frp is a high-performance reverse proxy application that exposes local services behind NAT or firewalls to the internet. It implements a client-server architecture where the frpc client connects to the frps server, registers proxies (TCP, UDP, HTTP, HTTPS, STCP, XTCP, TCPMUX), and tunnels traffic through encrypted, compressed connections. The system supports multiple transport protocols (TCP, KCP, QUIC, WebSocket, WSS), authentication (token, OIDC), health checks, load balancing, bandwidth limiting, and a plugin system for both client and server extensions. It also includes NAT hole punching for direct peer-to-peer connections and an SSH tunnel gateway that allows SSH clients to create tunnels without frpc. The codebase is well-structured with clear separation of concerns: configuration loading and validation in pkg/config/, wire protocol and message handling in pkg/msg/ and pkg/proto/, network utilities in pkg/util/net/, and proxy implementations in server/proxy/ and client/proxy/. The project includes comprehensive end-to-end tests, a Vue.js web dashboard for both server and client management, Prometheus metrics, and a store API for dynamic proxy configuration at runtime. The architecture is modular, using factory patterns for proxy types, visitor patterns for P2P connections, and an aggregator pattern for merging configuration sources. Despite its complexity, the codebase is actively maintained with regular releases, extensive documentation, and a large community. It demonstrates strong engineering practices including interface-based design, dependency injection for testability, and careful concurrency management. The main technical debt is the coexistence of legacy INI configuration and v1 wire protocol alongside newer formats, but these are well-isolated and migration paths are provided.
mitmproxy is a production-grade, interactive HTTPS proxy that intercepts, inspects, modifies, and replays HTTP/1, HTTP/2, HTTP/3, WebSocket, TCP, UDP, DNS, and QUIC traffic. It supports multiple proxy modes (regular, transparent, reverse, upstream, SOCKS5, DNS, WireGuard, TUN, local) and provides three frontends: a console TUI (mitmproxy), a command-line dump tool (mitmdump), and a web UI (mitmweb). The architecture is event-driven with a sans-IO proxy layer design: protocol layers yield commands and events processed by an asyncio event loop. An extensive addon system allows users to extend functionality via lifecycle hooks, custom commands, and content views. The codebase is well-structured, heavily typed, and includes a comprehensive test suite with fuzzing and benchmarks. It is actively maintained with frequent releases and security patches.
Headroom is a context optimization layer for LLM applications that reduces token usage by 50-90% through intelligent compression, caching, and memory systems. It provides a transparent proxy between LLM clients (like Claude Code, Cursor, etc.) and LLM providers (Anthropic, OpenAI, etc.), implementing CCR (Compress-Cache-Retrieve) for lossless compression with retrieval capability. The system features a hybrid polyglot architecture with a Rust-based high-performance proxy core, Python ecosystem for extensibility, and TypeScript SDK. Key capabilities include agent wrapping, cross-agent memory using Qdrant/Neo4j, observability through metrics and dashboard, and a learning system that analyzes interaction patterns to generate optimization rules. Deployment options include Docker, system services, and direct execution.
spoofdpi is a high-performance, cross-platform proxy tool written in Go that bypasses Deep Packet Inspection (DPI) by fragmenting and desynchronizing TLS handshakes and UDP packets. It operates in three modes: HTTP proxy, SOCKS5 proxy, and TUN interface (transparent proxy). The architecture is modular and clean, with clear separation of concerns: a config layer (TOML + CLI flags), a rule engine for domain/CIDR-based policy matching, a DNS resolver with multiple backends (UDP, DoH, system), a packet capture/injection layer using pcap or Linux raw sockets, and a desync engine that applies configurable split strategies (SNI, chunk, random, custom) and fake packets. The codebase demonstrates strong engineering practices: extensive use of interfaces for platform-specific code (Darwin/Linux/FreeBSD stubs), generic data structures (sharded LRU cache, TTL cache, domain trie with wildcard/globstar), concurrent connection management with idle timeouts, and structured logging with trace IDs. It includes a TUI mode using Bubble Tea. The project is actively maintained with recent commits, comprehensive CI/CD, and thorough test coverage for configuration parsing, rule matching, and desync logic. The code is of high quality and contains several reusable components.
