=/, ws-headers="host:example.com|user-agent:Mozilla/5.0 (iPhone; CPU iPhone OS 13_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.1.1 Mobile/15E148 Safari/604.1", tls=true, tls13=true, skip-cert-verify=true, sni=example.com, vmess-aead=true␊
+    测试 1 = vmess, 1.1.1.1, 8080, username=1386f85e-657b-4d6e-9d56-78badb75e1fd, encrypt-method=auto, ws=true, ws-path=/, ws-headers="host:example.com|user-agent:Mozilla/5.0 (iPhone; CPU iPhone OS 13_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.1.1 Mobile/15E148 Safari/604.1", vmess-aead=false␊
+    测试 2 = vmess, 1.1.1.1, 8080, username=1386f85e-657b-4d6e-9d56-78badb75e1fd, encrypt-method=auto, vmess-aead=false␊
+    测试 tls = vmess, example.com, 443, username=1386f85e-657b-4d6e-9d56-78badb75e1fd, encrypt-method=auto, ws=true, ws-path=/, ws-headers="host:example.com|user-agent:Mozilla/5.0 (iPhone; CPU iPhone OS 13_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.1.1 Mobile/15E148 Safari/604.1", tls=true, tls13=true, skip-cert-verify=true, sni=example.com, vmess-aead=false␊
     ----␊
     getNodeNames␊
     🇺🇸US 1, 🇺🇸US 2, 测试 1, 测试 2, 测试 tls␊
@@ -701,9 +701,9 @@ Generated by [AVA](https://avajs.dev).
     getQuantumultXNodes␊
     shadowsocks=us.example.com:443, method=chacha20-ietf-poly1305, password=password, obfs=tls, obfs-host=gateway-carry.icloud.com, tls13=true, tag=🇺🇸US 1␊
     shadowsocks=us.example.com:443, method=chacha20-ietf-poly1305, password=password, tls13=true, tag=🇺🇸US 2␊
-    vmess=1.1.1.1:8080, method=chacha20-ietf-poly1305, password=1386f85e-657b-4d6e-9d56-78badb75e1fd, obfs=ws, obfs-uri=/, obfs-host=example.com, tag=测试 1␊
-    vmess=1.1.1.1:8080, method=chacha20-ietf-poly1305, password=1386f85e-657b-4d6e-9d56-78badb75e1fd, tag=测试 2␊
-    vmess=example.com:443, method=chacha20-ietf-poly1305, password=1386f85e-657b-4d6e-9d56-78badb75e1fd, obfs=wss, obfs-uri=/, obfs-host=example.com, tls13=true, tag=测试 tls␊
+    vmess=1.1.1.1:8080, method=chacha20-ietf-poly1305, password=1386f85e-657b-4d6e-9d56-78badb75e1fd, aead=true, obfs=ws, obfs-uri=/, obfs-host=example.com, tag=测试 1␊
+    vmess=1.1.1.1:8080, method=chacha20-ietf-poly1305, password=1386f85e-657b-4d6e-9d56-78badb75e1fd, aead=true, tag=测试 2␊
+    vmess=example.com:443, method=chacha20-ietf-poly1305, password=1386f85e-657b-4d6e-9d56-78badb75e1fd, aead=true, obfs=wss, obfs-uri=/, obfs-host=example.com, tls13=true, tag=测试 tls␊
     ----␊
     getSurgeNodes␊
     ␊
@@ -750,9 +750,9 @@ Generated by [AVA](https://avajs.dev).
