frp is a high-performance reverse proxy application that exposes local services behind NAT or firewalls to the internet. It implements a client-server architecture where the frpc client connects to the frps server, registers proxies (TCP, UDP, HTTP, HTTPS, STCP, XTCP, TCPMUX), and tunnels traffic through encrypted, compressed connections. The system supports multiple transport protocols (TCP, KCP, QUIC, WebSocket, WSS), authentication (token, OIDC), health checks, load balancing, bandwidth limiting, and a plugin system for both client and server extensions. It also includes NAT hole punching for direct peer-to-peer connections and an SSH tunnel gateway that allows SSH clients to create tunnels without frpc. The codebase is well-structured with clear separation of concerns: configuration loading and validation in pkg/config/, wire protocol and message handling in pkg/msg/ and pkg/proto/, network utilities in pkg/util/net/, and proxy implementations in server/proxy/ and client/proxy/. The project includes comprehensive end-to-end tests, a Vue.js web dashboard for both server and client management, Prometheus metrics, and a store API for dynamic proxy configuration at runtime. The architecture is modular, using factory patterns for proxy types, visitor patterns for P2P connections, and an aggregator pattern for merging configuration sources. Despite its complexity, the codebase is actively maintained with regular releases, extensive documentation, and a large community. It demonstrates strong engineering practices including interface-based design, dependency injection for testability, and careful concurrency management. The main technical debt is the coexistence of legacy INI configuration and v1 wire protocol alongside newer formats, but these are well-isolated and migration paths are provided.
mitmproxy is a production-grade, interactive HTTPS proxy that intercepts, inspects, modifies, and replays HTTP/1, HTTP/2, HTTP/3, WebSocket, TCP, UDP, DNS, and QUIC traffic. It supports multiple proxy modes (regular, transparent, reverse, upstream, SOCKS5, DNS, WireGuard, TUN, local) and provides three frontends: a console TUI (mitmproxy), a command-line dump tool (mitmdump), and a web UI (mitmweb). The architecture is event-driven with a sans-IO proxy layer design: protocol layers yield commands and events processed by an asyncio event loop. An extensive addon system allows users to extend functionality via lifecycle hooks, custom commands, and content views. The codebase is well-structured, heavily typed, and includes a comprehensive test suite with fuzzing and benchmarks. It is actively maintained with frequent releases and security patches.
Headroom is a context optimization layer for LLM applications that reduces token usage by 50-90% through intelligent compression, caching, and memory systems. It provides a transparent proxy between LLM clients (like Claude Code, Cursor, etc.) and LLM providers (Anthropic, OpenAI, etc.), implementing CCR (Compress-Cache-Retrieve) for lossless compression with retrieval capability. The system features a hybrid polyglot architecture with a Rust-based high-performance proxy core, Python ecosystem for extensibility, and TypeScript SDK. Key capabilities include agent wrapping, cross-agent memory using Qdrant/Neo4j, observability through metrics and dashboard, and a learning system that analyzes interaction patterns to generate optimization rules. Deployment options include Docker, system services, and direct execution.
This repository implements a local MTProto proxy for Telegram Desktop, designed to bypass network censorship by wrapping Telegram's protocol in WebSocket connections, often routed through Cloudflare. It is a fully-featured desktop application with CLI and GUI modes, providing a robust solution for circumventing DPI-based blocking. The architecture is a monolithic asyncio application with a clear separation of concerns: the `proxy/` package handles the core protocol translation (MTProto to WebSocket, Fake TLS, HTTP/2 multiplexing), the `ui/` package provides a cross-platform tray interface using CustomTkinter, and `utils/` contains supporting infrastructure like update management and diagnostics. The system employs a sophisticated fallback chain (WebSocket pool -> Cloudflare Proxy -> Cloudflare Worker -> Direct TCP) to ensure reliability. The codebase demonstrates high engineering craftsmanship. It features several genuinely reusable components, including a custom `httpx` HTTP/2 transport, a robust connection pool with exponential backoff, and an atomic self-update mechanism with rollback. While tightly coupled to Telegram's specific protocol, the underlying patterns for network resource management, protocol obfuscation, and desktop application lifecycle are well-isolated and could be extracted for other projects. The extensive test suite and professional CI/CD pipeline further attest to its quality.
