Website · Docs · Agent registry · GitHub
Zentinel is a reverse proxy written in Rust on Pingora. The core does routing, TLS, load balancing and caching, and stays small. Security and middleware concerns run as agents: separate processes the proxy talks to over agent protocol v2, each with its own timeout and failure mode, so a crashing or slow agent is bounded instead of taking the proxy down.
| Repository | What it does |
|---|---|
zentinel |
The proxy: routing, TLS, load balancing, caching and the agent pipeline |
zentinel-modsec |
Pure Rust ModSecurity rule engine with OWASP CRS compatibility |
zentinel-convert |
Converts nginx, HAProxy, Traefik, Caddy and Envoy configs to Zentinel KDL (online) |
zentinel-control-plane |
Fleet management for Zentinel proxies (Elixir/Phoenix) |
zentinel-helm |
Helm chart for running Zentinel on Kubernetes |
pingora |
Zentinel's Pingora fork, published as the zentinel-pingora-* crates |
zentinel-hub |
Deprecated Go fleet manager, superseded by zentinel-control-plane |
| Agent | What it does |
|---|---|
auth |
JWT, API keys, Basic, OIDC, SAML, mTLS client certificates, Cedar authorization |
waf |
Pure Rust WAF with its own detection rules and anomaly scoring |
zentinelsec |
ModSecurity-compatible WAF that loads the OWASP CRS, built on zentinel-modsec (no C dependencies) |
modsec |
ModSecurity WAF through libmodsecurity bindings |
denylist |
Blocks requests by IP, CIDR range and pattern |
ratelimit |
Token bucket rate limiting |
bot-management |
Bot detection and management |
ip-reputation |
Checks client IPs against threat intelligence feeds and blocklists |
ai-gateway |
Pattern-based prompt injection, jailbreak and PII checks for LLM API traffic |
graphql-security |
GraphQL query depth, complexity and introspection control |
grpc-inspector |
gRPC authorization, rate limiting and metadata inspection |
websocket-inspector |
WebSocket content filtering, schema validation and rate limiting |
soap |
SOAP/XML validation, WSDL enforcement and XXE protection |
mqtt-gateway |
Topic ACLs, client auth and payload inspection for MQTT over WebSocket |
content-scanner |
Malware scanning of request bodies with ClamAV |
spiffe |
SPIFFE/SPIRE workload identity |
policy |
Policy evaluation with Rego (OPA) and Cedar |
audit-logger |
Structured audit logging with PII redaction |
| Agent | What it does |
|---|---|
lua |
Custom request/response logic in Lua |
js |
Custom request/response logic in JavaScript (QuickJS) |
wasm |
Runs WebAssembly modules in the request pipeline (wasmtime) |
transform |
URL rewrites, header changes and JSON body transforms |
image-optimization |
On-the-fly JPEG/PNG to WebP/AVIF conversion with caching |
api-deprecation |
Deprecation/Sunset headers, redirects and blocking for retired endpoints |
mock-server |
Configurable stub responses for testing |
chaos |
Controlled fault injection for resilience testing |
Every agent has a page in the agent registry.
Build your own agent against agent protocol v2 (protocol docs).
| Language | Repository |
|---|---|
| Rust | zentinel-agent-rust-sdk |
| Go | zentinel-agent-go-sdk |
| Python | zentinel-agent-python-sdk (install from the repository; not on PyPI) |
| TypeScript | zentinel-agent-typescript-sdk |
| Kotlin | zentinel-agent-kotlin-sdk |
| Elixir | zentinel-agent-elixir-sdk |
| Haskell | zentinel-agent-haskell-sdk |
| Repository | What it does |
|---|---|
zentinelproxy.io |
The website, zentinelproxy.io |
zentinelproxy.io-docs |
Versioned documentation, docs.zentinelproxy.io |
registry.zentinelproxy.io |
The agent registry, registry.zentinelproxy.io |
api.zentinelproxy.io |
Static JSON API for agent registry and bundle metadata, used by zentinel bundle |
design |
Design tokens and marks shared by the sites |
zentinel-bench |
Benchmarks against Envoy, HAProxy and nginx (results) |
wafworth |
WAF-agnostic test suite with confusion-matrix metrics and multi-WAF comparison |
.github |
This organization profile |
Part of Zentinel, the security-first reverse proxy. The shisa guards the gate.