frp is a high-performance reverse proxy application that exposes local services behind NAT or firewalls to the internet. It implements a client-server architecture where the frpc client connects to the frps server, registers proxies (TCP, UDP, HTTP, HTTPS, STCP, XTCP, TCPMUX), and tunnels traffic through encrypted, compressed connections. The system supports multiple transport protocols (TCP, KCP, QUIC, WebSocket, WSS), authentication (token, OIDC), health checks, load balancing, bandwidth limiting, and a plugin system for both client and server extensions. It also includes NAT hole punching for direct peer-to-peer connections and an SSH tunnel gateway that allows SSH clients to create tunnels without frpc. The codebase is well-structured with clear separation of concerns: configuration loading and validation in pkg/config/, wire protocol and message handling in pkg/msg/ and pkg/proto/, network utilities in pkg/util/net/, and proxy implementations in server/proxy/ and client/proxy/. The project includes comprehensive end-to-end tests, a Vue.js web dashboard for both server and client management, Prometheus metrics, and a store API for dynamic proxy configuration at runtime. The architecture is modular, using factory patterns for proxy types, visitor patterns for P2P connections, and an aggregator pattern for merging configuration sources. Despite its complexity, the codebase is actively maintained with regular releases, extensive documentation, and a large community. It demonstrates strong engineering practices including interface-based design, dependency injection for testability, and careful concurrency management. The main technical debt is the coexistence of legacy INI configuration and v1 wire protocol alongside newer formats, but these are well-isolated and migration paths are provided.
mitmproxy is a production-grade, interactive HTTPS proxy that intercepts, inspects, modifies, and replays HTTP/1, HTTP/2, HTTP/3, WebSocket, TCP, UDP, DNS, and QUIC traffic. It supports multiple proxy modes (regular, transparent, reverse, upstream, SOCKS5, DNS, WireGuard, TUN, local) and provides three frontends: a console TUI (mitmproxy), a command-line dump tool (mitmdump), and a web UI (mitmweb). The architecture is event-driven with a sans-IO proxy layer design: protocol layers yield commands and events processed by an asyncio event loop. An extensive addon system allows users to extend functionality via lifecycle hooks, custom commands, and content views. The codebase is well-structured, heavily typed, and includes a comprehensive test suite with fuzzing and benchmarks. It is actively maintained with frequent releases and security patches.
Apache ShenYu is a production-grade, plugin-based API gateway and microservices proxy platform written in Java. The runtime gateway (shenyu-bootstrap, a Spring WebFlux application) ingests HTTP/HTTPS/WebSocket traffic and processes each exchange through an ordered chain of ShenyuPlugin implementations covering protocol translation (HTTP, gRPC, Apache Dubbo, SOFA, Tars, MQTT, TCP), security (sign, JWT, OAuth2, key-auth, cryptor, WAF), traffic management (rate limiting, resilience4j), caching, logging (Kafka, Elasticsearch, RocketMQ, console), request rewriting, mocking, and AI proxy/token limiting. Routing, selector, rule, and plugin data is not hardcoded; it is synchronized dynamically from the admin plane. The management plane is shenyu-admin, a Spring MVC/MyBatis application exposing roughly 40 REST controllers for managing plugins, selectors, rules, metadata, namespaces, app auth, users/roles/permissions, discovery, and configuration import/export. Persistence supports H2, MySQL, PostgreSQL, OpenGauss, and Oracle via MyBatis mappers, with upgrade SQL scripts under db/upgrade. Configuration changes flow from admin to gateways through WebSocket, HTTP long polling, ZooKeeper, Nacos, etcd, or Apollo listeners, all built on shared abstract data-changed-listener templates. Client SDK modules (shenyu-client-*) auto-register Spring MVC, Dubbo, gRPC, SOFA, Tars, and WebSocket APIs using annotation-based extractors and a Disruptor-based async publish pipeline; a Kubernetes controller reconciles ingress/gateway-api resources. The repository demonstrates strong craftsmanship: a Dubbo-style SPI framework (@SPI/@Join/ExtensionLoader) drives pluggable match strategies, predicate judges, load balancers (Random, RoundRobin, LeastActive, P2C, ShortestResponse), cryptors, and rate limiter algorithms; shenyu-common contains a W-TinyLFU cache and memory-bounded queues that prevent OOM under burst; the admin uses domain events for audit logging and an observer pattern for Prometheus-driven auto-scaling. Testing is extensive (per-module unit tests, Spring Boot integration tests, Docker-Compose e2e suites, K8s examples). Main weaknesses are surface-area boilerplate across dozens of plugin modules, some experimental/placeholder code (WASM, AI, MCP), and a few disabled tests — typical for a large Apache project. Maintenance is active with recent commits, CodeQL scanning, and zero dependabot alerts; technical drift is low.