v2rayN is a cross-platform GUI client for managing proxy configurations (V2Ray, Xray, sing-box, etc.). It features dual UI frameworks (WPF for Windows, Avalonia for Linux/macOS) with shared MVVM architecture using ReactiveUI. The application handles server management, subscription processing, routing rules, DNS configuration, system proxy control, and traffic statistics. Core functionality includes generating core-specific configuration files, testing server performance, and integrating with external proxy binaries. The codebase demonstrates strong separation of concerns with distinct layers for models, services, handlers, and viewmodels.
LiteLLM is a production-grade, open-source proxy/gateway for over 200 large language model (LLM) providers, including OpenAI, Anthropic, Azure, Bedrock, Gemini, and many more. It presents a unified OpenAI-compatible API, handling request routing, authentication, rate limiting, cost tracking, caching, guardrails (content filtering, PII detection), and audit logging. The system is architected as a FastAPI Python server with a Next.js admin dashboard, Rust extensions for performance-critical paths (token counting, caching, auth, cost calculation), and optional PostgreSQL/Redis backends. It supports streaming, MCP (Model Context Protocol), A2A (Agent-to-Agent) protocol, and enterprise features like SSO, secret management, and Terraform deployment modules. Key entry points include the proxy server (litellm/proxy/proxy_server.py), CLI commands (litellm, litellm-proxy), and the admin UI at /ui/litellm-dashboard. The primary data flow is from client requests (chat completions, embeddings, audio, images) received by the proxy, which authenticates, applies guardrails, routes to the configured LLM provider(s), logs usage, and returns a standardized response. Caching is multi-tier (Redis, disk, S3, GCS, Azure Blob, semantic). Spend tracking is aggregated into daily tables and exposed via the management API and UI. External dependencies include PostgreSQL (via Prisma ORM), Redis (for distributed caching, rate limiting, and queuing), and cloud-specific secret managers (AWS Secrets Manager, GCP Secret Manager, Azure Key Vault, HashiCorp Vault). The project uses uv for Python dependency management, Cargo for Rust crates, and npm/pnpm for the dashboard. Extensive CI/CD pipelines (CircleCI, GitHub Actions) run unit, integration, e2e, mutation, and Rust-Python parity tests.
FlClash is a production multi-platform proxy/VPN client that embeds and manages the mihomo (Clash.Meta) Go core. The Dart/Flutter app (Riverpod, Drift, freezed) drives a real core lifecycle: profile/subscription import and validation, proxy group and rule management, TUN/VPN on Android, system proxy on desktop, live connections/requests/DNS views, latency probing, streaming-service availability checks, and WebDAV backup/restore. The Go core exposes a method-dispatch IPC contract (updateConfig, changeProxy, getConnections, watchRoute, probe, serviceCheck, etc.) consumed through an Android cgo bridge and a desktop helper process. This is a full application, not a library or data project — no notebooks, no research pipelines. The architecture is layered: Flutter UI → manager/provider layers → core controller → framed JSON IPC → Go mihomo core. Desktop builds add a Rust privileged helper service (systemd unit / Windows SCM, Unix socket with peer-credential auth) and Rust plugins for global hotkeys, QuickJS evaluation of script-based profile overrides, and a rope-backed code editor (code_forge). Native integration plugins for system tray, window management, system proxy, and WiFi SSID are shipped as separate Dart packages with per-OS implementations in C++/Swift/Kotlin. A custom build-hook system compiles and SHA-256-fingerprints the Go core and Rust helper artifacts with file-locking to make native builds cacheable and idempotent. The codebase is unusually disciplined. Test/ subdirectories include contract tests that parse Go structs from the mihomo submodule to verify DNS-override parity, AST-parsing tests verifying every core method is dispatchable, architectural lint tests (platform layering, dead-file detection, UI tooltip enforcement, Material-icon bans), plus unit and widget tests across every layer. Concurrency is handled deliberately: priority message batching between core and UI, serial task scheduling, claim/cancel semantics for GEO/probe updates, and an Android service state machine with newest-request-wins arbitration. Release tooling generates changelogs from conventional commits and a CI pipeline produces deb/rpm/AppImage/DMG/Inno packages. Caveats: the polyglot stack (Dart, Go, Rust, Kotlin, C++, Swift) and tight coupling to mihomo internals via a git submodule make wholesale extraction impractical, and large amounts of generated code (freezed, riverpod_generator, Drift, flutter_rust_bridge) require coordinated regeneration. Browser-platform and TV branches add conditional complexity, and some UI tests assert precise pixel/animation timings that are brittle. The genuinely reusable value lives in the standalone patterns — IPC framing and batching, the rope data structure, fractional indexing, async utilities, and the fingerprinted build cache — plus the independent plugin packages themselves.