This repository implements a local MTProto proxy for Telegram Desktop, designed to bypass network censorship by wrapping Telegram's protocol in WebSocket connections, often routed through Cloudflare. It is a fully-featured desktop application with CLI and GUI modes, providing a robust solution for circumventing DPI-based blocking. The architecture is a monolithic asyncio application with a clear separation of concerns: the `proxy/` package handles the core protocol translation (MTProto to WebSocket, Fake TLS, HTTP/2 multiplexing), the `ui/` package provides a cross-platform tray interface using CustomTkinter, and `utils/` contains supporting infrastructure like update management and diagnostics. The system employs a sophisticated fallback chain (WebSocket pool -> Cloudflare Proxy -> Cloudflare Worker -> Direct TCP) to ensure reliability. The codebase demonstrates high engineering craftsmanship. It features several genuinely reusable components, including a custom `httpx` HTTP/2 transport, a robust connection pool with exponential backoff, and an atomic self-update mechanism with rollback. While tightly coupled to Telegram's specific protocol, the underlying patterns for network resource management, protocol obfuscation, and desktop application lifecycle are well-isolated and could be extracted for other projects. The extensive test suite and professional CI/CD pipeline further attest to its quality.
v2rayN is a cross-platform GUI client for managing proxy configurations (V2Ray, Xray, sing-box, etc.). It features dual UI frameworks (WPF for Windows, Avalonia for Linux/macOS) with shared MVVM architecture using ReactiveUI. The application handles server management, subscription processing, routing rules, DNS configuration, system proxy control, and traffic statistics. Core functionality includes generating core-specific configuration files, testing server performance, and integrating with external proxy binaries. The codebase demonstrates strong separation of concerns with distinct layers for models, services, handlers, and viewmodels.
LiteLLM is a production-grade, open-source proxy/gateway for over 200 large language model (LLM) providers, including OpenAI, Anthropic, Azure, Bedrock, Gemini, and many more. It presents a unified OpenAI-compatible API, handling request routing, authentication, rate limiting, cost tracking, caching, guardrails (content filtering, PII detection), and audit logging. The system is architected as a FastAPI Python server with a Next.js admin dashboard, Rust extensions for performance-critical paths (token counting, caching, auth, cost calculation), and optional PostgreSQL/Redis backends. It supports streaming, MCP (Model Context Protocol), A2A (Agent-to-Agent) protocol, and enterprise features like SSO, secret management, and Terraform deployment modules. Key entry points include the proxy server (litellm/proxy/proxy_server.py), CLI commands (litellm, litellm-proxy), and the admin UI at /ui/litellm-dashboard. The primary data flow is from client requests (chat completions, embeddings, audio, images) received by the proxy, which authenticates, applies guardrails, routes to the configured LLM provider(s), logs usage, and returns a standardized response. Caching is multi-tier (Redis, disk, S3, GCS, Azure Blob, semantic). Spend tracking is aggregated into daily tables and exposed via the management API and UI. External dependencies include PostgreSQL (via Prisma ORM), Redis (for distributed caching, rate limiting, and queuing), and cloud-specific secret managers (AWS Secrets Manager, GCP Secret Manager, Azure Key Vault, HashiCorp Vault). The project uses uv for Python dependency management, Cargo for Rust crates, and npm/pnpm for the dashboard. Extensive CI/CD pipelines (CircleCI, GitHub Actions) run unit, integration, e2e, mutation, and Rust-Python parity tests.
FlClash is a production multi-platform proxy/VPN client that embeds and manages the mihomo (Clash.Meta) Go core. The Dart/Flutter app (Riverpod, Drift, freezed) drives a real core lifecycle: profile/subscription import and validation, proxy group and rule management, TUN/VPN on Android, system proxy on desktop, live connections/requests/DNS views, latency probing, streaming-service availability checks, and WebDAV backup/restore. The Go core exposes a method-dispatch IPC contract (updateConfig, changeProxy, getConnections, watchRoute, probe, serviceCheck, etc.) consumed through an Android cgo bridge and a desktop helper process. This is a full application, not a library or data project — no notebooks, no research pipelines. The architecture is layered: Flutter UI → manager/provider layers → core controller → framed JSON IPC → Go mihomo core. Desktop builds add a Rust privileged helper service (systemd unit / Windows SCM, Unix socket with peer-credential auth) and Rust plugins for global hotkeys, QuickJS evaluation of script-based profile overrides, and a rope-backed code editor (code_forge). Native integration plugins for system tray, window management, system proxy, and WiFi SSID are shipped as separate Dart packages with per-OS implementations in C++/Swift/Kotlin. A custom build-hook system compiles and SHA-256-fingerprints the Go core and Rust helper artifacts with file-locking to make native builds cacheable and idempotent. The codebase is unusually disciplined. Test/ subdirectories include contract tests that parse Go structs from the mihomo submodule to verify DNS-override parity, AST-parsing tests verifying every core method is dispatchable, architectural lint tests (platform layering, dead-file detection, UI tooltip enforcement, Material-icon bans), plus unit and widget tests across every layer. Concurrency is handled deliberately: priority message batching between core and UI, serial task scheduling, claim/cancel semantics for GEO/probe updates, and an Android service state machine with newest-request-wins arbitration. Release tooling generates changelogs from conventional commits and a CI pipeline produces deb/rpm/AppImage/DMG/Inno packages. Caveats: the polyglot stack (Dart, Go, Rust, Kotlin, C++, Swift) and tight coupling to mihomo internals via a git submodule make wholesale extraction impractical, and large amounts of generated code (freezed, riverpod_generator, Drift, flutter_rust_bridge) require coordinated regeneration. Browser-platform and TV branches add conditional complexity, and some UI tests assert precise pixel/animation timings that are brittle. The genuinely reusable value lives in the standalone patterns — IPC framing and batching, the rope data structure, fractional indexing, async utilities, and the fingerprinted build cache — plus the independent plugin packages themselves.