Prism is an OpenAPI toolkit for mocking and validating HTTP APIs. It provides a mock server that simulates API behavior from OpenAPI v2/v3 specifications and a validation proxy that checks API implementations against contracts. The architecture is a monorepo managed by Lerna with four core packages: cli (command-line interface), core (shared types and factory), http-server (HTTP server setup), and http (request processing, validation, and mocking). Key entry points include prism mock and prism proxy commands. Data flows involve loading OpenAPI specs, routing requests, validating against schemas, generating static/dynamic responses via JSON Schema Faker, applying callbacks, and forwarding traffic in proxy mode. External dependencies include Node.js, TypeScript, fp-ts for functional programming, AJV for validation, and json-schema-faker for dynamic data generation.
MockServer is a highly sophisticated, multi-protocol HTTP(S) mock server and proxy for testing, written in Java with Netty. It supports HTTP/1.1, HTTP/2, HTTP/3 (QUIC), gRPC, WebSockets, DNS, TCP, and binary protocols on a single port. The core engine provides expectation-based request matching, response generation, forwarding, proxying, recording, verification, and chaos engineering (latency, connection drops, error injection). It also includes built-in LLM mocking (OpenAI, Anthropic, Gemini, etc.), OIDC/OAuth2/SAML identity providers, SCIM provisioning, WASM custom rules, and drift detection. The repository is a monorepo containing the Java server, multi-language client libraries (Java, Node, Python, Ruby, Go, .NET, Rust, PHP), a React dashboard UI, IDE plugins (JetBrains, VS Code), Helm charts, Docker images, and extensive CI/CD pipelines via Buildkite. The architecture is modular with clear separation of concerns: core model/matcher/serialization in `mockserver-core`, Netty transport in `mockserver-netty`, language-specific clients in `mockserver-client-*`, and a React UI in `mockserver-ui`. The codebase demonstrates strong engineering practices including DTO patterns with Jackson serializers, a matcher hierarchy with compiled-once validators, bounded caches, constant-time equality checks, and extensive test coverage with integration tests across multiple environments.
Pingora is a production-grade Rust framework for building fast, reliable, and programmable networked systems, developed and battle-tested at Cloudflare (handling 40M+ requests/second). It provides a modular architecture with crates for HTTP/1.1 and HTTP/2 proxying, TLS termination (OpenSSL, BoringSSL, rustls, s2n-tls), load balancing (weighted round-robin, consistent hashing), caching (LRU, TinyUFO), rate limiting, and observability (Prometheus, Sentry). The core abstraction is the `ProxyHttp` trait, which allows users to define request/response filters, upstream selection, error handling, and module integration via lifecycle hooks. The framework also includes a server lifecycle manager with graceful shutdown, daemonization, and file descriptor transfer for zero-downtime upgrades. The architecture is library-oriented: users compose services by implementing traits and configuring YAML-based server settings. Key entry points include `pingora::Server` for process management, `pingora_proxy::http_proxy_service` for creating proxy services, and `pingora_load_balancing::LoadBalancer` for background health checks and discovery. Data flows involve downstream HTTP sessions (H1/H2), upstream connections via pooled connectors, and optional caching layers with eviction policies. External dependencies include tokio, http, h2, lru, ahash, and various TLS libraries. While primarily an application framework, Pingora contains research-grade components like `tinyufo` (a lock-free cache algorithm with TinyLFU admission and S3-FIFO eviction) and `pingora-ketama` (nginx-compatible consistent hashing). These are packaged as reusable crates with extensive benchmarks and memory profiling. The codebase is well-structured with clean trait-based abstractions, but the large workspace (20+ crates) and multiple TLS backends introduce maintenance complexity. Overall, it is a high-quality, actively maintained framework suitable for building custom proxies, load balancers, and edge services.
Proxyline is a Node.js library that installs a process-wide proxy routing policy across `node:http`, `node:https`, undici/fetch, WebSocket clients, and explicit HTTP CONNECT tunnels. It provides two modes: `managed` (fail-closed with a required proxy URL) and `ambient` (respects `HTTP_PROXY`/`HTTPS_PROXY`/`NO_PROXY` environment variables). The library patches global HTTP(S) methods, replaces global agents, installs a custom undici dispatcher, and patches fetch globals. It includes observability via `explain()` and lifecycle events, scoped proxy TLS trust, dynamic bypass registrations, and credential-safe URL redaction. The codebase is TypeScript, ESM-only, and requires Node.js 22.19+ with undici 8.5+ as a peer dependency. It is well-tested with an in-process proxy lab and has comprehensive documentation.
