Organizations invest heavily in protecting inbound traffic, yet outbound connections often receive far less attention. That outbound, or egress, traffic is precisely what Secure Proxy Manager (SPM) is designed to control. This new open-source project combines enterprise proxy capabilities, web traffic inspection, DNS filtering, and centralized management into a single platform.
Its goal is to provide a self-hosted alternative to commercial Secure Web Gateway (SWG) platforms such as Zscaler or Cloudflare Gateway, allowing organizations to keep all network traffic within their own infrastructure instead of routing it through third-party cloud services.
Secure Proxy Manager in 20 seconds
- Combines a forward proxy, WAF, DNS sinkhole, and management dashboard in a single Docker stack.
- Lets administrators control which domains and IP addresses users and servers can access.
- Includes native Model Context Protocol (MCP) support for AI-assisted administration.
- Runs entirely on-premises, keeping all traffic inside the organization’s infrastructure.
As AI services, SaaS applications, and hybrid work continue to increase the number of outbound connections, protecting only the network perimeter is no longer enough. Every workstation and server may establish thousands of connections every day to APIs, cloud platforms, and external services that often remain invisible to security teams.
A Fully Self-Hosted Secure Web Gateway
Secure Web Gateways have become a core component of Zero Trust architectures. Their primary role is to inspect outbound web traffic, enforce access policies, block malicious destinations, and reduce the risk of data exfiltration.
Most commercial SWGs operate as cloud services, meaning all traffic must traverse the vendor’s infrastructure.
Secure Proxy Manager takes the opposite approach: every security function remains inside the organization’s own network.
To achieve this, it combines several well-established open-source technologies:
- Squid as the forward HTTP/HTTPS proxy.
- dnsmasq for DNS filtering and sinkholing.
- A Go-based ICAP service for HTTP request and response inspection.
- A modern web interface for centralized management.
- A REST API for automation and integration with external systems.
The entire platform can be deployed using Docker Compose, making installation relatively straightforward.
More Than a Traditional Proxy
One of Secure Proxy Manager’s most interesting capabilities is that it does much more than simply forward traffic.
Its inspection engine analyzes both HTTP requests and responses through ICAP. According to the project documentation, it includes approximately 170 security rules across 21 categories, together with anomaly scoring and behavioral heuristics designed to detect attacks such as:
- SQL Injection
- Cross-Site Scripting (XSS)
- Remote Code Execution (RCE)
- Server-Side Request Forgery (SSRF)
- Path Traversal
- Data exfiltration
- Command-and-control (C2) communications
The developers also state that these protections are continuously validated using an automated adversarial testing framework during development.
DNS Filtering and Outbound Traffic Control
Another key capability is stopping unwanted traffic before connections are even established.
Using dnsmasq, Secure Proxy Manager functions as a DNS sinkhole, preventing DNS resolution for malware domains, advertising networks, and administrator-defined blocklists.
Beyond basic DNS filtering, the platform also supports:
- CIDR-based IP blocking
- Wildcard domain filtering
- One-click import of public blocklists
- Geographic restrictions
- Domain and IP allowlists
- A default-deny outbound policy where only explicitly approved destinations are allowed.
This model is particularly attractive for organizations that want strict control over which external services internal systems are permitted to access.
AI-Native Management Through MCP
Perhaps the project’s most distinctive feature is its built-in support for Model Context Protocol (MCP).
Rather than relying solely on a graphical interface, Secure Proxy Manager includes an optional MCP server that allows administrators to manage the gateway using natural language through compatible AI assistants such as Claude Desktop.
Example commands include:
- “Show me the top outbound domains.”
- “Are any systems accessing AI APIs?”
- “Block example.com.”
- “Temporarily disable one WAF category.”
This turns the gateway into another component of the rapidly growing AI-driven infrastructure automation ecosystem.
Real-Time Visibility and Centralized Management
The platform also includes operational capabilities typically associated with commercial security products.
Among them are:
- Live log streaming via WebSocket
- Per-client traffic analysis
- Top domains and Shadow IT visibility
- Prometheus metrics
- Grafana integration
- Configuration audit trails
- Notifications through Telegram, Microsoft Teams, Gotify, or custom webhooks
All configuration and operational data are stored locally using SQLite, avoiding the need for external database infrastructure in smaller deployments.
Security Built Into the Platform
The developers have also focused on hardening the platform itself.
Built-in security features include:
- Basic Authentication and JWT authentication
- Login rate limiting
- SSRF protection
- AES-256-GCM encryption for sensitive configuration
- Cosign-signed Docker images
- Support for both x86_64 and ARM64 systems
The documentation also recommends exposing the proxy only to private networks and carefully protecting the locally generated CA certificates used when HTTPS inspection is enabled.
A Strong Addition to Zero Trust Architectures
Rather than replacing a traditional firewall, Secure Proxy Manager is designed to address an area that many organizations still monitor only partially: outbound traffic.
Its combination of open-source software, self-hosted deployment, and integration with modern AI automation tools makes it an interesting option for home labs, SMBs, managed service providers, and enterprise administrators seeking greater visibility into outbound communications without relying on commercial cloud platforms.
As cloud applications, AI APIs, and distributed services continue to reshape enterprise networks, controlling outbound traffic is becoming just as important as defending the network perimeter. Secure Proxy Manager reflects that shift toward more comprehensive, self-hosted network security.
Frequently Asked Questions
What is Secure Proxy Manager?
Secure Proxy Manager is an open-source platform that combines a forward proxy, web application firewall, DNS sinkhole, and centralized management tools to control outbound web traffic.
Can it replace a traditional firewall?
No. It is designed to complement existing security infrastructure by focusing on HTTP/HTTPS egress control and DNS filtering.
Does it require cloud services?
No. The platform is entirely self-hosted and runs locally using Docker Compose, keeping traffic within the organization’s own infrastructure.
What does MCP integration provide?
It allows administrators to query the gateway, inspect traffic, and perform management tasks using natural language through AI assistants that support the Model Context Protocol.