Apache ShenYu is a production-grade, plugin-based API gateway and microservices proxy platform written in Java. The runtime gateway (shenyu-bootstrap, a Spring WebFlux application) ingests HTTP/HTTPS/WebSocket traffic and processes each exchange through an ordered chain of ShenyuPlugin implementations covering protocol translation (HTTP, gRPC, Apache Dubbo, SOFA, Tars, MQTT, TCP), security (sign, JWT, OAuth2, key-auth, cryptor, WAF), traffic management (rate limiting, resilience4j), caching, logging (Kafka, Elasticsearch, RocketMQ, console), request rewriting, mocking, and AI proxy/token limiting. Routing, selector, rule, and plugin data is not hardcoded; it is synchronized dynamically from the admin plane. The management plane is shenyu-admin, a Spring MVC/MyBatis application exposing roughly 40 REST controllers for managing plugins, selectors, rules, metadata, namespaces, app auth, users/roles/permissions, discovery, and configuration import/export. Persistence supports H2, MySQL, PostgreSQL, OpenGauss, and Oracle via MyBatis mappers, with upgrade SQL scripts under db/upgrade. Configuration changes flow from admin to gateways through WebSocket, HTTP long polling, ZooKeeper, Nacos, etcd, or Apollo listeners, all built on shared abstract data-changed-listener templates. Client SDK modules (shenyu-client-*) auto-register Spring MVC, Dubbo, gRPC, SOFA, Tars, and WebSocket APIs using annotation-based extractors and a Disruptor-based async publish pipeline; a Kubernetes controller reconciles ingress/gateway-api resources. The repository demonstrates strong craftsmanship: a Dubbo-style SPI framework (@SPI/@Join/ExtensionLoader) drives pluggable match strategies, predicate judges, load balancers (Random, RoundRobin, LeastActive, P2C, ShortestResponse), cryptors, and rate limiter algorithms; shenyu-common contains a W-TinyLFU cache and memory-bounded queues that prevent OOM under burst; the admin uses domain events for audit logging and an observer pattern for Prometheus-driven auto-scaling. Testing is extensive (per-module unit tests, Spring Boot integration tests, Docker-Compose e2e suites, K8s examples). Main weaknesses are surface-area boilerplate across dozens of plugin modules, some experimental/placeholder code (WASM, AI, MCP), and a few disabled tests — typical for a large Apache project. Maintenance is active with recent commits, CodeQL scanning, and zero dependabot alerts; technical drift is low.
AxonHub is a production-grade, multi-provider LLM API gateway that routes, transforms, and manages requests to a wide range of AI providers (OpenAI, Anthropic, Gemini, DeepSeek, xAI, and 60+ others). It provides a unified API surface for chat completions, embeddings, moderations, audio, images, and video generation, with sophisticated features like load balancing (latency-aware, weighted round-robin, circuit breaker), per-channel rate limiting, provider quota enforcement, streaming, and reasoning token handling. The backend is written in Go using Gin, Ent ORM, gqlgen, and Uber Fx for dependency injection, supporting PostgreSQL, MySQL, and SQLite with automatic migration. The frontend is a comprehensive React/TypeScript SPA (Vite, TanStack Router/Query, Tailwind, shadcn/ui) that provides administration of channels, models, API keys, users, roles, projects, and system settings. It includes analytics dashboards, request tracing, usage logs, and OIDC SSO. The system is designed for multi-tenancy with fine-grained RBAC (scope-based permissions) and privacy policies enforced at the Ent ORM layer. Deployment is supported via Docker, Docker Compose, and Helm charts. The codebase exhibits strong engineering practices: extensive unit and integration tests (including race-condition tests and E2E Playwright tests), pipeline middleware for request transformation, generic caching abstractions, stream processing utilities, and a Zanzibar-inspired authorization framework. While there are minor issues (duplicate utility packages, a typo in a folder name, and some frontend boilerplate repetition), the overall architecture is clean, modular, and well-documented. The project is actively maintained with frequent commits, issue triage, and a clear release process.