     `getSurgeNodes␊
     ss1 = ss, server, 443, encrypt-method=chacha20-ietf-poly1305, password=password, udp-relay=true␊
     ss2 = ss, server, 443, encrypt-method=chacha20-ietf-poly1305, password=password, udp-relay=true, obfs=tls, obfs-host=www.bing.com␊
-    vmess = vmess, server, 443, username=uuid, encrypt-method=auto, vmess-aead=true␊
-    vmess new format = vmess, server, 443, username=uuid, encrypt-method=auto, ws=true, ws-path=/path, ws-headers="host:v2ray.com|user-agent:Mozilla/5.0 (iPhone; CPU iPhone OS 13_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.1.1 Mobile/15E148 Safari/604.1", tls=true, tls13=true, skip-cert-verify=true, sni=v2ray.com, vmess-aead=true␊
-    vmess custom header = vmess, server, 443, username=uuid, encrypt-method=auto, ws=true, ws-path=/path, ws-headers="host:server|user-agent:Mozilla/5.0 (iPhone; CPU iPhone OS 13_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.1.1 Mobile/15E148 Safari/604.1|edge:www.baidu.com", tls=true, tls13=true, skip-cert-verify=false, sni=server, vmess-aead=true␊
+    vmess = vmess, server, 443, username=uuid, encrypt-method=auto, vmess-aead=false␊
+    vmess new format = vmess, server, 443, username=uuid, encrypt-method=auto, ws=true, ws-path=/path, ws-headers="host:v2ray.com|user-agent:Mozilla/5.0 (iPhone; CPU iPhone OS 13_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.1.1 Mobile/15E148 Safari/604.1", tls=true, tls13=true, skip-cert-verify=true, sni=v2ray.com, vmess-aead=false␊
+    vmess custom header = vmess, server, 443, username=uuid, encrypt-method=auto, ws=true, ws-path=/path, ws-headers="host:server|user-agent:Mozilla/5.0 (iPhone; CPU iPhone OS 13_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.1.1 Mobile/15E148 Safari/604.1|edge:www.baidu.com", tls=true, tls13=true, skip-cert-verify=false, sni=server, vmess-aead=false␊
     http 1 = https, server, 443, username, password, skip-cert-verify=false, tls13=true␊
     http 2 = http, server, 443, username, password␊
     snell = snell, server, 44046, psk=yourpsk, obfs=http␊
@@ -765,9 +765,9 @@ Generated by [AVA](https://avajs.dev).
     shadowsocks=server:443, method=chacha20-ietf-poly1305, password=password, udp-relay=true, tag=ss1␊
     shadowsocks=server:443, method=chacha20-ietf-poly1305, password=password, obfs=tls, obfs-host=www.bing.com, udp-relay=true, tag=ss2␊
     shadowsocks=server:443, method=chacha20-ietf-poly1305, password=password, obfs=ws, obfs-host=server, obfs-uri=/, udp-relay=true, tag=ss3␊
-    vmess=server:443, method=chacha20-ietf-poly1305, password=uuid, udp-relay=true, tag=vmess␊
-    vmess=server:443, method=chacha20-ietf-poly1305, password=uuid, udp-relay=true, obfs=wss, obfs-uri=/path, obfs-host=v2ray.com, tls13=true, tag=vmess new format␊
-    vmess=server:443, method=chacha20-ietf-poly1305, password=uuid, udp-relay=true, obfs=wss, obfs-uri=/path, obfs-host=server, tls13=true, tag=vmess custom header␊
+    vmess=server:443, method=chacha20-ietf-poly1305, password=uuid, udp-relay=true, aead=true, tag=vmess␊
+    vmess=server:443, method=chacha20-ietf-poly1305, password=uuid, udp-relay=true, aead=true, obfs=wss, obfs-uri=/path, obfs-host=v2ray.com, tls13=true, tag=vmess new format␊
+    vmess=server:443, method=chacha20-ietf-poly1305, password=uuid, udp-relay=true, aead=true, obfs=wss, obfs-uri=/path, obfs-host=server, tls13=true, tag=vmess custom header␊
     http=server:443, username=username, password=password, over-tls=true, tls-verification=true, tls13=true, tag=http 1␊