spoofdpi is a cross-platform proxy tool that bypasses Deep Packet Inspection (DPI) by fragmenting and desynchronizing TLS handshakes. It operates in three modes: HTTP proxy, SOCKS5 proxy, or TUN interface (transparent proxy). In production, it intercepts outgoing connections, reads the TLS ClientHello, splits it into segments using configurable strategies (SNI-split, random, chunk, first-byte, or custom plans), optionally sends fake packets before the real data, and may disorder segments by manipulating the TTL field so that DPI middleboxes misparse the connection while the destination server reassembles it correctly. It also includes a built-in DNS resolver with UDP, HTTPS (DoH), and system backends, and a rule system for per-domain/per-IP configuration. The architecture is a single Go binary with modular internal packages: config (TOML+CLI loading), desync (TLS/UDP desynchronization), dns (multi-backend resolver), netutil (connection management, dialing, TTL setting), packet (raw packet capture/injection via pcap or Linux raw sockets), proto (HTTP, SOCKS5, TLS parsing), rule (domain and CIDR matching), server (HTTP, SOCKS5, TUN server implementations), session (context-based tracing), trie (generic trie structures), cache (sharded LRU and TTL caches), and logging (zerolog-based structured logging). The TUI mode uses bubbletea for a terminal interface showing real-time speed and logs. Key entry points are cmd/spoofdpi/main.go (main function) which parses CLI flags, loads configuration, and starts the selected server. External dependencies include gopacket for packet manipulation, wireguard-tun for TUN device support, gvisor for TCP/IP stack in TUN mode, and various Go packages for CLI, TOML, DNS, and logging. The code is well-structured with extensive use of interfaces, generics, and concurrency primitives (context, channels, goroutines).
MockServer is a highly sophisticated, multi-protocol HTTP(S) mock server and proxy for testing, written in Java with Netty. It supports HTTP/1.1, HTTP/2, HTTP/3 (QUIC), gRPC, WebSockets, DNS, TCP, and binary protocols on a single port. The core engine provides expectation-based request matching, response generation, forwarding, proxying, recording, verification, and chaos engineering (latency, connection drops, error injection). It also includes built-in LLM mocking (OpenAI, Anthropic, Gemini, etc.), OIDC/OAuth2/SAML identity providers, SCIM provisioning, WASM custom rules, and drift detection. The repository is a monorepo containing the Java server, multi-language client libraries (Java, Node, Python, Ruby, Go, .NET, Rust, PHP), a React dashboard UI, IDE plugins (JetBrains, VS Code), Helm charts, Docker images, and extensive CI/CD pipelines via Buildkite. The architecture is modular with clear separation of concerns: core model/matcher/serialization in `mockserver-core`, Netty transport in `mockserver-netty`, language-specific clients in `mockserver-client-*`, and a React UI in `mockserver-ui`. The codebase demonstrates strong engineering practices including DTO patterns with Jackson serializers, a matcher hierarchy with compiled-once validators, bounded caches, constant-time equality checks, and extensive test coverage with integration tests across multiple environments.
