Bring your nginx config.
xin reads the configuration language, directives and routing rules you already have.
0lines to rewrite
Reverse proxy + MCP gateway
The edge for your apps — and your AI tools.
xin is a fast, memory-safe reverse proxy that runs your existing nginx config — no lines to rewrite. It also ships a built-in MCP gateway, so the edge you already run can route, police and log your AI tools too.
curl -fsSL https://xinproxy.com/install.sh | shEnrols the signed apt or rpm repository and installs beside your existing server. Starts nothing on its own.Read the script
MCP gateway built in.
Route, police and log MCP tool calls on the same proxy that already serves your traffic.
MCPgateway included
Memory-safe core.
Written in Rust — an entire class of security bugs can't happen here.
Rustcore
Run anywhere.
Signed apt and rpm packages, static musl builds, and a Homebrew tap.
7architectures
MCP gateway
Your edge is already the MCP gateway.
xin isn't a separate gateway you bolt on — it's the reverse proxy you already run, grown protocol-aware. Route tool calls, set per-tool policy, and log every call, without standing up a new tier.
Route to any tool server
mcp_pass connects a location to a stdio tool server or an HTTP MCP backend. It becomes an ordinary endpoint on the same listener — same TLS, same logs, same operational commands.
location /mcp/files {
mcp_pass stdio:/usr/local/bin/fs-mcp-server;
}Tool-level policy and rate limits
mcp_allow_tool and mcp_deny_tool match on the tool a call names. Rate limit by tool with the $mcp_tool variable and the limit_req you already know.
location /mcp {
mcp_pass http://search-backend/mcp;
mcp_allow_tool search.* docs.read_*;
mcp_deny_tool docs.delete_*;
limit_req zone=mcp_clients burst=20 nodelay;
}One audit trail
$mcp_method and $mcp_tool drop straight into log_format, next to every other request field — one log for HTTP and MCP traffic, not a second system to run.
log_format mcp_audit '$time_iso8601 $remote_addr '
'$mcp_method $mcp_tool';
access_log /var/log/xin/mcp-audit.log mcp_audit;What xin delivers
One binary, the whole edge.
HTTP/1.1, HTTP/2 and TLS
Modern protocol support with AWS-LC crypto, on the config you already run.
Proxying & load balancing
Reverse proxy and load balancer with FastCGI, uwsgi, SCGI and gRPC upstreams.
Caching, access control & rate limits
The directives you already write for caching, allow/deny and limit_req.
Kubernetes ingress & Gateway API
xingress ingress controller and a Gateway API controller, packaged as OCI/Helm.
WASM extension modules
Extend request handling with wasm_module and wasm_hook, no module ABI to patch.
Memory-safe core
An entire class of security bugs can't happen here.
Platforms
Install where you already run.
Signed apt & rpm reposEnrol a repository and install with your package manager.
7 architecturesamd64, arm64, i686, ARMv6/v7, ppc64le and s390x.
Static musl buildsSingle static binary for Alpine and distroless images.
Homebrew tapFor macOS and Linux.
Talk to us
Talk to us.
Discuss commercial licensing and support, MCP gateway rollouts, or Kubernetes ingress and Gateway API deployments. Submissions are stored in our own database and reviewed by the engineering team.