Open source
Our founders are long-time open-source users, contributors and patrons. The creator of Otoroshi is one of them, and Cloud APIM is by far the biggest contributor to the project. We give back by making the tools we build around Otoroshi available to everyone.
The foundation · #OSSbyMAIF
A lightweight API management layer on top of a modern HTTP reverse proxy. Battle-tested in production since 2017, created at MAIF and developed in the open with the MAIF OSS team. Everything we build starts here.
Flagship projects
otoroshi-llm-extension
The open-source AI gateway for Otoroshi.
Connect, set up, secure and seamlessly manage LLMs through a universal, OpenAI-compatible API. 50+ providers, guardrails, semantic cache, budgets, MCP and AI Studio.
otoroshi-waf-extension
A WAF, IP reputation, bot control and a decision fabric for Otoroshi.
A JVM-native ModSecurity WAF with the OWASP Core Rule Set, threat-intel feeds, CrowdSec, bot mitigation and one threat score for every request — with Threat Studio, the security console for Otoroshi.
otoroshi-biscuit-studio
Biscuit tokens, natively in your API gateway.
A set of Otoroshi plugins and entities to forge, attenuate and verify Biscuit tokens — decentralized, offline-verifiable authorization tokens — right in your gateway.
A CLI to manage your Otoroshi clusters with style.
Control your Otoroshi clusters from the command line, expose local processes through remote tunnels, run a universal sidecar for an Otoroshi-based service mesh, and manage your Cloud APIM deployments.
seclang-engine
A ModSecurity-compatible WAF library for the JVM.
An enterprise-grade, high-performance implementation of the ModSecurity SecLang language in Scala, passing 100% of the OWASP CRS v4 regression tests. The engine behind our threat protection.
New entities, plugins and consoles that turn Otoroshi into much more than an API gateway.
3 projects
otoroshi-api-portal
A lightweight developer portal served by Otoroshi itself.
Markdown pages, OpenAPI rendering, self-service API key subscriptions to plans and a built-in API tester, configured from your Otoroshi API entities.
otoroshi-smolvm-extension
Run code and services in micro-VMs from Otoroshi.
Run functions and HTTP services inside smolvm micro-VMs, with inline JavaScript (Node or Bun), warm pools or one VM per request for untrusted code.
otoroshi-clevercloud-reaper
Put idle Clever Cloud apps to sleep, wake them on the next request.
An Otoroshi extension that stops idle Clever Cloud applications after a grace period and wakes them up transparently, with savings tracking, dry run and a kill switch.
Focused plugins for specific integrations and protocols.
7 projects
otoroshi-plugin-spiffe
SPIFFE workload identities in Otoroshi.
Validate SPIFFE JWT-SVIDs and X.509 client certificates, and preload SPIFFE CA certificates. Tested against SPIRE.
otoroshi-plugin-dynamic-js-modules
JavaScript plugins without the compilation step.
Run JavaScript modules loaded from a URL in a WASM runtime, hooked on validation, request, backend call, response and error phases.
otoroshi-plugin-webhook-validator
Validate webhook signatures from any provider.
Provider-agnostic HMAC signature validation for incoming webhooks (GitHub, Stripe, Slack, YouSign…), with constant-time comparison.
otoroshi-plugin-moesif
Send your API analytics to Moesif.
Ship Otoroshi traffic to Moesif API analytics, mapping customers and companies from API key metadata.
otoroshi-plugin-curity-phantom-token
Phantom token validation with Curity.
Validate Curity phantom tokens against a Curity identity server and forward the resulting JWT to your services.
otoroshi-plugin-couchbase
Couchbase as an Otoroshi datastore.
Use Couchbase as the storage backend of Otoroshi, and export Otoroshi events to Couchbase.
otoroshi-plugin-mailer
Send emails through an asynchronous REST API.
Turns a route into an asynchronous REST API that sends emails through the SMTP server of your choice, with retries and Otoroshi events.
Reusable building blocks for the JVM, published on Maven Central.
2 projects
seclang-engine-coreruleset
The OWASP Core Rule Set, ready to embed.
Packages the OWASP CRS v4 as an embeddable SecLang Engine preset, importable with a single line.
SQL injection and XSS detection for the JVM.
A faithful Java port of libinjection, with SQLi detection based on thousands of fingerprints and HTML5 XSS detection. No runtime dependencies.
Command-line tools and proxies to work with Otoroshi.
1 project
otoroshi-mcp-proxy
A local MCP proxy backed by an Otoroshi endpoint.
Connect local MCP clients to MCP servers exposed and governed by Otoroshi.
No project matches .
Everything here runs on your own Otoroshi. When you'd rather not operate it, Otoroshi Managed runs Otoroshi and our extensions for you — with the people that wrote the code.