Chucker is a production-grade Android library for inspecting HTTP(S) traffic in-app. It acts as an OkHttp interceptor, capturing full request/response details (headers, bodies, timing, errors) and persisting them to a local Room database. The library provides a built-in Material Design UI for browsing, searching, filtering, and exporting transactions (HAR 1.2, plain text, curl commands). It is designed as a debug-only tool via a no-op variant for release builds. The architecture follows a clean separation: public API (ChuckerInterceptor, ChuckerCollector, BodyDecoder), internal data layer (Room entities, DAO, repository), support utilities (okio stream manipulation, JSON formatting, background services), and a full set of UI fragments/adapters. The codebase is well-tested (unit tests for interceptors, DAO, repository, utilities, ViewModels) and follows modern Android development practices (Kotlin, Coroutines, LiveData/Flow, ViewBinding, Compose sample). It handles edge cases like compressed bodies, large payloads, binary formats (protobuf), GraphQL, and SSL/TLS information. The project also includes CI/CD pipelines, automated dependency updates via Renovate, and migration guides for previous versions. While primarily an application library, it has a strong data storage component (Room database) and export functionality (HAR generation), making it useful for debugging network issues in any Android app.
sing-box is a universal proxy platform written in Go, serving as both a client and server for a wide range of proxy protocols including Shadowsocks, VMess, VLESS, Trojan, Hysteria2, TUIC, WireGuard, Tailscale, OpenVPN, OpenConnect, and many more. It features a modular architecture with pluggable inbounds, outbounds, services, and endpoints, all managed through a central routing engine with rule-based traffic steering, DNS resolution, and traffic sniffing. The system is designed for cross-platform deployment, with native support for Linux, macOS, Windows, Android, iOS, and tvOS, and includes a daemon mode with gRPC API for remote management, a Clash-compatible REST API, and mobile library bindings via gomobile. The architecture is built around adapter interfaces and generic registries, allowing easy extension with new protocols and services. The codebase demonstrates high craftsmanship in areas such as multi-engine TLS abstraction (supporting standard Go TLS, uTLS for fingerprinting, Apple's SecureTransport, Windows SChannel, and kernel TLS), parallel happy-eyeballs dialing, binary rule-set serialization, HTTP transport fallback with broken-authority tracking, and platform-specific packet manipulation (WinDivert on Windows, pf on macOS, netfilter on Linux). The project is actively maintained with frequent commits, extensive integration tests, and a comprehensive documentation site. While the codebase is large and contains experimental features, the core abstractions are clean and well-isolated, making many components genuinely reusable in other network-oriented Go projects.
GreenTunnel is a local proxy that bypasses DPI (Deep Packet Inspection) censorship by fragmenting the TLS ClientHello so the SNI never appears whole in a single packet, and by resolving DNS over encrypted channels (DoH/DoT). It is a ground-up TypeScript rewrite of the original GreenTunnel, fixing numerous bugs from v2 (backpressure, timeouts, HTTP framing corruption, DNS cache expiry, system proxy crash safety). The repository is a monorepo containing a core engine library, a CLI tool (`gt`), and an Electron desktop app. The engine implements a full HTTP/HTTPS proxy with TLS fragmentation, HTTP request rewriting (absolute-form to origin-form), a caching DNS resolver with TTL-based expiration and in-flight deduplication, and a system-proxy management layer with snapshot/restore and crash recovery. The desktop app provides a 340px frameless window with a live log panel (virtual list), tray integration, and non-intrusive advocacy prompts. The codebase is exceptionally well-documented (CLAUDE.md serves as the authoritative design document), uses modern Node.js features (parseArgs, styleText, pipeline), and has a strong emphasis on correctness and edge-case handling (e.g., stranded proxy detection, HTTP framing awareness, signal handling for clean shutdown).
