stripe/smokescreen

Health v2 · maintenance only

Flags: no_releases

Adoption not part of the score

1331 stars · 105 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

Smokescreen is an HTTP CONNECT egress proxy written in Go, developed by Stripe to proxy outbound traffic such as webhooks. It enforces hostname ACLs, blocks requests to internal IP addresses to prevent SSRF, and authenticates clients via mTLS with per-client access control.

Use cases

• prevent SSRF attacks from outbound webhook traffic
• restrict which external hostnames services can connect to
• centralize egress traffic behind stable IP addresses
• authenticate and authorize internal clients making outbound requests
• block requests to internal network IP ranges
• proxy all outbound HTTP traffic from a microservices fleet

When to choose

• you need to control and audit all outbound HTTP(S) traffic from your infrastructure
• you want to prevent SSRF by blocking connections to internal IPs
• you need stable egress IPs for partners or third parties
• you want per-client mTLS authentication for egress

When to avoid

• you need a general-purpose forward proxy for end users or browsers
• you need SOCKS or non-HTTP proxy protocols
• you want a simple proxy without ACL or mTLS configuration overhead

Facets

service · maturity active

proxy security networking auth rate-limiting security networking backend infrastructure-as-code go self-hosted http-proxy egress-proxy connect-proxy ssrf-protection mtls egress-control acl linux docker web-server

Member repositories

For agents

markdown · JSON · MCP: product_card(name="stripe/smokescreen")