CLIProxyAPI is a sophisticated Go-based proxy/gateway service that acts as an intermediary between clients and multiple AI service providers (OpenAI, Claude, Gemini, Codex, xAI/Grok, etc.). It handles authentication, request/response translation, routing, and management of AI API interactions. The system features a modular architecture with distinct layers for server handling, authentication, execution, translation, plugins, and configuration. It provides both REST and WebSocket interfaces, includes a terminal UI for interactive management, and offers extensibility through a plugin system. The codebase demonstrates strong engineering practices with comprehensive testing, clear separation of concerns, and reusable components.
OpenFaaS is a serverless platform that provides an API gateway for deploying, managing, and invoking functions. The gateway handles HTTP routing to functions, collects and exposes Prometheus metrics, implements autoscaling based on invocation rates, includes a built-in AngularJS UI for function management, and supports alerting via integrations like Slack. It uses a plugin architecture for function providers (e.g., Kubernetes, Docker Swarm) via the faas-provider interface, allowing the core to remain decoupled from the underlying runtime. The system processes synchronous function invocations through a reverse proxy and asynchronous invocations via NATS queues.
Higress is a cloud-native, AI-native API gateway built on Istio and Envoy. In production, it operates as a Kubernetes ingress controller, an AI/LLM proxy gateway, and a Wasm plugin host. The system ingests Kubernetes resource definitions (Ingress, Gateway API, custom CRDs like WasmPlugin, Http2Rpc, McpBridge) and translates them into Envoy xDS configurations, managing the full lifecycle of gateway routes, policies, and plugins. It provides a rich set of Wasm plugins (Go, Rust, C++, AssemblyScript) for authentication, rate limiting, request/response transformation, AI proxy (with 15+ LLM providers), semantic caching, RAG, MCP server hosting, and security (WAF, bot detection, IP restriction). The architecture is microservices-oriented: a control plane (Go-based ingress controller) manages Kubernetes resources and pushes config to Envoy data planes; a CLI tool (hgctl) handles installation, plugin development, and debugging; and a plugin release pipeline manages OCI image distribution with provenance verification. External dependencies include Kubernetes (client-go, controller-runtime), Istio (pilot, networking APIs), Envoy (Go filter API), and various AI/vector DB providers (OpenAI, Milvus, Pinecone, etc.).
Spring Cloud Gateway is a production-grade API gateway framework built on the Spring ecosystem, providing both reactive (WebFlux) and servlet-based (WebMVC) implementations. It routes HTTP/HTTPS/gRPC/WebSocket traffic through a configurable chain of predicates and filters, supporting features such as path rewriting, header manipulation, rate limiting (Redis/Bucket4j), circuit breaking (Resilience4J), retry with backoff, response caching, load balancing, and distributed tracing (Micrometer/OpenTelemetry). The architecture is plugin-based: route predicates and filter factories are registered as Spring beans and composed via a fluent builder DSL or YAML/properties configuration. External dependencies include Project Reactor, Spring Cloud Load Balancer, Redis, and optional integrations with gRPC, OAuth2, and serverless functions. The codebase is organized into multiple Maven modules: the core server modules (spring-cloud-gateway-server-webflux and spring-cloud-gateway-server-webmvc) contain the routing engine, filter/predicate factories, and auto-configuration; proxy exchange modules provide lightweight annotation-based proxying; and integration tests cover HTTP/2, SSL, WebSocket, and gRPC scenarios. Key entry points include FilteringWebHandler (WebFlux) and GatewayRouterFunctions (WebMVC) for request processing, RoutePredicateHandlerMapping for route matching, and GatewayAutoConfiguration for bean wiring. The system is designed for extensibility: custom filters and predicates can be added by implementing GatewayFilter or RoutePredicateFactory and registering them as beans. Data flows follow a standard gateway pattern: an incoming request is matched against route definitions (loaded from properties, Redis, or service discovery), then passed through a chain of global filters and route-specific filters. Filters can modify the request/response, cache bodies, enforce rate limits, or invoke circuit breakers before forwarding to the backend via a configurable HTTP client (Netty-based for WebFlux, RestTemplate/WebClient for WebMVC). Observability is embedded via Micrometer metrics and OpenTelemetry tracing, with custom observation conventions for gateway-specific events.
