Open-source rate-limiting software
231 open-source libraries, tools and applications tagged rate-limiting, ranked by how closely rate-limiting is their primary purpose, then by adoption and maintenance health. Each entry links to a page with sources, use cases and when to choose or avoid it.
231 products, primary matches first, then adoption-weighted; health v2 shown.
| Product | Health v2 | Stars | Maturity |
|---|---|---|---|
| OmniRoute OmniRoute is an open‑source AI gateway that provides a single OpenAI‑compatible endpoint routing requests across hundreds of LLM providers.… | 78 | 77757 | active |
| alibaba/spring-cloud-alibaba Spring Cloud Alibaba is a Java-based framework that extends Spring Cloud with Alibaba middleware components. It provides out‑of‑the‑box sol… | 86 | 29172 | active |
| TecharoHQ/anubis Anubis is a Go‑based service that adds a proof‑of‑work challenge to incoming HTTP requests to deter AI‑driven crawlers. It acts as middlewa… | 88 | 23520 | active |
| Sentinel Sentinel is a flow control and reliability library for microservices, providing rate limiting, traffic shaping, concurrency limiting, circu… | 70 | 23144 | stable |
| Polly Polly is a .NET resilience and transient-fault-handling library that lets developers express resilience strategies such as Retry, Circuit B… | 93 | 14244 | stable |
| Wei-Shaw/claude-relay-service A self-hosted relay/proxy service for Claude Code (and OpenAI, Gemini, Droid) subscriptions that lets multiple users share accounts via ind… | 83 | 12667 | active |
| hotheadhacker/no-as-a-service No-as-a-Service is a lightweight Express.js REST API that returns a random, witty rejection reason as JSON. It is hosted publicly and can a… | 53 | 7997 | stable |
| coleifer/huey Huey is a lightweight Python task queue supporting Redis, Postgres, SQLite, file-system, or in-memory storage. It offers scheduled, periodi… | 96 | 6045 | active |
| rack/rack-attack Rack::Attack is Rack middleware for protecting Ruby and Rails web applications from abusive clients. It lets you define rules to allow, blo… | 66 | 5764 | stable |
| Discovery Nepxion Discovery is a cloud-native microservice governance framework for Spring Cloud and Spring Cloud Alibaba. It provides blue-green and… | 46 | 5752 | active |
| pk910/PoWFaucet A self-hostable, modularized faucet for EVM-compatible blockchain testnets that distributes test ETH with multiple bot-protection mechanism… | 90 | 5622 | active |
| unkeyed/unkey Unkey is an open-source, source-available developer platform for modern APIs that combines instant deployments, a globally distributed gate… | 92 | 5462 | active |
| Dramatiq Dramatiq is a fast and reliable distributed background task processing library for Python 3.10+. It uses an actor-based API with RabbitMQ o… | 88 | 5326 | active |
| mitchellkrogza/nginx-ultimate-bad-bot-blocker A drop-in Nginx configuration package that blocks bad bots, spam referrers, vulnerability scanners, malware, adware, and fake Googlebots, w… | 75 | 4792 | active |
| uber-go/ratelimit A Go library implementing a blocking leaky-bucket rate limiter. It refills the bucket based on elapsed time between requests, and Take() sl… | 32 | 4721 | stable |
| emissary-ingress/emissary Emissary-ingress is an open-source, Kubernetes-native API gateway, Layer 7 load balancer, and Kubernetes Ingress built on Envoy Proxy. It i… | 83 | 4521 | stable |
| failsafe-lib/failsafe Failsafe is a lightweight, zero-dependency Java library for fault tolerance, wrapping executable logic with composable resilience policies … | 55 | 4313 | active |
| OptimalBits/bull Bull is a Redis-based job and message queue library for Node.js supporting priorities, scheduling, retries, and rate limiting. It is now in… | 72 | 16256 | maintenance |