MockServer is a highly sophisticated, multi-protocol HTTP(S) mock server and proxy for testing, written in Java with Netty. It supports HTTP/1.1, HTTP/2, HTTP/3 (QUIC), gRPC, WebSockets, DNS, TCP, and binary protocols on a single port. The core engine provides expectation-based request matching, response generation, forwarding, proxying, recording, verification, and chaos engineering (latency, connection drops, error injection). It also includes built-in LLM mocking (OpenAI, Anthropic, Gemini, etc.), OIDC/OAuth2/SAML identity providers, SCIM provisioning, WASM custom rules, and drift detection. The repository is a monorepo containing the Java server, multi-language client libraries (Java, Node, Python, Ruby, Go, .NET, Rust, PHP), a React dashboard UI, IDE plugins (JetBrains, VS Code), Helm charts, Docker images, and extensive CI/CD pipelines via Buildkite. The architecture is modular with clear separation of concerns: core model/matcher/serialization in `mockserver-core`, Netty transport in `mockserver-netty`, language-specific clients in `mockserver-client-*`, and a React UI in `mockserver-ui`. The codebase demonstrates strong engineering practices including DTO patterns with Jackson serializers, a matcher hierarchy with compiled-once validators, bounded caches, constant-time equality checks, and extensive test coverage with integration tests across multiple environments.
Chucker is a production-grade Android library for inspecting HTTP(S) traffic in-app. It acts as an OkHttp interceptor, capturing full request/response details (headers, bodies, timing, errors) and persisting them to a local Room database. The library provides a built-in Material Design UI for browsing, searching, filtering, and exporting transactions (HAR 1.2, plain text, curl commands). It is designed as a debug-only tool via a no-op variant for release builds. The architecture follows a clean separation: public API (ChuckerInterceptor, ChuckerCollector, BodyDecoder), internal data layer (Room entities, DAO, repository), support utilities (okio stream manipulation, JSON formatting, background services), and a full set of UI fragments/adapters. The codebase is well-tested (unit tests for interceptors, DAO, repository, utilities, ViewModels) and follows modern Android development practices (Kotlin, Coroutines, LiveData/Flow, ViewBinding, Compose sample). It handles edge cases like compressed bodies, large payloads, binary formats (protobuf), GraphQL, and SSL/TLS information. The project also includes CI/CD pipelines, automated dependency updates via Renovate, and migration guides for previous versions. While primarily an application library, it has a strong data storage component (Room database) and export functionality (HAR generation), making it useful for debugging network issues in any Android app.
sing-box is a universal proxy platform written in Go, serving as both a client and server for a wide range of proxy protocols including Shadowsocks, VMess, VLESS, Trojan, Hysteria2, TUIC, WireGuard, Tailscale, OpenVPN, OpenConnect, and many more. It features a modular architecture with pluggable inbounds, outbounds, services, and endpoints, all managed through a central routing engine with rule-based traffic steering, DNS resolution, and traffic sniffing. The system is designed for cross-platform deployment, with native support for Linux, macOS, Windows, Android, iOS, and tvOS, and includes a daemon mode with gRPC API for remote management, a Clash-compatible REST API, and mobile library bindings via gomobile. The architecture is built around adapter interfaces and generic registries, allowing easy extension with new protocols and services. The codebase demonstrates high craftsmanship in areas such as multi-engine TLS abstraction (supporting standard Go TLS, uTLS for fingerprinting, Apple's SecureTransport, Windows SChannel, and kernel TLS), parallel happy-eyeballs dialing, binary rule-set serialization, HTTP transport fallback with broken-authority tracking, and platform-specific packet manipulation (WinDivert on Windows, pf on macOS, netfilter on Linux). The project is actively maintained with frequent commits, extensive integration tests, and a comprehensive documentation site. While the codebase is large and contains experimental features, the core abstractions are clean and well-isolated, making many components genuinely reusable in other network-oriented Go projects.
