# stripe/smokescreen

A simple HTTP proxy that fogs over naughty URLs

Repository: https://github.com/stripe/smokescreen
Canonical: https://ross.abutalabs.com/products/smokescreen
Language: Go
License: MIT
License Family: permissive
Last push: 2026-08-26T12:29:41+00:00

## Health v2 (maintenance only)
Score: 77/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 99, release rhythm 35, longevity 100
- inputs: {"age_days": 3715, "days_push": 7, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: no_releases
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1331, forks 105 (observed 2026-08-28T04:04:24.372048+00:00)

## What it is
Smokescreen is an HTTP CONNECT egress proxy written in Go, developed by Stripe to proxy outbound traffic such as webhooks. It enforces hostname ACLs, blocks requests to internal IP addresses to prevent SSRF, and authenticates clients via mTLS with per-client access control.

## Use cases
- prevent SSRF attacks from outbound webhook traffic
- restrict which external hostnames services can connect to
- centralize egress traffic behind stable IP addresses
- authenticate and authorize internal clients making outbound requests
- block requests to internal network IP ranges
- proxy all outbound HTTP traffic from a microservices fleet

## When to choose
- you need to control and audit all outbound HTTP(S) traffic from your infrastructure
- you want to prevent SSRF by blocking connections to internal IPs
- you need stable egress IPs for partners or third parties
- you want per-client mTLS authentication for egress

## When to avoid
- you need a general-purpose forward proxy for end users or browsers
- you need SOCKS or non-HTTP proxy protocols
- you want a simple proxy without ACL or mTLS configuration overhead

## Facets
- artifact type: service
- maturity: active
- function: proxy, security, networking, auth, rate-limiting
- domain: security, networking, backend, infrastructure-as-code
- platform: go, self-hosted
- tags: http-proxy, egress-proxy, connect-proxy, ssrf-protection, mtls, egress-control, acl, linux, docker, web-server

## Member repositories
- stripe/smokescreen (main) score 77

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:04:24.372048+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T04:45:20.934406+00:00, confidence not recorded.
  - readme: https://github.com/stripe/smokescreen (fetched 2026-08-28T04:04:24.372048+00:00, sha 050b81d7ac46)
- Data as of 2026-08-30T08:39:29.467469+00:00.