OpenNHP/opennhp

Health v2 · maintenance only

Adoption not part of the score

13918 stars · 2480 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

OpenNHP is a lightweight, cryptography-powered open-source toolkit written in Go that implements the Cloud Security Alliance's Network-infrastructure Hiding Protocol (NHP) for Zero Trust security. It hides server ports, IP addresses, and domains behind default-deny access control with encrypted UDP knocks (Noise Protocol, ECC), and ships agent, server, and access-control components plus a Data-content Hiding Protocol (DHP) for making data 'usable but not visible'.

Use cases

• hide server ports, IPs, and domains from attackers and scanners
• implement zero trust network access for infrastructure and applications
• protect APIs and app servers from unauthorized discovery and port scanning
• replace legacy port knocking or SPA tools with a modern memory-safe Go implementation
• make services invisible until users authenticate with time-limited access
• encrypt sensitive data so it is usable but not visible
• secure infrastructure against AI-driven automated vulnerability exploitation

When to choose

• You need default-deny, hide-until-authenticated access for servers, APIs, or cloud infrastructure
• You want a CSA-spec-aligned, memory-safe Go implementation of NHP/SPA instead of C/C++ tools like fwknop
• You need mutual authentication, encrypted UDP knocks, and automatically expiring access paths
• You want to reduce attack surface against automated LLM-driven scanning and exploitation

When to avoid

• You need a general-purpose VPN or full network-layer tunnel rather than per-service access hiding
• You require a turnkey commercial ZTNA product with enterprise support and broad IAM integrations out of the box
• You depend on interoperability with existing SPA/port-knocking ecosystems rather than the NHP protocol
• Your team cannot operate additional agent, server, and access-control components

Facets

framework · maturity active

security cryptography networking auth authorization security networking cloud-computing backend self-hosted go windows cross-platform self-hosted cloud zero-trust zero-trust-network-access network-hiding-protocol single-packet-authorization port-knocking software-defined-perimeter noise-protocol default-deny infrastructure-hiding confidential-computing dark-forest linux macos docker

Member repositories

For agents

markdown · JSON · MCP: product_card(name="OpenNHP/opennhp")