Traefik is a cloud-native reverse proxy and API gateway that dynamically configures itself from various service discovery backends (Docker, Kubernetes, Consul, etc.). It provides HTTP, TCP, and UDP routing, load balancing, TLS termination, ACME certificate management, a rich middleware chain (auth, rate limiting, compression, headers, etc.), observability (metrics, tracing, access logs), and a plugin system (Yaegi and Wasm). The project is written in Go with a React-based web UI. It supports Kubernetes CRDs (IngressRoute, Middleware, etc.) and the Gateway API. It has extensive integration tests and is actively maintained. The architecture is modular with clear provider interfaces, a configuration watcher that merges dynamic configs from multiple sources, and a hot-swappable handler for live updates.
Kong is a cloud-native, platform-agnostic API gateway built on OpenResty/Nginx. It provides traffic management, security, observability, and AI/LLM proxying capabilities through a plugin architecture. The system supports traditional, DB-less, and hybrid deployment modes, with an Admin API for configuration and Kong Manager for GUI-based management. Key features include load balancing, authentication, rate limiting, request/response transformation, and extensive observability integrations.
One API is a production-ready OpenAI API gateway that aggregates 30+ LLM providers (OpenAI, Anthropic, Google Gemini, Azure, Baidu, Alibaba, Zhipu, Moonshot, DeepSeek, Ollama, etc.) behind a single OpenAI-compatible endpoint. The Go backend implements a sophisticated relay system with provider-specific adaptors that translate OpenAI-format requests to each provider's native API. It features token-based quota management with group/channel multipliers, load balancing across channels, automatic failover, channel health monitoring with metric-based auto-disable, and multi-node deployment with Redis synchronization. The React frontend (three themes: default, berry, air) provides admin dashboards for channel/token/user management, billing visualization, and system configuration. The codebase demonstrates strong engineering practices: clean adaptor pattern for provider extensibility, comprehensive middleware chain, batched database updates for performance, and well-structured configuration management.
Apollo Router is a production-grade GraphQL gateway written in Rust. It accepts incoming GraphQL HTTP requests, composes a supergraph schema from subgraph schemas, plans queries across subgraphs, and executes them through a tower-style service pipeline. It supports federation, subscriptions, persisted queries, demand control, entity caching, progressive overrides, connectors, and defer. Configuration is YAML-based and can be managed via Apollo GraphOS Uplink for schema/config propagation.
Ocelot is a .NET library providing a highly configurable, middleware-based API Gateway for ASP.NET Core applications. It is not a standalone application but a framework that integrates into an ASP.NET Core host via `AddOcelot()` and `UseOcelot()`. Its architecture centers on a fixed-order middleware pipeline that processes incoming HTTP requests through stages including configuration loading, route matching, security, rate limiting, authentication, authorization, load balancing, URL rewriting, and proxying to downstream services. The pipeline is extensible through custom delegates and handlers, and supports advanced features like WebSocket proxying, response aggregation, and circuit breaking. The codebase demonstrates strong engineering practices with a clean separation of concerns across modules for Configuration, Routing, Load Balancing, Quality of Service, Rate Limiting, Caching, and WebSocket proxying. It features an extensive test suite with over a thousand unit and acceptance tests, many of which are linked to specific GitHub issues, indicating rigorous issue-driven development. The configuration system is particularly robust, supporting JSON file merging, environment-specific overrides, dynamic reloading, and fluent validation. While the core architecture is modern and well-maintained, targeting .NET 8 through 10, the codebase exhibits some technical drift. It relies on deprecated dependencies like `Microsoft.Extensions.DiagnosticAdapter` and `Newtonsoft.Json` alongside the newer `System.Text.Json`. There are known concurrency bottlenecks (e.g., a single static lock in rate limiting, blocking calls in the async configuration poller) and a reliance on reflection in unit tests that makes them brittle. Several properties are marked obsolete with planned removal in version 25.0. Despite this debt, Ocelot contains several genuinely reusable components that demonstrate non-obvious craftsmanship, such as a generic, thread-safe Circuit Breaker, a flexible Retry helper, and a clean DSL parser for claim transformations. It is an ideal choice for .NET teams requiring a robust, self-hosted, and extensible API gateway without the overhead of a commercial solution. Its primary value lies in its comprehensive feature set, extensibility, and the quality of its testing infrastructure.
