conforacle/

NeoOracle Service

HTTP oracle proxy service for the Neo Service Layer.

Overview

The NeoOracle service provides a secure HTTP proxy for fetching external data from within the MarbleRun TEE. It enforces an outbound URL allowlist and can inject user-owned secrets into outbound requests (for authenticated APIs).

This service is intended to be reached via the gateway (Supabase Edge) rather than directly.

Architecture

┌──────────────┐     ┌──────────────┐     ┌──────────────┐
│ User Contract│     │ Oracle       │     │ External API │
│              │     │ Service (TEE)│     │              │
└──────┬───────┘     └──────┬───────┘     └──────┬───────┘
       │                    │                    │
       │ Request Data       │                    │
       │───────────────────>│                    │
       │                    │                    │
       │                    │ Fetch Data         │
       │                    │───────────────────>│
       │                    │                    │
       │                    │ Response           │
       │                    │<───────────────────│
       │                    │                    │
       │ Response (mTLS)    │                    │
       │<───────────────────│                    │

API Endpoints

Request/Response Types

Query (Fetch Data)

POST /query
{
    "url": "https://api.binance.com/api/v3/account",
    "headers": {
        "Accept": "application/json"
    },
    "method": "GET",
    "secret_name": "binance_api_key",
    "secret_as_key": "X-MBX-APIKEY"
}

Query Response

{
    "status_code": 200,
    "headers": {
        "Content-Type": "application/json"
    },
    "body": "{\"any\":\"string\"}"
}

Supported Features

Security

• All outbound requests originate from within the MarbleRun TEE (attested identity via mTLS)
• Strict identity mode enforces HTTPS-only outbound URLs
• URL allowlist support via ORACLE_HTTP_ALLOWLIST

Configuration

Environment Variables

Testing

go test ./services/conforacle/... -v -cover

Current test coverage: 58.6%

Version

• Service ID: neooracle
• Version: 1.0.0