| Netflix/concurrency-limits A Java library that applies TCP congestion control concepts to automatically detect and enforce concurrency limits for services. It uses la… | 52 | 3615 | active |
| animir/node-rate-limiter-flexible A Node.js/Deno library for counting and limiting events with atomic rate limiting across many backends including Redis, Valkey, Memcached, … | 96 | 3589 | stable |
| express-rate-limit/express-rate-limit A rate-limiting middleware library for the Express web server, written in TypeScript. It limits repeated requests per IP or key over config… | 99 | 3311 | stable |
| Tencent/spring-cloud-tencent Spring Cloud Tencent is a Spring Cloud-based service governance framework from Tencent that implements the standard Spring Cloud SPI and in… | 95 | 3297 | active |
| sindresorhus/p-limit A tiny JavaScript library that limits the concurrency of promise-returning and async functions, so only a fixed number run at once. It work… | 92 | 2928 | stable |
| sky22333/hubproxy HubProxy is a lightweight self-hosted Go proxy server that accelerates Docker registry pulls (Docker Hub, GHCR, Quay, GCR, registry.k8s.io)… | 79 | 2893 | active |
| juju/ratelimit A Go library implementing an efficient, concurrency-safe token-bucket rate limiter. It supports blocking and non-blocking token consumption… | 23 | 2880 | stable |
| Tollbooth Tollbooth is a Go middleware library for rate-limiting HTTP requests. It supports limiting by remote IP, path, HTTP methods, custom headers… | 32 | 2849 | stable |
| bucket4j/bucket4j Bucket4j is a Java rate-limiting library based on the token-bucket algorithm, offering lock-free, high-precision integer arithmetic impleme… | 94 | 2807 | stable |
| envoyproxy/ratelimit A Go/gRPC rate limiting service from the Envoy project that provides centralized, generic rate limiting for distributed applications. It st… | 67 | 2707 | active |
| Polaris Service Discovery & Governance Polaris is an open-source service discovery and governance platform for microservice and distributed architectures, developed by Tencent. I… | 42 | 2564 | active |
| mCaptcha/mCaptcha mCaptcha is a self-hosted, privacy-respecting CAPTCHA system that uses SHA-256 proof-of-work to rate-limit users instead of image puzzles. … | 39 | 2493 | active |
| dingo/api Dingo API is a PHP package that provides tools for building RESTful APIs on top of the Laravel and Lumen frameworks. It offers content nego… | 23 | 9378 | maintenance |
| ulule/limiter A dead-simple rate limiting middleware library for Go supporting HTTP, FastHTTP, and Gin. It uses a pluggable store approach with built-in … | 23 | 2343 | stable |
| failsafe-go/failsafe-go Failsafe-go is a Go library for building fault-tolerant applications by wrapping functions with composable resilience policies. It provides… | 96 | 2254 | active |
| NatLabRockies/api-umbrella API Umbrella is an open source API management platform that sits as a layer above existing web service APIs. It standardizes access control… | 64 | 2199 | active |
| vulcand/oxy Oxy is a Go library of HTTP middleware handlers that extend the standard net/http library with reverse proxying, load balancing, rate limit… | 70 | 2105 | active |
| laurentS/slowapi SlowAPI is a rate limiting library for Starlette and FastAPI, adapted from flask-limiter and built on top of the limits package. It support… | 82 | 2070 | stable |
| upstash/ratelimit-js A TypeScript rate limiting library backed by Upstash Redis that works over HTTP, making it suitable for serverless and edge runtimes. It pr… | 93 | 2046 | stable |
| SGrondin/bottleneck Bottleneck is a lightweight, zero-dependency task scheduler and rate limiter for Node.js and the browser. It supports distributed rate limi… | 23 | 2004 | stable |
| BiglyBT BiglyBT is a feature-filled, open-source, ad-free BitTorrent client forked from the Azureus project and maintained by original developers. … | 83 | 1961 | active |