Emissary-ingress (formerly Ambassador) is a Kubernetes-native API gateway and ingress controller built on Envoy Proxy. It sits at the edge of a Kubernetes cluster, managing ingress traffic with self-service configuration via Custom Resource Definitions (CRDs) like Mapping, Host, Module, AuthService, RateLimitService, and TLSContext. The system is architected as a dual-language control plane: a Go-based main entrypoint (`cmd/entrypoint/`) handles Kubernetes resource watching, snapshot assembly, secret reconciliation, and Envoy lifecycle management, while a Python-based configuration engine (`python/ambassador/`) compiles the desired state into an Intermediate Representation (IR) and generates Envoy xDS configuration (v3). A separate Go API extension server (`cmd/apiext/`) provides conversion webhooks and certificate management for CRD versions (v1, v2, v3alpha1). The compiled Envoy configuration is served via gRPC and pushed to Envoy through the ambex package using go-control-plane. Key data flows: Kubernetes resources (CRDs, Ingresses, Services) are watched by Go watchers and accumulated into snapshots via the `pkg/kates/accumulator`. Snapshots are passed to the Python diagd process, which builds an IR (Intermediate Representation) and generates Envoy v3 configuration for listeners, clusters, routes, filters (auth, rate limiting, gzip, CORS, tracing), and TLS settings. The resulting config is written as JSON files, read by the ambex ADS server, and pushed to Envoy. The system supports dynamic updates without restart, canary deployments, circuit breaking, health checks, Istio and Consul integration, and extensive observability (Prometheus, StatsD, Datadog). The codebase demonstrates strong engineering practices with a comprehensive test suite including Go unit tests, Python unit tests, Kubernetes integration tests (KAT framework), and e2e tests using chainsaw and k3d. It has a mature build system with multi-architecture Docker images, Helm charts, and automated release pipelines. While the dual-language architecture introduces some complexity and duplication (e.g., service name normalization in both Python and Go), the project is actively maintained with regular releases and a large community (4.5k stars, 700+ forks).
The Serverless Framework is a mature, open-source CLI tool for deploying and managing serverless applications on AWS. It compiles declarative YAML/JSON configuration (serverless.yml) into CloudFormation templates, orchestrates deployments via S3 artifact uploads and stack operations, and supports a wide range of AWS event sources (API Gateway, SQS, SNS, DynamoDB Streams, etc.). The repository is a monorepo with multiple packages: `sf-core` (new unified runner), `serverless` (legacy framework with AWS plugins), `engine` (AWS SDK client abstractions), `mcp` (Model Context Protocol server for AI agent integration), and `util` (shared logging, error handling, proxy support). Key entry points include `packages/sf-core/bin/sf-core.js` and `packages/serverless/lib/plugins/index.js`. The architecture is plugin-based, with lifecycle hooks for packaging, compiling events, and deploying. External dependencies include AWS SDK v2/v3, esbuild, and various npm packages. The codebase demonstrates high craftsmanship in areas like deterministic naming, proxy wrapping, and variable resolution, though some technical drift exists (dual SDK versions, deprecated providers).