Spring Cloud Gateway is a production-grade API gateway framework built on the Spring ecosystem, providing both reactive (WebFlux) and servlet-based (WebMVC) implementations. It routes HTTP/HTTPS/gRPC/WebSocket traffic through a configurable chain of predicates and filters, supporting features such as path rewriting, header manipulation, rate limiting (Redis/Bucket4j), circuit breaking (Resilience4J), retry with backoff, response caching, load balancing, and distributed tracing (Micrometer/OpenTelemetry). The architecture is plugin-based: route predicates and filter factories are registered as Spring beans and composed via a fluent builder DSL or YAML/properties configuration. External dependencies include Project Reactor, Spring Cloud Load Balancer, Redis, and optional integrations with gRPC, OAuth2, and serverless functions. The codebase is organized into multiple Maven modules: the core server modules (spring-cloud-gateway-server-webflux and spring-cloud-gateway-server-webmvc) contain the routing engine, filter/predicate factories, and auto-configuration; proxy exchange modules provide lightweight annotation-based proxying; and integration tests cover HTTP/2, SSL, WebSocket, and gRPC scenarios. Key entry points include FilteringWebHandler (WebFlux) and GatewayRouterFunctions (WebMVC) for request processing, RoutePredicateHandlerMapping for route matching, and GatewayAutoConfiguration for bean wiring. The system is designed for extensibility: custom filters and predicates can be added by implementing GatewayFilter or RoutePredicateFactory and registering them as beans. Data flows follow a standard gateway pattern: an incoming request is matched against route definitions (loaded from properties, Redis, or service discovery), then passed through a chain of global filters and route-specific filters. Filters can modify the request/response, cache bodies, enforce rate limits, or invoke circuit breakers before forwarding to the backend via a configurable HTTP client (Netty-based for WebFlux, RestTemplate/WebClient for WebMVC). Observability is embedded via Micrometer metrics and OpenTelemetry tracing, with custom observation conventions for gateway-specific events.
HTTrack is a mature, production-grade website mirroring/offline browsing tool written in C. It recursively downloads websites to a local directory, rewriting links to enable offline browsing. The system includes a command-line interface (httrack), a web-based GUI (htsserver), a caching proxy (proxytrack), and a shared library (libhttrack). The core engine manages multi-threaded HTTP/HTTPS/FTP downloads, incremental updates via a zip-based cache, WARC/WACZ archival output, and robust link filtering. The architecture is monolithic but modularized into loosely coupled subsystems (caching, URL naming, HTML parsing, content decoding, robots.txt handling, etc.). Key entry points are in src/httrack.c, src/htsserver.c, and src/proxy/main.c. Data flows: user-provided URL seeds → DNS resolution → HTTP fetch → HTML parsing → link extraction → deduplication → resource download → local mirror tree or WARC output. External dependencies include zlib (required), OpenSSL (optional for WARC digests), and iconv (optional for charset conversion). The codebase is extensively tested with integration tests, fuzz harnesses, and self-tests; it also includes a standalone reusable test HTTP server and a WARC validator.
ProxyPool is a production-grade proxy pool application that automatically collects free HTTP/HTTPS proxies from over a dozen public sources, validates their availability, and stores them in Redis or SSDB. It provides a Flask RESTful API for consuming proxies (get, pop, all, count, delete) and uses APScheduler for periodic fetching and validation. The architecture is a monolith with two main processes: a scheduler that runs fetch/check cycles and an API server (Flask with Gunicorn on Linux). The codebase demonstrates strong software engineering practices: a plugin-based fetcher system with dynamic module loading and caching, a clean Proxy data model with JSON serialization, a decorator-based validator registration pattern, and a layered test suite (unit, API, integration) with fakeredis mocking. External dependencies include Redis/SSDB, APScheduler, Flask, requests, and lxml. The project is actively maintained with recent commits and a comprehensive test suite.