Keydd is an HTTP(s) proxy tool that performs sensitive information detection and AI-driven API business logic analysis. It acts as a MITM proxy to intercept traffic, matches content against 30+ regex patterns for credentials/API keys, and optionally uses LLMs to analyze API endpoints for business purpose, sensitivity, and penetration priority. The architecture features separate layers for proxy handling, rule-based detection, AI analysis (with rate limiting, token tracking, and metrics), database persistence (SQLite/MySQL/PostgreSQL), and notifications. Key entry points include main.go for startup, proxy/handler.go for traffic processing, and cmd/match_rules.go for sensitive pattern matching.
Proxelar is a high-performance, scriptable local traffic workbench for HTTP, HTTPS, and WebSocket debugging. It functions as a man-in-the-middle (MITM) proxy that can capture, inspect, intercept, modify, replay, and export traffic across multiple protocols (HTTP/1.1, HTTP/2, HTTP/3, WebSocket, SOCKS5, DNS, UDP, and WireGuard). The system is built as a Rust workspace with four crates: `proxelar-cli` (binary with TUI, terminal, and web GUI interfaces), `proxyapi` (core proxy engine with TLS interception, Lua scripting, addon system, route rules, and session export/import), `proxelar-proto` (transport-neutral HTTP core with sans-I/O parsers for HTTP/1 and HTTP/2), and `proxyapi_models` (shared data types for headers, sessions, and captured exchanges). It supports forward and reverse proxy modes, declarative JSON routing rules, Lua addons with SHA-256 verification, and exports to HAR, curl, and raw formats. The architecture is modular with clean dependency direction, extensive integration tests, performance benchmarks, and property-based testing. It is a production-quality developer tool comparable to mitmproxy or Charles Proxy, with a focus on performance, correctness, and extensibility.
Ladder is a self-hosted HTTP web proxy written in Go, designed for testing and analyzing paywall implementations, content delivery, and access control behavior on modern websites. It intercepts client requests, applies domain-specific YAML rulesets to modify request headers, URLs, and response content (e.g., removing CORS/CSP headers, injecting scripts, rewriting relative URLs), then fetches the target site and returns the modified response. The proxy exposes a web form, a JSON API, a raw HTML endpoint, and a ruleset endpoint, and supports optional FlareSolverr integration for bypassing Cloudflare challenges. It is deployable as a binary, Docker container, or Helm chart, and is configured via environment variables and CLI flags. The architecture is a single Go binary using the Fiber web framework. The main entry point (cmd/main.go) sets up routing, basic auth, and middleware. Core logic lives in handlers/proxy.go, which handles URL extraction, ruleset application, HTTP fetching, HTML rewriting, and FlareSolverr integration. The pkg/ruleset package provides a clean, reusable ruleset loader supporting local files, directories, remote URLs, and gzip-compressed YAML. The codebase is generally well-structured with some global state and a few misnamed test files (e.g., proxy.test.go instead of proxy_test.go) that are not executed by Go's test runner. Despite these minor issues, the project is actively maintained, uses current dependencies, and demonstrates solid engineering practices for a focused tool.