| connor4312/cockatiel Cockatiel is a TypeScript/Node.js resilience and transient-fault-handling library inspired by .NET's Polly. It lets developers compose poli… | 67 | 1829 | active |
| Safe3/uusec-waf UUSEC WAF is a free, high-performance web application firewall and API security gateway (WAAP) that combines AI/semantic detection engines … | 95 | 1715 | active |
| openappsec/openappsec open-appsec is an open-source machine learning security engine that provides preemptive web application and API threat protection against O… | 90 | 1715 | active |
| jazzband/django-axes django-axes is a Django plugin that tracks failed login attempts and blocks brute-force attacks on Django-powered sites. It supports monito… | 93 | 1699 | stable |
| nodeshift/opossum Opossum is a Node.js circuit breaker library that wraps asynchronous functions (promises and callbacks) and monitors their execution, faili… | 90 | 1689 | active |
| C0nw0nk/Nginx-Lua-Anti-DDoS A Lua-based Anti-DDoS script for Nginx that presents a Cloudflare-style JavaScript authentication puzzle to filter out bots and mitigate La… | 98 | 1658 | active |
| AltraMayor/gatekeeper Gatekeeper is the first open-source DDoS protection system, built on DPDK for high-performance packet processing. It uses a geographically … | 66 | 1649 | active |
| ADD-SP/ngx_waf ngx_waf is a high-performance Nginx firewall module written in C that provides web application firewall capabilities. It is compatible with… | 66 | 1635 | active |
| alexazhou/VeryNginx VeryNginx is an enhanced Nginx distribution built on lua-nginx-module (OpenResty) that adds a web application firewall, request routing, ra… | 23 | 5979 | maintenance |
| throttled/throttled Throttled is a Go library that implements rate limiting using the generic cell rate algorithm (GCRA) to limit access to resources such as H… | 57 | 1598 | stable |
| jhurliman/node-rate-limiter A generic rate limiting library for Node.js and the web, exposing RateLimiter and TokenBucket classes for throttling tasks like API request… | 95 | 1568 | stable |
| nianhua99/PandoraHelper PandoraHelper is a self-hosted web application for centrally managing ChatGPT and Claude accounts and sharing them with other users via iso… | 34 | 1352 | active |
| vmihailenco/taskq A Go library for asynchronous task/job queues with pluggable backends including Redis, AWS SQS, IronMQ, and in-memory. It turns Go function… | 27 | 1343 | active |
| afex/hystrix-go A Go port of Netflix's Hystrix latency and fault tolerance library. It lets developers wrap calls to remote systems in commands with timeou… | 32 | 4399 | maintenance |
| bricks-cloud/BricksLLM BricksLLM is a cloud-native AI gateway written in Go that sits between applications and LLM providers like OpenAI, Anthropic, Azure OpenAI,… | 31 | 1230 | active |
| sindresorhus/p-queue p-queue is a TypeScript promise queue library for Node.js that provides concurrency control for async or sync operations. It lets you rate-… | 89 | 4276 | maintenance |
| alisaifee/flask-limiter Flask-Limiter is a Flask extension that adds rate limiting to Flask applications, with configurable limits at the app, blueprint, view, and… | 71 | 1207 | stable |
| JKorf/Binance.Net Binance.Net is a strongly typed C#/.NET client library for the Binance cryptocurrency exchange REST and WebSocket APIs. It supports Spot an… | 93 | 1172 | active |
| loveshell/ngx_lua_waf A lightweight, high-performance web application firewall (WAF) built on lua-nginx-module (OpenResty) for Nginx. It filters requests using r… | 23 | 4021 | maintenance |
| jsocol/django-ratelimit A Django library providing a decorator to rate-limit views based on IP address or request fields, using Django's cache backend. It is a lig… | 23 | 1150 | stable |
