Apache ShenYu is a production-grade, plugin-based API gateway and microservices proxy platform written in Java. The runtime gateway (shenyu-bootstrap, a Spring WebFlux application) ingests HTTP/HTTPS/WebSocket traffic and processes each exchange through an ordered chain of ShenyuPlugin implementations covering protocol translation (HTTP, gRPC, Apache Dubbo, SOFA, Tars, MQTT, TCP), security (sign, JWT, OAuth2, key-auth, cryptor, WAF), traffic management (rate limiting, resilience4j), caching, logging (Kafka, Elasticsearch, RocketMQ, console), request rewriting, mocking, and AI proxy/token limiting. Routing, selector, rule, and plugin data is not hardcoded; it is synchronized dynamically from the admin plane. The management plane is shenyu-admin, a Spring MVC/MyBatis application exposing roughly 40 REST controllers for managing plugins, selectors, rules, metadata, namespaces, app auth, users/roles/permissions, discovery, and configuration import/export. Persistence supports H2, MySQL, PostgreSQL, OpenGauss, and Oracle via MyBatis mappers, with upgrade SQL scripts under db/upgrade. Configuration changes flow from admin to gateways through WebSocket, HTTP long polling, ZooKeeper, Nacos, etcd, or Apollo listeners, all built on shared abstract data-changed-listener templates. Client SDK modules (shenyu-client-*) auto-register Spring MVC, Dubbo, gRPC, SOFA, Tars, and WebSocket APIs using annotation-based extractors and a Disruptor-based async publish pipeline; a Kubernetes controller reconciles ingress/gateway-api resources. The repository demonstrates strong craftsmanship: a Dubbo-style SPI framework (@SPI/@Join/ExtensionLoader) drives pluggable match strategies, predicate judges, load balancers (Random, RoundRobin, LeastActive, P2C, ShortestResponse), cryptors, and rate limiter algorithms; shenyu-common contains a W-TinyLFU cache and memory-bounded queues that prevent OOM under burst; the admin uses domain events for audit logging and an observer pattern for Prometheus-driven auto-scaling. Testing is extensive (per-module unit tests, Spring Boot integration tests, Docker-Compose e2e suites, K8s examples). Main weaknesses are surface-area boilerplate across dozens of plugin modules, some experimental/placeholder code (WASM, AI, MCP), and a few disabled tests — typical for a large Apache project. Maintenance is active with recent commits, CodeQL scanning, and zero dependabot alerts; technical drift is low.