HashiCorp Consul is a distributed service mesh platform providing service discovery, health checking, dynamic configuration, and multi-datacenter federation. The codebase implements a full-stack system: a Go-based agent that runs as a server or client, a CLI tool for administration, a web UI built with Ember.js, and extensive gRPC/protobuf-based APIs for internal and external communication. The agent uses Raft consensus for state replication, maintains an in-memory database (memdb) for service and configuration state, and generates Envoy xDS configuration for service mesh gateways. Key entry points include the agent server (agent/consul/), CLI commands (command/), and the UI router (ui/packages/consul-ui/app/router.js). External dependencies include protobuf, gRPC, Envoy, and various cloud provider SDKs (AWS, Azure, GCP). The codebase is actively maintained with a large test suite covering unit, integration, and acceptance tests.
pREST is a production-grade Go HTTP server that automatically exposes PostgreSQL databases as RESTful and MCP (Model Context Protocol) APIs without requiring hand-written backend code. It provides instant CRUD endpoints for any table, custom SQL template execution with parameterized queries, and a built-in Studio web UI for exploring and managing APIs. The system is architected around a hexagonal pattern with a clean adapter interface supporting multiple databases (PostgreSQL, TimescaleDB), dependency injection for controllers, and a layered middleware stack for authentication (JWT), authorization (table/field-level ACL), caching, and CORS. Security is a primary concern: SQL injection is mitigated through strict identifier validation, template parameter screening, and bound parameter binding, while credential leakage in logs is prevented by a dedicated redaction package. The codebase is well-tested with both unit tests (using sqlmock) and integration tests (against real PostgreSQL in Docker), and includes OpenTelemetry integration for observability. It is not a data research or analytics project; it is a pure application for building low-code database APIs.
decK is a CLI tool for declarative configuration management of Kong API Gateway and Konnect SaaS. It enables users to manage Kong entities (services, routes, plugins, consumers, certificates, etc.) via YAML/JSON state files, supporting sync, diff, dump, apply, reset, and validate operations. The architecture is a single binary with multiple subcommands organized under `gateway`, `file`, `ai`, and `konnect` namespaces, built on top of Kong's go-database-reconciler library for state reconciliation. Key entry points include `main.go` (signal handling), `cmd/root.go` (Cobra CLI), and command handlers in `cmd/gateway_*.go`, `cmd/file_*.go`, and `cmd/ai_*.go`. Data flows involve reading declarative state files, fetching current state from Kong Admin API or Konnect, computing diffs, and applying CRUD operations. External dependencies include Kong Gateway (>=1.x), Kong Enterprise, Konnect, and various Go libraries for Kubernetes, Terraform, and AI Gateway integrations. The repository also includes converters for generating Kubernetes Ingress Controller manifests (`kong2kic`), Terraform resources (`kong2tf`), and version migration rulesets (`convert/`).
Hasura GraphQL Engine is an open-source, metadata-driven GraphQL server that provides instant, real-time GraphQL APIs over multiple databases (PostgreSQL, MSSQL, BigQuery, CockroachDB, Citus, and custom sources via Data Connectors). The repository is a large monorepo containing a Rust-based v3 engine, a Go CLI for project management (migrations, metadata, seeds), a React/TypeScript admin console, and community boilerplates for authentication, event triggers, and remote schemas. The system exposes a single GraphQL endpoint that supports queries, mutations, subscriptions, streaming subscriptions, event triggers, cron triggers, remote joins, actions, and Apollo Federation. It relies on external databases, webhook endpoints for auth and event handling, and optionally OpenTelemetry collectors for observability. The architecture is modular: the v3 engine handles metadata resolution, GraphQL schema generation, and execution planning; the CLI manages project lifecycle; and the console provides a GUI for configuration. The codebase is actively maintained with frequent releases, but shows signs of technical drift due to legacy frontend code (Redux vs React Query), dual version support (v2/v3), and multiple programming languages (Rust, Go, TypeScript, Haskell, Python).