ProxyManager is a PHP library for generating proxy classes at runtime. It provides implementations for several proxy patterns: lazy loading (ghost and value holder), access interceptors (with value holder or scope localizer), null objects, and remote objects. The library uses Laminas Code for code generation and reflection to dynamically create proxy classes that wrap or substitute real objects. It is designed as a standalone Composer package with a configuration-driven architecture: a central Configuration object manages autoloading, generator strategies (evaluating or file-writing), class name inflectors, and signature verification. Factories (e.g., LazyLoadingValueHolderFactory, NullObjectFactory) serve as the primary entry points for users, each producing proxies for a given class or interface. The generated proxies include methods for initialization control, interceptor callbacks, and property access simulation. The library is extensively tested with unit tests, functional tests, and mutation testing, and includes benchmarks for performance. External dependencies are limited to Laminas Code and Composer's installed versions API.
HevSocks5Tunnel is a lightweight, high-performance tun2socks proxy written in C. It creates a virtual TUN interface and forwards all TCP/UDP traffic through a SOCKS5 proxy, supporting IPv4/IPv6 dual-stack, UDP-in-UDP and UDP-in-TCP relay modes, optional local ICMP echo replies, and a mapped DNS feature for transparent DNS resolution. The architecture is monolithic but modular: a YAML-based configuration parser, platform-specific tunnel backends (Linux, FreeBSD, macOS, NetBSD, Windows via Wintun), and a session management layer built on top of lwIP and the hev-task-system cooperative multitasking library. It can be used as a standalone CLI tool, a static/shared library, or embedded via JNI on Android. The codebase demonstrates strong C craftsmanship with clean abstractions, efficient I/O patterns (ring buffer with iovec, scatter/gather), and careful platform abstraction.
tsbridge is a production-grade reverse proxy that exposes multiple backend services on a Tailscale tailnet using isolated tsnet nodes per service. It supports static TOML configuration and dynamic Docker label discovery, with hot-reload, graceful shutdown, Prometheus metrics, and a composable middleware chain (access log, whois identity lookup, request ID, body size limits, header sanitization). The architecture is a single Go binary that manages per-service tsnet.Server instances, each with its own state directory and listener. External dependencies are Tailscale (tsnet), Docker (optional), and Prometheus. The codebase demonstrates strong engineering practices: interface-based abstractions (TSNetServer, config.Provider), typed error hierarchy, secret resolution with redaction, debounced event handling with exponential backoff, and comprehensive unit and integration tests. It is actively maintained with CI/CD, dependabot, and regular dependency updates.
v2rayNG is a production-grade Android VPN/proxy client that provides a comprehensive interface for managing V2Ray and Xray proxy configurations. It supports multiple proxy protocols (VMess, VLESS, Shadowsocks, Trojan, WireGuard, Hysteria2, SOCKS, HTTP), subscription management with auto-update, routing rules, per-app proxy, and backup/restore via local files or WebDAV. The app runs in three modes: VPN (TUN), proxy-only (local SOCKS/HTTP), and root (iptables transparent proxy). It uses native cores (Xray or v2fly) via JNI and manages complex configuration generation, including DNS segmentation, observatory-based load balancing, and fragment settings. The architecture follows standard Android patterns with Compose UI, ViewModels, and background services in separate processes. The codebase is actively maintained with a large community, though some modules (e.g., CoreConfigManager) are monolithic and could benefit from further decomposition.
One API is a production-ready OpenAI API gateway that aggregates 30+ LLM providers (OpenAI, Anthropic, Google Gemini, Azure, Baidu, Alibaba, Zhipu, Moonshot, DeepSeek, Ollama, etc.) behind a single OpenAI-compatible endpoint. The Go backend implements a sophisticated relay system with provider-specific adaptors that translate OpenAI-format requests to each provider's native API. It features token-based quota management with group/channel multipliers, load balancing across channels, automatic failover, channel health monitoring with metric-based auto-disable, and multi-node deployment with Redis synchronization. The React frontend (three themes: default, berry, air) provides admin dashboards for channel/token/user management, billing visualization, and system configuration. The codebase demonstrates strong engineering practices: clean adaptor pattern for provider extensibility, comprehensive middleware chain, batched database updates for performance, and well-structured configuration management.