     http=server:443, username=username, password=password, tag=http 2␊
     shadowsocks=server:443, method=chacha20-ietf-poly1305, password=password, obfs=tls, obfs-host=example.com, udp-relay=true, tag=ss4␊
diff --git a/test/snapshots/cli.test.ts.snap b/test/snapshots/cli.test.ts.snap
index 3da24eb11..6c22b3348 100644
Binary files a/test/snapshots/cli.test.ts.snap and b/test/snapshots/cli.test.ts.snap differ
diff --git a/test/utils/index.test.ts b/test/utils/index.test.ts
index 392840039..c40fb9d37 100644
--- a/test/utils/index.test.ts
+++ b/test/utils/index.test.ts
@@ -232,11 +232,11 @@ test('getSurgeNodes', async (t) => {
   );
   t.is(
     txt1[4],
-    '测试 4 = vmess, 1.1.1.1, 8080, username=1386f85e-657b-4d6e-9d56-78badb75e1fd, encrypt-method=auto, ws=true, ws-path=/, ws-headers="host:1.1.1.1|user-agent:Mozilla/5.0 (iPhone; CPU iPhone OS 13_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.1.1 Mobile/15E148 Safari/604.1", tls=true, vmess-aead=true',
+    '测试 4 = vmess, 1.1.1.1, 8080, username=1386f85e-657b-4d6e-9d56-78badb75e1fd, encrypt-method=auto, ws=true, ws-path=/, ws-headers="host:1.1.1.1|user-agent:Mozilla/5.0 (iPhone; CPU iPhone OS 13_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.1.1 Mobile/15E148 Safari/604.1", tls=true, vmess-aead=false',
   );
   t.is(
     txt1[5],
-    '测试 5 = vmess, 1.1.1.1, 8080, username=1386f85e-657b-4d6e-9d56-78badb75e1fd, encrypt-method=auto, vmess-aead=true',
+    '测试 5 = vmess, 1.1.1.1, 8080, username=1386f85e-657b-4d6e-9d56-78badb75e1fd, encrypt-method=auto, vmess-aead=false',
   );
   t.is(
     txt1[6],
@@ -256,11 +256,11 @@ test('getSurgeNodes', async (t) => {
   );
   t.is(
     txt1[10],
-    '测试 6 = vmess, 1.1.1.1, 8080, username=1386f85e-657b-4d6e-9d56-78badb75e1fd, encrypt-method=auto, ws=true, ws-path=/, ws-headers="host:1.1.1.1|user-agent:Mozilla/5.0 (iPhone; CPU iPhone OS 13_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.1.1 Mobile/15E148 Safari/604.1", tls=true, tls13=true, skip-cert-verify=true, tfo=true, mptcp=true, vmess-aead=true',
+    '测试 6 = vmess, 1.1.1.1, 8080, username=1386f85e-657b-4d6e-9d56-78badb75e1fd, encrypt-method=auto, ws=true, ws-path=/, ws-headers="host:1.1.1.1|user-agent:Mozilla/5.0 (iPhone; CPU iPhone OS 13_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.1.1 Mobile/15E148 Safari/604.1", tls=true, tls13=true, skip-cert-verify=true, tfo=true, mptcp=true, vmess-aead=false',
   );
   t.is(
     txt1[11],
-    '测试 7 = vmess, 1.1.1.1, 8080, username=1386f85e-657b-4d6e-9d56-78badb75e1fd, encrypt-method=auto, ws=true, ws-path=/, ws-headers="host:1.1.1.1|user-agent:Mozilla/5.0 (iPhone; CPU iPhone OS 13_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.1.1 Mobile/15E148 Safari/604.1", tls=true, tls13=true, skip-cert-verify=true, tfo=true, mptcp=true, underlying-proxy=another-proxy, vmess-aead=true',
+    '测试 7 = vmess, 1.1.1.1, 8080, username=1386f85e-657b-4d6e-9d56-78badb75e1fd, encrypt-method=auto, ws=true, ws-path=/, ws-headers="host:1.1.1.1|user-agent:Mozilla/5.0 (iPhone; CPU iPhone OS 13_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.1.1 Mobile/15E148 Safari/604.1", tls=true, tls13=true, skip-cert-verify=true, tfo=true, mptcp=true, underlying-proxy=another-proxy, vmess-aead=false',
   );
 
   t.is(
@@ -443,7 +443,7 @@ test('getSurgeNodes', async (t) => {
         testUrl: 'http://www.google.com',
       },
     ]),
