Overview

An exchange through roxy: TLS decryption, then an addon stack (here a service addon and a WASM addon), then the rules, then the upstream connector with its address floor, with capture recording what the rules allow before the connector; the response returns the same way; every stage writes to the flow log

roxy is a strict, programmable HTTP firewall. Requests and responses stream through addons that can rewrite, hold, answer or block them, then through rules that decide what is forwarded. Anything roxy cannot parse, verify or classify is denied (how roxy works).

Use cases

Sandbox containment. An untrusted workload's only route out is roxy. It sets HTTPS_PROXY to roxy and trusts roxy's CA. roxy decrypts each request, decides on it, injects credentials the workload never sees, and logs every decision (sandbox containment).

A workload inside a sealed sandbox network whose only exit is roxy's proxy port 3128. Requests go from the workload to roxy and on to the allowed upstreams, api.anthropic.com and github.com, with the real key added; responses come back the same way. roxy holds the CA and the secrets, and the workload fetches roxy-ca.pem from port 3130. A direct route out of the sandbox is blocked at the boundary: direct TCP, UDP and DNS have no route.

HTTP gateway. Clients send requests to roxy directly, behind a load balancer that terminates TLS. Rules route each request by host and inject the real API keys, so clients only hold placeholders (HTTP gateway).

An example gateway. Clients send HTTPS requests to a load balancer that terminates TLS and forwards plain HTTP to roxy's http listener on port 8080. Inside roxy the request streams through an auth service addon, which asks an auth service over a WebSocket who the client is and gets back allow, user=alice, or answers 401 if the caller is unknown. Then the rules route by host and inject roxy's own secrets: requests for anthropic.gw.example.com go on over HTTPS to api.anthropic.com with x-api-key added from roxy's secrets, and requests for openai.gw.example.com to api.openai.com with a bearer key added the same way. Responses return by the same path.

Try it

The quickstart runs generated traffic through roxy with an auth check, a per-user token quota and an inspect_sentinel sidecar. It needs no API key.

examples/human-approval runs Claude Code behind roxy and holds every tool call until someone clicks Approve or Deny in the browser.

Open source

roxy is open source, written in Rust, and dual-licensed under Apache 2.0 and MIT. Outstanding work is tracked in issues.

Edit on GitHub