A security-first reverse proxy built to guard the free web Website ·
Docs ·
Source ·
Agent Registry
Zentinel is a high-performance reverse proxy written in Rust, built on Cloudflare Pingora . It uses a pluggable agent architecture — each security or middleware concern is an isolated, composable module that you can mix, match, and extend.
Repo Description zentinelThe proxy core — routing, TLS, load balancing, agent pipeline zentinel-modsecPure Rust ModSecurity engine with OWASP CRS compatibility zentinel-convertConvert nginx / HAProxy / Envoy / Traefik / Caddy configs to Zentinel
Agent What it does authJWT, API keys, OIDC, mTLS, SAML wafOWASP CRS web application firewall zentinelsecPure Rust ModSecurity WAF (no C deps) modsecModSecurity via libmodsecurity bindings denylistIP and pattern-based blocking ratelimitToken bucket rate limiting bot-managementBot detection and management ip-reputationThreat intelligence and blocklist checks ai-gatewayLLM proxy — prompt injection, PII, jailbreak detection graphql-securityQuery depth, complexity, and introspection control grpc-inspectorgRPC authz, rate limiting, metadata inspection websocket-inspectorWebSocket content filtering and schema validation content-scannerMalware scanning with ClamAV spiffeSPIFFE / SPIRE workload identity policyPolicy evaluation — Rego/OPA + Cedar soapSOAP envelope validation and WS-Security audit-loggerCompliance logging with PII redaction api-deprecationAPI lifecycle and deprecation management
Agent What it does luaCustom logic via Lua scripts jsCustom logic via JavaScript wasmRun WebAssembly modules in the request pipeline transformRequest / response header and body transforms image-optimizationOn-the-fly JPEG/PNG to WebP/AVIF conversion with caching mock-serverStub responses for testing chaosFault injection for resilience testing mqtt-gatewayMQTT protocol gateway
Build your own agents in your language of choice.
Built with Rust and Pingora. Based in Switzerland.