V2Ray-core is a Go-based network proxy and tunneling platform designed to help users build private networks and bypass censorship. It functions as a modular proxy framework supporting multiple protocols (VMess, VLess, Trojan, SOCKS, HTTP, MTProto, Shadowsocks) and transport layers (TCP, mKCP, WebSocket, HTTP/2, QUIC, Domain Socket, XTLS). The architecture is highly modular: the core runtime manages features (dispatcher, router, DNS, stats, policy, log) as pluggable components, while proxy implementations and transports are registered via a global config-creator registry. Entry points are the main binary (v2ray) and a control utility (v2ctl) for config conversion, signing, and diagnostics. Data flows from inbound handlers through a dispatcher that routes connections by destination, protocol sniffing, and routing rules to outbound handlers, which then dial remote servers over the configured transport. External dependencies include gorilla/websocket, quic-go, miekg/dns, go-proxyprotocol, VSign for binary signing, and xtls/go for extended TLS. The codebase demonstrates strong engineering in its layered abstraction: common/ provides reusable, low-level primitives (buffered I/O with MultiBuffer, retry logic, crypto streams, session context, platform path handling), while features/ defines clean interfaces for routing, DNS, stats, and policy that the app/ layer implements. The transport layer is particularly well-designed, with each protocol isolated behind a common Dial/Listen interface and supporting pluggable packet headers for traffic obfuscation (e.g., faking WeChat video, SRTP, UTP, WireGuard, DTLS). The string matcher (strmatcher) uses a trie for domain matching and supports full, substring, keyword, and regex patterns with index-based grouping. The custom buf package provides a lightweight buffer pool and vectored I/O reader (readv) for performance. The error handling uses a structured errors package with path objects for source location. However, the repository shows signs of stagnation. The README explicitly redirects to v2fly/v2ray-core, indicating this is the legacy v2ray organization's repo. The last commit was in April 2026, but the go.mod targets Go 1.15 (released 2020), and many dependencies are pinned to pre-1.0 versions (quic-go v0.18.1, grpc v1.32.0, protobuf v1.25.0). The CI workflows have conditions like `if: github.repository != 'v2ray/v2ray-core'` suggesting they are disabled for this fork. The codebase contains extensive generated code (errors.generated.go, config.pb.go) and mock files. The XTLS integration references an external fork (xtls/go) rather than the standard crypto/tls. The custom Chacha20 implementation uses code generation for the core block function. While the architecture is sound, the dependency versions and Go version target are significantly behind current ecosystem standards.
teddyCloud is a self-hosted, open-source replacement server for the Toniebox children's audio player. It implements the entire cloud-side protocol stack—including HTTPS, TLS, MQTT, and custom protobuf-based APIs—to intercept, proxy, cache, and serve audio content to physical Toniebox devices. The application is written in C, builds on the CycloneTCP networking library, and integrates a full MQTT server, a Home Assistant bridge, a web administration interface, and tools for firmware patching (ESP32, CC3200, CC3235) and certificate generation. It also includes a WebAssembly-based TAF audio encoder for browser-side use. The codebase is a result of extensive reverse engineering of the Toniebox protocol, demonstrating deep expertise in embedded systems, cryptography, and IoT networking. While tightly coupled to the Toniebox ecosystem, several components (MQTT server, settings overlay system, WASM encoder) are designed with sufficient abstraction to be reusable in other contexts.
Stoobly Agent is a monolithic Python application that acts as a man-in-the-middle HTTP(S) proxy for recording, mocking, replaying, and testing API interactions. Built on mitmproxy, it provides a comprehensive CLI (Click-based) for managing requests, scenarios, settings, and snapshots, as well as a scaffold system that generates full Docker Compose or local development workflows. The application supports four proxy modes (record, mock, test, develop) with configurable policies, rewrite rules, and lifecycle hooks that allow custom Python callbacks at various interception stages. It persists state to a local SQLite database via an ORM with migrations, and optionally integrates with a remote Stoobly cloud service for project and scenario management. The codebase exhibits a solid architecture with adapter patterns for converting between different HTTP representations (mitmproxy, Python requests, raw, ORM, Stoobly API), factory patterns for resource creation, and builder patterns for Docker Compose generation. However, it suffers from some technical drift (deprecated mitmproxy API usage, many lazy imports, global singletons) and the test suite includes flaky end-to-end tests that depend on external services. Overall, it is a well-crafted tool for API development and testing, with several reusable components, particularly the HTTP adapter system.
This is an Android application for network traffic capture and diagnostics, functioning as a mobile proxy similar to Fiddler. The core functionality revolves around intercepting HTTP/HTTPS traffic via a locally running BrowserMobProxy instance, capturing requests/responses in HAR format, and providing tools for modifying traffic (via response injection rules), exporting captures, and performing network diagnostics (ping, DNS, traceroute). The architecture follows standard Android patterns with Activities, Fragments, Services, and Utils classes, but integrates deeply with modified versions of Netty, BrowserMob Proxy, and LittleProxy for MITM capabilities. Key entry points include MainActivity (UI launcher), SysApplication (proxy initialization), MyVpnService (system-wide traffic capture via VPN), and LDNetDiagnoService (diagnostic tasks). The application requires manual installation of a CA certificate for HTTPS interception and stores configuration in SharedPreferences. While functional, the codebase exhibits maintenance challenges including reflection-heavy Android version-specific code, complex SSL/TLS management, static state risks, and dependencies on forked libraries that may lag upstream.