-    '测试 6 = vmess, 1.1.1.1, 8080, username=1386f85e-657b-4d6e-9d56-78badb75e1fd, encrypt-method=auto, ws=true, ws-path=/, ws-headers="host:1.1.1.1|user-agent:Mozilla/5.0 (iPhone; CPU iPhone OS 13_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.1.1 Mobile/15E148 Safari/604.1", tls=true, tls13=true, skip-cert-verify=true, tfo=true, mptcp=true, test-url=http://www.google.com, vmess-aead=true',
+    '测试 6 = vmess, 1.1.1.1, 8080, username=1386f85e-657b-4d6e-9d56-78badb75e1fd, encrypt-method=auto, ws=true, ws-path=/, ws-headers="host:1.1.1.1|user-agent:Mozilla/5.0 (iPhone; CPU iPhone OS 13_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.1.1 Mobile/15E148 Safari/604.1", tls=true, tls13=true, skip-cert-verify=true, tfo=true, mptcp=true, test-url=http://www.google.com, vmess-aead=false',
   );
 });
 
@@ -1538,15 +1538,15 @@ test('getQuantumultXNodes', (t) => {
 
   t.is(
     schemeList[0],
-    'vmess=1.1.1.1:8080, method=chacha20-ietf-poly1305, password=1386f85e-657b-4d6e-9d56-78badb75e1fd, obfs=ws, obfs-uri=/, obfs-host=example.com, tag=测试 1',
+    'vmess=1.1.1.1:8080, method=chacha20-ietf-poly1305, password=1386f85e-657b-4d6e-9d56-78badb75e1fd, aead=false, obfs=ws, obfs-uri=/, obfs-host=example.com, tag=测试 1',
   );
   t.is(
     schemeList[1],
-    'vmess=1.1.1.1:8080, method=chacha20-ietf-poly1305, password=1386f85e-657b-4d6e-9d56-78badb75e1fd, tag=测试 2',
+    'vmess=1.1.1.1:8080, method=chacha20-ietf-poly1305, password=1386f85e-657b-4d6e-9d56-78badb75e1fd, aead=false, tag=测试 2',
   );
   t.is(
     schemeList[2],
-    'vmess=1.1.1.1:8080, method=chacha20-ietf-poly1305, password=1386f85e-657b-4d6e-9d56-78badb75e1fd, udp-relay=true, obfs=ws, obfs-uri=/, obfs-host=1.1.1.1, tag=测试 3',
+    'vmess=1.1.1.1:8080, method=chacha20-ietf-poly1305, password=1386f85e-657b-4d6e-9d56-78badb75e1fd, udp-relay=true, aead=false, obfs=ws, obfs-uri=/, obfs-host=1.1.1.1, tag=测试 3',
   );
   t.is(
     schemeList[3],
@@ -1562,7 +1562,7 @@ test('getQuantumultXNodes', (t) => {
   );
   t.is(
     schemeList[6],
-    'vmess=1.1.1.1:443, method=chacha20-ietf-poly1305, password=1386f85e-657b-4d6e-9d56-78badb75e1fd, obfs=over-tls, tag=测试 4',
+    'vmess=1.1.1.1:443, method=chacha20-ietf-poly1305, password=1386f85e-657b-4d6e-9d56-78badb75e1fd, aead=false, obfs=over-tls, tag=测试 4',
   );
 
   t.is(
@@ -1581,7 +1581,29 @@ test('getQuantumultXNodes', (t) => {
         uuid: '1386f85e-657b-4d6e-9d56-78badb75e1fd',
       },
     ]),
-    'vmess=1.1.1.1:443, method=chacha20-ietf-poly1305, password=1386f85e-657b-4d6e-9d56-78badb75e1fd, udp-relay=true, obfs=over-tls, tls13=true, tag=测试',
+    'vmess=1.1.1.1:443, method=chacha20-ietf-poly1305, password=1386f85e-657b-4d6e-9d56-78badb75e1fd, udp-relay=true, aead=false, obfs=over-tls, tls13=true, tag=测试',
+  );
+
+  t.is(
+    utils.getQuantumultXNodes([
+      {
+        type: NodeTypeEnum.Vmess,
+        alterId: '64',
+        hostname: '1.1.1.1',
+        method: 'auto',
+        network: 'tcp',
+        nodeName: '测试',
+        port: 443,
+        tls: true,
+        tls13: true,
+        'udp-relay': true,
+        uuid: '1386f85e-657b-4d6e-9d56-78badb75e1fd',
+        quantumultXConfig: {
+          vmessAEAD: true,
+        },
+      },
+    ]),
+    'vmess=1.1.1.1:443, method=chacha20-ietf-poly1305, password=1386f85e-657b-4d6e-9d56-78badb75e1fd, udp-relay=true, aead=true, obfs=over-tls, tls13=true, tag=测试',
   );
   t.is(
     utils.getQuantumultXNodes([