proxy

Jun 12, 2026

Changes in this version

+ type PostgresCredentialResolver interface

+ InvalidatePassword func(host, user, database string)

+ ResolvePassword func(ctx context.Context, host, user, database string) (string, error)

+ type PostgresResolverEntry struct

+ Pattern string

+ Resolver PostgresCredentialResolver

+ type PostgresServer struct

+ func NewPostgresServer(p *Proxy) *PostgresServer

+ func (s *PostgresServer) Addr() string

+ func (s *PostgresServer) Shutdown(ctx context.Context) error

+ func (s *PostgresServer) Start(addr string) error

+ func (s *PostgresServer) Stop()

type Proxy

+ func (p *Proxy) SetPostgresResolver(pattern string, r PostgresCredentialResolver)

type RequestLogData

+ RequestMessages int64

+ ResponseMessages int64

type RunContextData

+ PostgresResolvers []PostgresResolverEntry

+ type StaticPostgresResolver struct

+ func NewStaticPostgresResolver(password string) *StaticPostgresResolver

+ func (s *StaticPostgresResolver) InvalidatePassword(host, user, database string)

+ func (s *StaticPostgresResolver) ResolvePassword(ctx context.Context, host, user, database string) (string, error)

May 11, 2026

Changes in this version

+ func UserIDFromContext(ctx context.Context) string

+ func ValidateCaptureHeaders(headers []string) error

type Proxy

+ func (p *Proxy) SetCaptureHeaders(headers []string) error

type RequestLogData

+ UserID string

Apr 22, 2026

Changes in this version

+ func RequestIDFromContext(ctx context.Context) string

type RequestLogData

+ Denied bool

+ DenyReason string

+ Grants []string

+ Host string

+ Path string

+ RequestID string

+ RequestSize int64

+ RequestType string

+ ResponseSize int64

Apr 21, 2026

Changes in this version

type Proxy

+ func (p *Proxy) SetDelegateAuth(delegate bool)

Apr 21, 2026

Changes in this version

+ type CredentialResolver func(ctx context.Context, proxyReq, innerReq *http.Request, host string) ([]credentialHeader, error)

type Proxy

+ func (p *Proxy) SetCredentialResolver(host string, resolver CredentialResolver)

Apr 21, 2026

Changes in this version

+ const MaxBodySize

+ func FilterHeaders(headers http.Header, injectedHeaders map[string]bool) map[string]string

+ func GetHostsForGrant(grant string) []string

+ func MatchesHostPattern(pattern HostPattern, host string, port int) bool

+ func OTelHandler(next http.Handler) http.Handler

+ func RecordCredentialInjection(ctx context.Context, host, headerName string)

+ func RecordPolicyDenial(ctx context.Context, scope, rule string)

+ func RegisterGrantHosts(grant string, hosts []string)

+ type CA struct

+ func LoadCA(certPEM, keyPEM []byte) (*CA, error)

+ func NewCA(caDir string) (*CA, error)

+ func (ca *CA) CertPEM() []byte

+ func (ca *CA) GenerateCert(host string) (*tls.Certificate, error)

+ type ContextResolver func(token string) (*RunContextData, bool)

+ type CredentialHeader = credentialHeader

+ type CredentialStore interface

+ GetToken func(provider string) (string, error)

+ type ExtraHeader = extraHeader

+ type HostPattern = hostPattern

+ func ParseHostPattern(pattern string) HostPattern

+ type MCPAuthConfig struct

+ Grant string

+ Header string

+ type MCPServerConfig struct

+ Auth *MCPAuthConfig

+ Name string

+ URL string

+ type PathRulesChecker func(host string, port int) bool

+ type PolicyLogData struct

+ Ctx context.Context

+ Message string

+ Operation string

+ Rule string

+ RunID string

+ Scope string

+ type PolicyLogger func(data PolicyLogData)

+ type Proxy struct

+ func NewProxy() *Proxy

+ func (p *Proxy) AddExtraHeader(host, headerName, headerValue string)

+ func (p *Proxy) AddRelay(name, targetURL string) error

+ func (p *Proxy) AddResponseTransformer(host string, transformer ResponseTransformer)

+ func (p *Proxy) RemoveRequestHeader(host, headerName string)

+ func (p *Proxy) ResolveContext(token string) (*RunContextData, bool)

+ func (p *Proxy) ServeHTTP(w http.ResponseWriter, r *http.Request)

+ func (p *Proxy) SetAWSHandler(h http.Handler)

+ func (p *Proxy) SetAuthToken(token string)

+ func (p *Proxy) SetCA(ca *CA)

+ func (p *Proxy) SetContextResolver(resolver ContextResolver)

+ func (p *Proxy) SetCredential(host, authHeader string)

+ func (p *Proxy) SetCredentialHeader(host, headerName, headerValue string)

+ func (p *Proxy) SetCredentialStore(store CredentialStore)

+ func (p *Proxy) SetCredentialWithGrant(host, headerName, headerValue, grant string)

+ func (p *Proxy) SetLogger(logger RequestLogger)

+ func (p *Proxy) SetMCPServers(servers []MCPServerConfig)

+ func (p *Proxy) SetNetworkPolicy(policy string, allows []string, grants []string)

+ func (p *Proxy) SetNetworkPolicyWithRules(policy string, allows []string, grants []string, checker RequestChecker, ...)

+ func (p *Proxy) SetPolicyLogger(logger PolicyLogger)

+ func (p *Proxy) SetTokenSubstitution(host, placeholder, realToken string)

+ func (p *Proxy) SetUpstreamCAs(pool *x509.CertPool)

+ type RequestChecker func(host string, port int, method, path string) bool

+ type RequestLogData struct

+ AuthInjected bool

+ Ctx context.Context

+ Duration time.Duration

+ Err error

+ InjectedHeaders map[string]bool

+ Method string

+ RequestBody []byte

+ RequestHeaders http.Header

+ ResponseBody []byte

+ ResponseHeaders http.Header

+ RunID string

+ StatusCode int

+ URL string

+ type RequestLogger func(data RequestLogData)

+ type ResponseTransformer func(req, resp any) (any, bool)

+ type RunContextData struct

+ AWSHandler http.Handler

+ AllowedHostPorts []int

+ AllowedHosts []hostPattern

+ CredStore CredentialStore

+ Credentials map[string][]credentialHeader

+ ExtraHeaders map[string][]extraHeader

+ HostGateway string

+ HostGatewayIP string

+ KeepEngines map[string]*keeplib.Engine

+ MCPServers []MCPServerConfig

+ PathRulesCheck PathRulesChecker

+ Policy string

+ RemoveHeaders map[string][]string

+ RequestCheck RequestChecker

+ ResponseTransformers map[string][]ResponseTransformer

+ RunID string

+ TokenSubstitutions map[string]*tokenSubstitution

+ type Server struct

+ func NewServer(proxy *Proxy) *Server

+ func (s *Server) Addr() string

+ func (s *Server) Port() string

+ func (s *Server) Proxy() *Proxy

+ func (s *Server) SetBindAddr(addr string)

+ func (s *Server) SetPort(port int)

+ func (s *Server) Start() error

+ func (s *Server) Stop(ctx context.Context) error

+ type TokenSubstitution = tokenSubstitution

+ func NewTokenSubstitution(placeholder, realToken string) *TokenSubstitution