| VoAPI/VoAPI VoAPI is a self-hosted AI large-model API aggregation and distribution gateway written in Go, deployed via Docker. It proxies requests to m… | 56 | 1088 | active |
| jazzband/django-defender A Django reusable app that blocks brute-force login attempts by rate limiting on username and IP address, using Redis as a fast cache backe… | 48 | 1077 | active |
| go-redis/redis_rate A Go library implementing GCRA (leaky bucket) rate limiting on top of Redis, built for the go-redis client. It exposes a simple Allow API w… | 76 | 1051 | active |
| akaunting/laravel-firewall A Web Application Firewall (WAF) package for Laravel that protects applications from attacks like XSS, SQLi, RFI, LFI, and malicious user a… | 69 | 1015 | active |
| zaiyunduan123/springboot-seckill A high-concurrency flash-sale (seckill) system built with SpringBoot, MySQL, Redis, RabbitMQ, and Guava. It demonstrates caching, rate limi… | 32 | 3291 | maintenance |
| stefanprodan/AspNetCoreRateLimit AspNetCoreRateLimit is an ASP.NET Core rate limiting middleware library for controlling how many requests clients can make to a Web API or … | 23 | 3166 | maintenance |
| momosecurity/aswan Aswan is Momo's open-source risk-control static rule engine, a self-hosted Python/Django service for configuring blacklist/whitelist, boole… | 32 | 3045 | maintenance |
| youtube/doorman Doorman is a Go-based gRPC service for global distributed client-side rate limiting, letting clients voluntarily limit their use of shared … | 10 | 1952 | maintenance |
| hfbin/Seckill A Java flash-sale (seckill) system built with SpringBoot, Mybatis, Redis, and RabbitMQ, demonstrating high-concurrency e-commerce flash-sal… | 32 | 1426 | maintenance |
| antonioribeiro/firewall A Laravel package acting as a soft-firewall that controls route access by IP address, country, or host via blacklists and whitelists. It al… | 32 | 1406 | maintenance |
| LupinTraderIII/LookingGlass LookingGlass is a user-friendly PHP web application that lets the public run network diagnostic commands (ping, traceroute, mtr, host) agai… | 32 | 1317 | maintenance |
| lloyd/node-toobusy A Node.js library that monitors event loop lag and reports when the process is too busy to accept more work. It lets servers shed load earl… | 32 | 1296 | maintenance |
| starjun/openstar OpenStar (WAF+) is a Web Application Firewall written in Lua that runs on nginx/OpenResty (LuaJIT), filtering HTTP traffic through JSON-con… | 32 | 1282 | maintenance |
| stefanprodan/WebApiThrottle A rate-limiting library for ASP.NET Web API providing a throttling handler, OWIN middleware, and action filter. It controls request rates p… | 10 | 1271 | maintenance |
| brandur/redis-cell A Redis module written in Rust that adds a single CL.THROTTLE command implementing the generic cell rate algorithm (GCRA) for distributed r… | 68 | 1261 | maintenance |
| marcosbarbero/spring-cloud-zuul-ratelimit A Spring Cloud auto-configuration library that adds rate limiting to Spring Cloud Netflix Zuul API gateways via Zuul filters. It supports m… | 68 | 1130 | maintenance |
| cloudflare/workers-chat-demo A demo real-time chat application built on Cloudflare Workers using Durable Objects, with one object per chat room coordinating WebSocket c… | 64 | 1122 | maintenance |
| not-an-aardvark/snoowrap snoowrap is a fully-featured JavaScript wrapper for the reddit API, providing a simple promise-based interface to every reddit endpoint. It… | 10 | 1031 | maintenance |
| memorysafety/river River is a reverse proxy application written in Rust, built on Cloudflare's Pingora library and developed under ISRG's Prossimo initiative … | 17 | 2353 | experimental |
| OmniRoute OmniRoute is a free, MIT-licensed AI gateway that exposes a single OpenAI-compatible endpoint routing to 350+ LLM providers (90+ with free … | 78 | 77757 | active |
