Tag
Proxy tools
11 reviewed tools: 10 free or open source, 1 hosted with a real free tier.
Order: free and open source first, then hosted products with a real free tier, then paid-led; catalog order inside each group, with quiet or archived repos last. Not a score, and no tool pays for its place.
11 tools
- CaddyApache-2.0 reverse proxy with automatic HTTPS by default
Free / OSS · Apache-2.0 · 78.2k GitHub stars
VerdictApache-2.0 auto-HTTPS proxy. The missing piece under self-host PaaS.
CatchEncyclopedia-adjacent but was absent while Coolify/CapRover assume a proxy. Caddy is the proxy, not the PaaS. Not nginx with a friendlier name — ACME-first defaults are the product.
- TraefikMIT dynamic reverse proxy for Docker/K8s ingress
Free / OSS · OSS/MIT · 65.3k GitHub stars
VerdictMIT dynamic proxy for Docker/K8s. Free core; Hub is optional paid.
CatchVs Caddy: dynamic Docker/K8s LB/Ingress lane, not auto-HTTPS-for-one-binary. Steeper label/static-vs-dynamic model. Not a PaaS. Hub/API-management SKUs are separate paid products you do not need for reverse-proxy duty.
- AnubisMIT PoW challenge layer vs AI scrapers in front of Caddy/Traefik
Free / OSS · OSS/MIT · 23.6k GitHub stars
VerdictMIT anti-scraper PoW layer. Free forever; tune policies.
CatchPoW slows mass scrapers; determined headless solvers still pass. Can impede Archive/RSS unless you allowlist. Not Cloudflare WAF. Distinct from Traefik/Caddy proxies.
- OAuth2 ProxyMIT CNCF Sandbox reverse-proxy auth gate vs external IdPs
Free / OSS · OSS/MIT · 15.2k GitHub stars
VerdictMIT CNCF reverse-proxy auth gate. Free forever; bring an external IdP — this is not one.
CatchNOT an IdP and NOT a user store — it only gates apps against an upstream provider you already run or rent. Vs Authelia/Tinyauth (proxy SSO / portal), authentik (full IdP), and Dex (federated OIDC IdP that still is not an app-fronting proxy): oauth2-proxy sits in front of apps, talks out to an IdP, and never owns accounts. You still configure the upstream client, cookies/headers, and the protected upstreams.
- mcp-remoteMIT npx stdio↔remote MCP proxy with OAuth support
Free / OSS · OSS/MIT · 1.6k GitHub stars
VerdictMIT remote-MCP stdio shim. Use until your client speaks OAuth remote natively.
CatchVs SuperGateway (bidirectional stdio↔SSE/WS bridge): mcp-remote is the client-side remote+OAuth drop-in, not a capability server and not a full gateway product. Some clients already speak unauth remote MCP — you only need this for OAuth/legacy stdio hosts. Adds a local Node process in the path.
- BifrostApache-2.0 AI gateway — perf angle vs LiteLLM (Maxim)
Free / OSS · Freemium · 9k GitHub stars
VerdictApache-2.0 AI gateway. Fast LiteLLM alternative; Maxim enterprise is the loud paid path.
CatchVs LiteLLM: same gateway job with a Go/perf positioning — not a model marketplace. Maxim upsell: enterprise/clustering/adaptive LB/OIDC provisioning and getmaxim.ai Bifrost enterprise pages are the commercial gravity; OSS gateway still runs locally. You still pay upstream model providers.
- CavemanViral skill and proxy that forces coding agents to spend fewer tokens
Free / OSS · Apache-2.0 · 114k GitHub stars
VerdictMIT skill surface with BSL engine bits. Use to cut coding-agent token spend; read the BSL boundary before productizing the runtime.
CatchEngine-linked runtime directories (engine/, proxy/, rewriter/, and related) are Business Source License 1.1, not MIT — see LICENSING.md / LICENSE.BSL before embedding or offering a hosted Caveman runtime. Vs LiteLLM: Caveman is output/style compression for agent hosts, not a multi-provider model gateway. Terse output can hide nuance; keep quality checks on hard tasks.
- Weave RouterELv2 on-box embedder proxy that routes each prompt to the right model
Free / OSS · Open-Core · 5.6k GitHub stars
VerdictELv2 source-available model router. Strong cost lever for agent fleets; no managed offering without a license review.
CatchElastic License 2.0 is source-available, not OSI open-source — you may not offer Weave Router as a hosted/managed service under ELv2 without permission. Vs LiteLLM: LiteLLM is the broader multi-provider gateway/SDK; Weave Router's wedge is per-prompt model selection via on-box embeddings. Routing quality still depends on your traffic mix and evaluation.
- AgentgatewayApache AI-native proxy — MCP & A2A security, obs, governance
Free / OSS · Apache-2.0 · 5.4k GitHub stars
VerdictApache MCP/A2A proxy when agents need governed tool and agent traffic — not LiteLLM/Weave/CCR model routers and not Nasiko harness control.
CatchVs litellm / weave-router / claude-code-router / nasiko: LiteLLM is a multi-provider LLM proxy; Weave/CCR are coding-agent model routers; Nasiko is harness discover/route/trace — Agentgateway’s catch is MCP/A2A agentic connectivity proxy (security/obs/governance), not model routing alone. Ops weight of a full proxy; pin a release and map which MCP/A2A clients you actually terminate.
- OtariApache-2.0 self-hosted OpenAI-compatible LLM gateway
Free / OSS · Apache-2.0 · 711 GitHub stars
VerdictA clean, self-hosted way to put keys and budgets in front of many LLM providers — pin a version while it is pre-1.0.
CatchIt is younger than LiteLLM and still pre-1.0, so expect breaking changes. The one-line Docker quick start keeps SQLite inside the container and loses everything when it stops; a persistent setup means Compose with PostgreSQL. The README also offers a hosted control plane at otari.ai, so check which features you need run fully standalone.
- LiteLLMMIT OpenAI-compatible gateway to 100+ LLMs; Enterprise SSO paid
Free tier · Freemium · 61.7k GitHub stars
VerdictMIT LLM gateway. Self-host free; Enterprise SSO/governance is paid.
CatchVs OpenRouter/provider SDKs: self-host gateway you operate — not a hosted model marketplace. Enterprise/ tree and SSO/audit/RBAC are commercial; core proxy stays MIT. You still pay model providers.
FAQ
- What is the top free pick among Proxy tools?
- Caddy leads the Stack Gems list for Proxy tools. Verdict: Apache-2.0 auto-HTTPS proxy. The missing piece under self-host PaaS.
- How many Proxy tools does Stack Gems review?
- 11: 10 free or open source, 1 hosted with a real free tier. Each review has a verdict and an honest Catch; no tool pays for its spot.
- Which Proxy tools can I self-host for free?
- Caddy, Traefik, Anubis, OAuth2 Proxy, mcp-remote, Caveman, Agentgateway and Otari.
- Which Proxy tools have the most GitHub stars?
- Caveman (114k), Caddy (78.2k), Traefik (65.3k), per GitHub on 2026-10-21. Stars measure attention, not fit; read the Catch.
- What is the catch with Caddy?
- Encyclopedia-adjacent but was absent while Coolify/CapRover assume a proxy.