HTTP CONNECT, forward and SOCKS5 ingress
Existing tools connect with a standard proxy URL. Organization keys identify the tenant, and per-org tunnel limits and org blocks apply on every connection.
Open source · AGPL-3.0-only
Open-source Rust proxy platform for pools, sessions and capture.
ProxyX is one binary with roles. A pool gateway routes HTTP CONNECT and SOCKS5 traffic to upstream provider pools; a session proxy intercepts and captures HTTP, HTTP/2 and WebSocket traffic; a control plane stores it and answers queries.
git clone https://github.com/noxred-research/proxyx.git
cd proxyx
cargo build --release -p proxyxCapabilities
- HTTP CONNECT + forward
- SOCKS5
- Org keys
- Provider adapters
- Sticky sessions
- Rotation
- Circuit breakers
- Pool warmer
- Reputation scoring
- TLS interception
- TLS fingerprints
- WebSocket capture
- ClickHouse storage
- Query DSL
- Distributed limiter
- OpenTelemetry
# start the pool gateway
$ proxyx gateway --config proxyx.toml
# route a request through it with an org key
$ curl -x http://ORG_KEY@localhost:8080 \
https://example.org
# open a capture session
$ curl -X POST http://localhost:8090/v1/sessionsEarly development, version 0.1.0. The source repository is private for now; the code is licensed AGPL-3.0-only.
01Pool gateway
One entry point for every upstream pool.
Clients speak plain HTTP CONNECT, forward-proxy HTTP or SOCKS5 to the gateway. It authenticates an organization key, picks an exit from the right provider pool and keeps the pool healthy while it does.
Declarative provider adapters
Residential, ISP, datacenter, mobile and static IP pools, or your own upstreams, are described in TOML. Username templating carries geo, session and sticky parameters to each provider.
Leasing, sticky sessions and rotation
Exits are leased, held for sticky sessions and rotated on demand, so a workload sees the identity it asked for for as long as it asked.
Circuit breakers, budgets and fair use
A circuit breaker per provider stops traffic to a failing upstream. Budgets and fair-use limits keep one organization from starving the rest.
Pool warmer and verifier
Exit IPs are warmed and kept alive, checked from the outside, scored for reputation and reclaimed by a sweeper when they are no longer used.
Block-signal feedback and probes
Block signals from real traffic feed back into reputation scoring, and probes keep measuring providers when traffic is quiet.
02Session proxy
A proxy you can inspect.
The session proxy gives each session its own credentials and listeners, then sits in the middle of its traffic. It can decrypt, rewrite, record and forward it, to the internet or on to another proxy.
Per-session credentials
HTTP, CONNECT and SOCKS5 listeners accept credentials that belong to one session, so a client never needs a shared key.
Optional TLS interception
Decrypt HTTPS with a per-deployment certificate authority you create and trust. Leave interception off and the proxy tunnels TLS untouched.
Browser-grade TLS fingerprints
Fingerprint profiles make upstream TLS handshakes look like a real browser's rather than the proxy's own.
Header injection and upstream overrides
Add or replace headers and point a session at a specific upstream without touching the client.
Egress chaining
Send egress through the pool gateway, or through any upstream proxy you already operate.
Per-org rate limiting
Rate limits per organization run on a low-latency distributed token-bucket limiter, available as a standalone service with a client crate.
03Capture and control plane
From wire to query.
Everything the session proxy sees is captured as structured records, moved through a broker into ClickHouse, and made available to query and export.
Sessions API
Create, get, extend and delete sessions over REST. A session carries its credentials, its listeners and its capture settings.
HTTP/1.1, HTTP/2 and WebSocket capture
Requests, responses and WebSocket messages are recorded as they pass, for plain and intercepted TLS traffic alike.
Broker and ClickHouse storage
A Redis Streams or Kafka-compatible broker decouples capture from storage. ClickHouse holds the traffic.
Query DSL over REST and GraphQL
One query language, reachable over a REST endpoint or a GraphQL schema, for finding the traffic you captured.
Traffic export views
Saved views export captured traffic to object storage, so analysis can happen outside the platform.
Observability and runbooks
Prometheus metrics and OpenTelemetry traces from every role, with runbooks for operating them.
04Responsible use
Responsible use.
A proxy sees what passes through it. You are responsible for the traffic you route and the traffic you capture.
Do
- Use upstream pools your provider agreements allow you to use.
- Intercept TLS only for traffic you are entitled to inspect.
- Keep the interception CA private to the deployment that created it.
- Set retention and access rules for captured traffic.
Do not
- Route traffic you have no right to send, or abuse a target.
- Share organization keys or session credentials.
- Install the interception CA on devices you do not control.
- Keep captured traffic longer than you need it.
05Architecture
One binary, several roles.
A single Rust workspace builds proxyx. A role selects what the process
does: pool gateway, pool warmer and verifier, session proxy, control plane or limiter.
State lives in Postgres and Redis or Valkey.
Ingress
- HTTP CONNECT + forward
- SOCKS5
- Per-session listeners
Pool plane
- Pool gateway
- Provider adapters
- Warmer + verifier
Limiter a standalone distributed token-bucket rate-limit service
Session plane
- Session proxy
- TLS interception
- Capture
Control plane
- Sessions API
- Query DSL
- REST + GraphQL
- Export views
State and storage
- PostgreSQL
- Redis / Valkey
- ClickHouse
- Redis Streams / Kafka-compatible
- Object storage
Prometheus metrics and OpenTelemetry traces cover every role. The full diagram is in the media kit →
06Quick start
From clone to first proxied request.
You need a Rust toolchain, plus Postgres and Redis or Valkey for state. Replace
ORG_KEY with an organization key issued for your deployment.
-
Step 1 · Build
git clone https://github.com/noxred-research/proxyx.git cd proxyx cargo build --release -p proxyx -
Step 2 · Start the pool gateway
proxyx gateway --config proxyx.toml -
Step 3 · Send a request through the gateway
curl -x http://ORG_KEY@localhost:8080 https://example.org
07Control plane
Sessions API.
The control plane creates, reads, extends and deletes capture sessions. Each response carries the credentials and listeners for that session; captured traffic is queried through the query DSL over REST or GraphQL.
curl -X POST http://localhost:8090/v1/sessions08Open source
License and vulnerability reports.
AGPL-3.0-only
ProxyX is licensed under the GNU Affero General Public License, version 3 only — not “version 3 or later.” Third-party dependencies keep their own licenses and notices.
Report a vulnerability in ProxyX
Use GitHub private vulnerability reporting. Please do not open public issues for suspected vulnerabilities, and do not include live credentials or captured personal data in a report.