Features

Everything xin ships.

One reverse proxy, your existing config, and a gateway for the traffic you run today plus the tool traffic you're starting to run.

Config compatibility

Bring your nginx config.

xin reads the nginx configuration you already have — the same directives, the same location blocks, the same operational muscle memory. Point it at your config file and it runs.

If a directive isn't honoured, xin refuses to start instead of silently ignoring it. No silent surprises: what you configure is what runs, or you find out at startup, not in an incident.

location /app/ {
    proxy_pass http://app_upstream;
    proxy_set_header Host $host;
}

Protocols

HTTP/1.1, HTTP/2, and modern TLS.

Serve and proxy over HTTP/1.1 and HTTP/2 on the same listener, with TLS termination backed by AWS-LC — the cryptography library built for FIPS-adjacent and high-assurance deployments.

Certificates, ciphers and protocol negotiation are configured the way you already configure them in nginx.

listen 443 ssl http2;
ssl_certificate     /etc/xin/tls/fullchain.pem;
ssl_certificate_key /etc/xin/tls/privkey.pem;

Proxying & load balancing

Every backend protocol you're already running.

Reverse proxy and load balance over FastCGI, uwsgi, SCGI and gRPC, alongside plain HTTP upstreams. Caching, access control and rate limiting sit in front of any of them.

Route by path, host or header; balance across upstream pools; cache responses; gate access with allow/deny rules and request-rate limits — all from the config you know.

upstream api {
    server 10.0.0.11:9000;
    server 10.0.0.12:9000;
}
location /api/ {
    proxy_pass http://api;
    limit_req zone=api_clients burst=20 nodelay;
}

MCP gateway

The edge for your AI tools.

mcp_pass turns a location into an MCP gateway endpoint, routing to a stdio tool server you spawn or an HTTP tool server you already run — the same listener, TLS and logs as every other route.

mcp_allow_tool and mcp_deny_tool grant or block by tool name, not by URL. $mcp_tool and $mcp_method drop into log_format for one audit trail, and limit_req applies per tool.

location /mcp/files {
    mcp_pass stdio:/usr/local/bin/fs-mcp-server;
    mcp_allow_tool fs.read_*;
    mcp_deny_tool  fs.delete_*;
    limit_req zone=mcp_clients burst=20 nodelay;
}

Kubernetes

An ingress controller that speaks nginx.

xingress ships as an ingress controller you install from an OCI image via Helm — the same Ingress resources, annotations and TLS setup you already write.

A Gateway API controller is in private beta for teams standardising on the newer Kubernetes networking API.

helm install xingress oci://ghcr.io/xinproxy/xingress \
  --namespace xingress-system --create-namespace

WASM extensions

Extend the proxy without a C module ABI.

wasm_module loads a WebAssembly module into xin; wasm_hook attaches it to a request phase. Write extension logic in any language that compiles to WASM, ship it as a portable module, and reload it without rebuilding or ABI-matching a C module.

wasm_module mod_headers /etc/xin/wasm/headers.wasm;
location / {
    wasm_hook mod_headers on_request_headers;
}

Observability

Metrics and logs your tools already speak.

Native Prometheus /metrics endpoint — plus stub_status your existing exporters already scrape, and access logs shaped by log_format. OpenTelemetry support is on the way.

Point your edge straight at ClickHouse — JSON access logs (log_format escape=json) that your pipeline ingests directly, no log-parsing sidecar.

location /metrics {
    metrics;
}
log_format analytics escape=json '{"status":"$status",...}';

Certificates

Works with the renewal flow you already run.

Point ssl_certificate and ssl_certificate_key at the files certbot or acme.sh manage, and keep the same renewal cron or systemd timer. Reload xin — the same signal or command you use today — and it picks up the renewed certificate with no downtime.

Platforms & packages

One static binary, everywhere you run nginx.

xin ships as a single static binary. Signed apt and rpm repositories cover amd64, arm64, i686, ARMv6/v7, ppc64le and s390x — from a Raspberry Pi to a mainframe.

musl builds serve Alpine and distroless containers. A Homebrew tap covers macOS on arm64 and amd64, and Linux.

Bring your config.

Get started Download Solutions