GreenTunnel is a local proxy that bypasses DPI (Deep Packet Inspection) censorship. It works by intercepting HTTPS CONNECT tunnels, detecting the TLS ClientHello, and splitting it into fragments (either TCP segments or valid TLS records) so that the SNI (Server Name Indication) containing the target hostname never appears whole in a single packet. DNS resolution is performed over encrypted channels (DoH/DoT) to prevent ISP-level blocking. The repository contains a complete TypeScript rewrite of the engine, a CLI tool (`gt`), and an Electron desktop app. The engine is deliberately separated from the OS proxy configuration (handled by `SystemProxy`) and from the CLI output, making it testable and crash-safe. The codebase demonstrates strong engineering practices: proper error handling (no silent catch-and-return), backpressure-aware socket writes, framing-aware HTTP request rewriting, and a crash-proof system-proxy snapshot/restore mechanism. The desktop app features a live log panel with virtual scrolling, a tray icon, and a modal star/share prompt scheduled over three asks. The repository is actively maintained with modern tooling (Node 24, TypeScript 6, Electron 43, Vitest 4) and has a comprehensive test suite and CI/CD pipeline.
HTTrack is a mature, production-grade website mirroring/offline browsing tool written in C. It recursively downloads websites to a local directory, rewriting links to enable offline browsing. The system includes a command-line interface (httrack), a web-based GUI (htsserver), a caching proxy (proxytrack), and a shared library (libhttrack). The core engine manages multi-threaded HTTP/HTTPS/FTP downloads, incremental updates via a zip-based cache, WARC/WACZ archival output, and robust link filtering. The architecture is monolithic but modularized into loosely coupled subsystems (caching, URL naming, HTML parsing, content decoding, robots.txt handling, etc.). Key entry points are in src/httrack.c, src/htsserver.c, and src/proxy/main.c. Data flows: user-provided URL seeds → DNS resolution → HTTP fetch → HTML parsing → link extraction → deduplication → resource download → local mirror tree or WARC output. External dependencies include zlib (required), OpenSSL (optional for WARC digests), and iconv (optional for charset conversion). The codebase is extensively tested with integration tests, fuzz harnesses, and self-tests; it also includes a standalone reusable test HTTP server and a WARC validator.
ProxyPool is a production-grade proxy pool application that automatically collects free HTTP/HTTPS proxies from over a dozen public sources, validates their availability, and stores them in Redis or SSDB. It provides a Flask RESTful API for consuming proxies (get, pop, all, count, delete) and uses APScheduler for periodic fetching and validation. The architecture is a monolith with two main processes: a scheduler that runs fetch/check cycles and an API server (Flask with Gunicorn on Linux). The codebase demonstrates strong software engineering practices: a plugin-based fetcher system with dynamic module loading and caching, a clean Proxy data model with JSON serialization, a decorator-based validator registration pattern, and a layered test suite (unit, API, integration) with fakeredis mocking. External dependencies include Redis/SSDB, APScheduler, Flask, requests, and lxml. The project is actively maintained with recent commits and a comprehensive test suite.
ProxyManager is a PHP library for generating proxy classes at runtime. It provides implementations for several proxy patterns: lazy loading (ghost and value holder), access interceptors (with value holder or scope localizer), null objects, and remote objects. The library uses Laminas Code for code generation and reflection to dynamically create proxy classes that wrap or substitute real objects. It is designed as a standalone Composer package with a configuration-driven architecture: a central Configuration object manages autoloading, generator strategies (evaluating or file-writing), class name inflectors, and signature verification. Factories (e.g., LazyLoadingValueHolderFactory, NullObjectFactory) serve as the primary entry points for users, each producing proxies for a given class or interface. The generated proxies include methods for initialization control, interceptor callbacks, and property access simulation. The library is extensively tested with unit tests, functional tests, and mutation testing, and includes benchmarks for performance. External dependencies are limited to Laminas Code and Composer's installed versions API.
