Open source

Open source at heart.Apache 2.0 by default.

Our founders are long-time open-source users, contributors and patrons. The creator of Otoroshi is one of them, and Cloud APIM is by far the biggest contributor to the project. We give back by making the tools we build around Otoroshi available to everyone.

Cloud APIM on GitHub Join the Discord

public projects: 23
for Otoroshi & our extensions: Apache 2.0
Otoroshi extensions & plugins: 13

The foundation · #OSSbyMAIF

Otoroshi

A lightweight API management layer on top of a modern HTTP reverse proxy. Battle-tested in production since 2017, created at MAIF and developed in the open with the MAIF OSS team. Everything we build starts here.

323 stars49 forksScalaApache-2.0

otoroshi.io GitHub

Flagship projects

Built around Otoroshi,
open to everyone.

Otoroshi LLM Extension

The open-source AI gateway for Otoroshi.

Connect, set up, secure and seamlessly manage LLMs through a universal, OpenAI-compatible API. 50+ providers, guardrails, semantic cache, budgets, MCP and AI Studio.

Scala19Apache-2.0updated today

Threat Protection Suite

A WAF, IP reputation, bot control and a decision fabric for Otoroshi.

A JVM-native ModSecurity WAF with the OWASP Core Rule Set, threat-intel feeds, CrowdSec, bot mitigation and one threat score for every request — with Threat Studio, the security console for Otoroshi.

ScalaApache-2.0updated today

Biscuit Studio

Biscuit tokens, natively in your API gateway.

A set of Otoroshi plugins and entities to forge, attenuate and verify Biscuit tokens — decentralized, offline-verifiable authorization tokens — right in your gateway.

Scala4Apache-2.0updated 6 days ago

otoroshictl

A CLI to manage your Otoroshi clusters with style.

Control your Otoroshi clusters from the command line, expose local processes through remote tunnels, run a universal sidecar for an Otoroshi-based service mesh, and manage your Cloud APIM deployments.

Rust4Apache-2.0updated 16 days ago

SecLang Engine

A ModSecurity-compatible WAF library for the JVM.

An enterprise-grade, high-performance implementation of the ModSecurity SecLang language in Scala, passing 100% of the OWASP CRS v4 regression tests. The engine behind our threat protection.

Java1Apache-2.0updated 2 days ago

Otoroshi extensions

New entities, plugins and consoles that turn Otoroshi into much more than an API gateway.

API Portal

A lightweight developer portal served by Otoroshi itself.

Markdown pages, OpenAPI rendering, self-service API key subscriptions to plans and a built-in API tester, configured from your Otoroshi API entities.

ScalaApache-2.0updated 6 days ago

Clever Cloud Reaper

Put idle Clever Cloud apps to sleep, wake them on the next request.

An Otoroshi extension that stops idle Clever Cloud applications after a grace period and wakes them up transparently, with savings tracking, dry run and a kill switch.

Scalaupdated yesterday

smolvm Extension

Run code and services in micro-VMs from Otoroshi.

Run functions and HTTP services inside smolvm micro-VMs, with inline JavaScript (Node or Bun), warm pools or one VM per request for untrusted code.

ScalaApache-2.0updated 6 days ago

Otoroshi plugins

Focused plugins for specific integrations and protocols.

Dynamic JS Modules

JavaScript plugins without the compilation step.

Run JavaScript modules loaded from a URL in a WASM runtime, hooked on validation, request, backend call, response and error phases.

Scala1Apache-2.0updated 6 days ago

Mailer

Send emails through an asynchronous REST API.

Turns a route into an asynchronous REST API that sends emails through the SMTP server of your choice, with retries and Otoroshi events.

ScalaApache-2.0updated 6 days ago

Webhook Validator

Validate webhook signatures from any provider.

Provider-agnostic HMAC signature validation for incoming webhooks (GitHub, Stripe, Slack, YouSign…), with constant-time comparison.

Scala1Apache-2.0updated 6 days ago

Moesif

Send your API analytics to Moesif.

Ship Otoroshi traffic to Moesif API analytics, mapping customers and companies from API key metadata.

Scala1Apache-2.0updated 6 days ago

Curity Phantom Token

Phantom token validation with Curity.

Validate Curity phantom tokens against a Curity identity server and forward the resulting JWT to your services.

Scala1Apache-2.0updated 6 days ago

SPIFFE

SPIFFE workload identities in Otoroshi.

Validate SPIFFE JWT-SVIDs and X.509 client certificates, and preload SPIFFE CA certificates. Tested against SPIRE.

Scala2Apache-2.0updated 6 days ago

Couchbase

Couchbase as an Otoroshi datastore.

Use Couchbase as the storage backend of Otoroshi, and export Otoroshi events to Couchbase.

Scala1Apache-2.0updated 2 months ago

Libraries

Reusable building blocks for the JVM, published on Maven Central.

SecLang Engine Core Rule Set

The OWASP Core Rule Set, ready to embed.

Packages the OWASP CRS v4 as an embeddable SecLang Engine preset, importable with a single line.

ScalaApache-2.0updated 2 days ago

libinjection-jvm

SQL injection and XSS detection for the JVM.

A faithful Java port of libinjection, with SQLi detection based on thousands of fingerprints and HTML5 XSS detection. No runtime dependencies.

Javaupdated 9 months ago

Tools

Command-line tools and proxies to work with Otoroshi.

Otoroshi MCP Proxy

A local MCP proxy backed by an Otoroshi endpoint.

Connect local MCP clients to MCP servers exposed and governed by Otoroshi.

JavaScriptupdated 2 years ago

Templates & examples

Starters to get your first projects live in minutes.

Use it for free.Run it with us.

Everything here runs on your own Otoroshi. When you'd rather not operate it, Otoroshi Managed runs Otoroshi and our extensions for you — with the people that wrote the code.

Discover Otoroshi Managed Get support for your Otoroshi

Open source at heart.Apache 2.0 by default.

Otoroshi