Direktiv is a workflow automation and serverless orchestration platform that enables users to define, execute, and manage workflows and services through a web UI or API. The system features a Go-based backend with React/TypeScript frontend, providing namespace-based multi-tenancy, event-driven triggers via CloudEvents and NATS, a plugin-extensible API gateway, and Kubernetes-native service deployment. Key capabilities include workflow execution (YAML/TypeScript), service management, secret/variable storage, file handling, Git-based namespace mirroring, and comprehensive monitoring with OpenTelemetry integration. The architecture follows a microservices-inspired monolith pattern with clear separation between API handling, data storage, execution engine, and gateway plugin systems.
This repository is the official Helm chart collection for deploying Kong API Gateway and related operators (Kong Ingress Controller, Kong Gateway Operator, Kong Operator, Kong AI Gateway) on Kubernetes. It provides production-grade deployment templates with support for DB-less, PostgreSQL, hybrid mode, enterprise features, cert-manager integration, Prometheus monitoring, and admission webhooks. The architecture is a multi-chart Helm repository with subcharts for CRDs (kic-crds, gwapi-crds, ko-crds) and extensive CI snapshot testing via helm-chartsnap. Key entry points include the main `charts/kong/` chart for the gateway and ingress controller, `charts/kong-operator/` for the Kong Operator managing Konnect and AI gateway resources, and `charts/gateway-operator/` for the Gateway API operator. External dependencies include Kong container images, cert-manager, Bitnami PostgreSQL (optional), and Konnect SaaS for enterprise deployments. The repository is actively maintained with regular releases, changelogs, and upgrade guides, though CRDs are auto-generated and may drift from upstream operator versions.
Pollinations is a large monorepo hosting a multi-modal generative AI platform. It provides a unified API gateway (gen.pollinations.ai) for text, image, video, audio, 3D, and embeddings generation, routing requests to dozens of providers (OpenAI, Anthropic, Google, Fal, Replicate, ElevenLabs, etc.) with fallback chains, caching, rate limiting, and billing. A separate enterprise service (enter.pollinations.ai) handles authentication (GitHub OAuth, API keys, device code flow), user dashboards, API key management, Stripe/Pollen billing, community-hosted model endpoints, and a quest/reward gamification system. The platform also includes a design system UI library (@pollinations/ui), a Node.js SDK, a CLI tool (polli-cli), an MCP server, and over 20 community apps (chat, AI dungeon master, image reimagine, Discord bots, etc.). Infrastructure includes Cloudflare Workers, Durable Objects, D1, R2, Tinybird for analytics, and GPU inference servers (Flux, Dreamshaper, Z-Image) deployed on Vast/IO.net. The architecture is service-oriented within a monorepo: each major service (gen, enter, media, pollinations.ai) is a separate Cloudflare Worker with its own wrangler.toml and dependencies. Shared packages (shared/, packages/) provide cross-cutting concerns like billing logic, model registry, auth middleware, HTTP error handling, and UI components. Data flows from user requests through middleware (auth, balance, cache, rate-limit, safety, model resolution) to provider-specific adapters, with usage events published to Tinybird for analytics and billing. The system is heavily tested with Vitest, including integration tests with Cloudflare Workers test environment and VCR snapshots. External dependencies include Cloudflare (Workers, D1, R2, KV, Durable Objects, Vectorize), Tinybird (analytics), Stripe (payments), GitHub (OAuth, quests), and numerous AI model providers. The codebase is predominantly TypeScript with some Python (Floret agent, GPU servers, social automation) and Rust (polli-core for Discord bot). While the core platform is well-maintained, there is significant drift in community apps and infrastructure scripts, and the sheer number of provider integrations creates maintenance surface area.