HevSocks5Tunnel is a lightweight, high-performance tun2socks proxy written in C. It creates a virtual TUN interface and forwards all TCP/UDP traffic through a SOCKS5 proxy, supporting IPv4/IPv6 dual-stack, UDP-in-UDP and UDP-in-TCP relay modes, optional local ICMP echo replies, and a mapped DNS feature for transparent DNS resolution. The architecture is monolithic but modular: a YAML-based configuration parser, platform-specific tunnel backends (Linux, FreeBSD, macOS, NetBSD, Windows via Wintun), and a session management layer built on top of lwIP and the hev-task-system cooperative multitasking library. It can be used as a standalone CLI tool, a static/shared library, or embedded via JNI on Android. The codebase demonstrates strong C craftsmanship with clean abstractions, efficient I/O patterns (ring buffer with iovec, scatter/gather), and careful platform abstraction.
tsbridge is a production-grade reverse proxy that exposes multiple backend services on a Tailscale tailnet using isolated tsnet nodes per service. It supports static TOML configuration and dynamic Docker label discovery, with hot-reload, graceful shutdown, Prometheus metrics, and a composable middleware chain (access log, whois identity lookup, request ID, body size limits, header sanitization). The architecture is a single Go binary that manages per-service tsnet.Server instances, each with its own state directory and listener. External dependencies are Tailscale (tsnet), Docker (optional), and Prometheus. The codebase demonstrates strong engineering practices: interface-based abstractions (TSNetServer, config.Provider), typed error hierarchy, secret resolution with redaction, debounced event handling with exponential backoff, and comprehensive unit and integration tests. It is actively maintained with CI/CD, dependabot, and regular dependency updates.
v2rayNG is a production-grade Android VPN/proxy client that provides a comprehensive interface for managing V2Ray and Xray proxy configurations. It supports multiple proxy protocols (VMess, VLESS, Shadowsocks, Trojan, WireGuard, Hysteria2, SOCKS, HTTP), subscription management with auto-update, routing rules, per-app proxy, and backup/restore via local files or WebDAV. The app runs in three modes: VPN (TUN), proxy-only (local SOCKS/HTTP), and root (iptables transparent proxy). It uses native cores (Xray or v2fly) via JNI and manages complex configuration generation, including DNS segmentation, observatory-based load balancing, and fragment settings. The architecture follows standard Android patterns with Compose UI, ViewModels, and background services in separate processes. The codebase is actively maintained with a large community, though some modules (e.g., CoreConfigManager) are monolithic and could benefit from further decomposition.
One API is a production-ready OpenAI API gateway that aggregates 30+ LLM providers (OpenAI, Anthropic, Google Gemini, Azure, Baidu, Alibaba, Zhipu, Moonshot, DeepSeek, Ollama, etc.) behind a single OpenAI-compatible endpoint. The Go backend implements a sophisticated relay system with provider-specific adaptors that translate OpenAI-format requests to each provider's native API. It features token-based quota management with group/channel multipliers, load balancing across channels, automatic failover, channel health monitoring with metric-based auto-disable, and multi-node deployment with Redis synchronization. The React frontend (three themes: default, berry, air) provides admin dashboards for channel/token/user management, billing visualization, and system configuration. The codebase demonstrates strong engineering practices: clean adaptor pattern for provider extensibility, comprehensive middleware chain, batched database updates for performance, and well-structured configuration management.
Xboard is a production-grade proxy/VPN subscription management panel built on Laravel 11/12 with Octane (Swoole) for high performance. It manages the full lifecycle of proxy service subscriptions: user registration and authentication, plan selection, order processing with coupon and gift card support, payment integration via a plugin system (Alipay, BTCPay, Coinbase, etc.), and real-time node synchronization through a Workerman WebSocket server. The system generates subscription configurations for multiple client applications (Clash, Surge, Loon, Shadowrocket, SingBox, etc.) using a pluggable protocol abstraction layer. It includes an admin panel with full CRUD for servers, users, orders, tickets, and statistics, plus a Telegram bot plugin for user self-service. The architecture follows Laravel best practices with service classes, form request validation, queue jobs (Horizon), Redis caching, and a custom plugin system that supports both payment gateways and feature extensions. The codebase is well-structured with clean abstractions, though it has a large migration history and some Chinese comments. The project is in limited new feature development mode but actively maintained for critical fixes and security updates.