# OpenNHP/opennhp

A lightweight, cryptography-powered, open-source toolkit built to enforce Zero Trust security for infrastructure, applications, and data in the AI-driven world.

Repository: https://github.com/OpenNHP/opennhp
Canonical: https://ross.abutalabs.com/products/opennhp
Homepage: http://opennhp.org/
Language: Go
License: Apache-2.0
License Family: permissive
Topics: cybersecurity, zero-trust, zero-trust-network-access, zero-trust-security
Last push: 2026-08-24T22:58:02+00:00

## Health v2 (maintenance only)
Score: 94/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 99, release rhythm 84, longevity 100
- inputs: {"age_days": 4412, "days_push": 9, "days_rel": 109, "gap_med": 0, "n_releases_24m": 4}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 13918, forks 2480 (observed 2026-08-28T04:11:05.055753+00:00)

## What it is
OpenNHP is a lightweight, cryptography-powered open-source toolkit written in Go that implements the Cloud Security Alliance's Network-infrastructure Hiding Protocol (NHP) for Zero Trust security. It hides server ports, IP addresses, and domains behind default-deny access control with encrypted UDP knocks (Noise Protocol, ECC), and ships agent, server, and access-control components plus a Data-content Hiding Protocol (DHP) for making data 'usable but not visible'.

## Use cases
- hide server ports, IPs, and domains from attackers and scanners
- implement zero trust network access for infrastructure and applications
- protect APIs and app servers from unauthorized discovery and port scanning
- replace legacy port knocking or SPA tools with a modern memory-safe Go implementation
- make services invisible until users authenticate with time-limited access
- encrypt sensitive data so it is usable but not visible
- secure infrastructure against AI-driven automated vulnerability exploitation

## When to choose
- You need default-deny, hide-until-authenticated access for servers, APIs, or cloud infrastructure
- You want a CSA-spec-aligned, memory-safe Go implementation of NHP/SPA instead of C/C++ tools like fwknop
- You need mutual authentication, encrypted UDP knocks, and automatically expiring access paths
- You want to reduce attack surface against automated LLM-driven scanning and exploitation

## When to avoid
- You need a general-purpose VPN or full network-layer tunnel rather than per-service access hiding
- You require a turnkey commercial ZTNA product with enterprise support and broad IAM integrations out of the box
- You depend on interoperability with existing SPA/port-knocking ecosystems rather than the NHP protocol
- Your team cannot operate additional agent, server, and access-control components

## Facets
- artifact type: framework
- maturity: active
- function: security, cryptography, networking, auth, authorization
- domain: security, networking, cloud-computing, backend, self-hosted
- platform: go, windows, cross-platform, self-hosted, cloud
- tags: zero-trust, zero-trust-network-access, network-hiding-protocol, single-packet-authorization, port-knocking, software-defined-perimeter, noise-protocol, default-deny, infrastructure-hiding, confidential-computing, dark-forest, linux, macos, docker

## Member repositories
- OpenNHP/opennhp (main) score 94

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:11:05.055753+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-29T17:12:56.975791+00:00, confidence not recorded.
  - readme: https://github.com/OpenNHP/opennhp (fetched 2026-08-28T04:11:05.055753+00:00, sha 378a2ab93c47)
  - homepage: http://opennhp.org/ (fetched 2026-08-29T08:07:00.463124+00:00, sha 1aff284bb395)
  - site_page: https://docs.opennhp.org (fetched 2026-08-29T08:07:00.465787+00:00, sha 8597ccda6460)
- Data as of 2026-08-30T08:39:29.467469+00:00.