| LiteLLM LiteLLM is an open‑source Python library and self‑hosted gateway that provides a single OpenAI‑compatible interface to call 100+ LLM provid… | 93 | 61456 | active |
| LiteLLM LiteLLM is an open-source AI gateway and Python SDK that provides a unified OpenAI-format interface to 100+ LLM providers (OpenAI, Anthropi… | 93 | 61456 | active |
| New API New API is a self-hosted LLM gateway and AI asset management system that aggregates 30+ model providers behind a single unified endpoint. I… | 88 | 48905 | active |
| Kong Gateway Kong Gateway is an open‑source, cloud‑native API and AI gateway that provides high‑performance request routing, load balancing, authenticat… | 91 | 44279 | active |
| Wei-Shaw/sub2api Sub2API is a self-hosted AI API gateway written in Go that converts Claude, OpenAI, Gemini, and Grok subscriptions into unified API access.… | 80 | 44264 | active |
| Apache Dubbo Apache Dubbo is a high-performance RPC and microservice framework for Java (with multi-language SDKs) that provides service discovery, traf… | 86 | 41580 | stable |
| go-zero go-zero is a cloud-native Go web and RPC microservices framework with built-in engineering practices like circuit breaking, rate limiting, … | 95 | 33372 | stable |
| Better Auth Better Auth is a framework-agnostic authentication and authorization framework for TypeScript that ships with comprehensive features like e… | 88 | 30360 | active |
| Envoy Envoy is a CNCF-hosted, high-performance C++ edge, middle, and service proxy designed for cloud-native and AI-native applications. It provi… | 95 | 29082 | stable |
| Redisson Redisson is a Java client and real-time data platform for Redis and Valkey, built on Netty, offering sync, async, reactive, and RxJava3 API… | 94 | 24402 | stable |
| SafeLine SafeLine is a self-hosted web application firewall (WAF) that acts as an Nginx-based reverse proxy to protect web apps from attacks like SQ… | 96 | 22725 | active |
| Apache RocketMQ Apache RocketMQ is a distributed cloud-native messaging and streaming platform built for low-latency, high-throughput, financially reliable… | 88 | 22629 | stable |
| EL-ADMIN ELADMIN is a front-end/back-end separated admin management system built on Spring Boot 2.7.18, JPA, Spring Security, JWT, Redis, and Vue. I… | 56 | 21905 | active |
| LangBot LangBot is an open-source, production-grade platform for building AI-powered instant messaging bots, connecting LLMs and agent workflows to… | 95 | 18291 | active |
| Apache APISIX Apache APISIX is a dynamic, high-performance cloud-native API gateway and AI gateway built on NGINX and etcd, offering load balancing, dyna… | 94 | 17201 | stable |
| CrowdSec CrowdSec is an open-source, crowdsourced security engine that analyzes logs and HTTP requests to detect malicious behavior and block offend… | 93 | 15138 | stable |
| Netflix/zuul Zuul is Netflix's L7 application gateway service providing dynamic routing, monitoring, resiliency, and security for microservices. It is a… | 93 | 14083 | active |
| Portkey AI Gateway Portkey AI Gateway is an open-source, TypeScript-based AI gateway that routes requests to 1,600+ LLMs across many providers through a singl… | 71 | 13079 | active |
| BunkerWeb BunkerWeb is an open-source, cloud-native Web Application Firewall (WAF) built on NGINX that acts as a reverse proxy to protect web service… | 94 | 11054 | active |
| Tyk API Gateway Tyk Gateway is a cloud-native, open-source API Gateway written in Go that supports REST, GraphQL, TCP, and gRPC protocols. It provides rate… | 93 | 10840 | stable |
| pennersr/django-allauth django-allauth is an integrated set of Django applications covering authentication, registration, account management, and third-party (soci… | 75 | 10373 | stable |
page 1 / 3 next →