Skip to content
Conduit

mcp server

RouteX

High-performance, stateless web gateway running on Cloudflare Workers with comprehensive SSRF protection, dynamic HTML/CSS rewriting, SPA routing, and optional Daytona compute sandboxes.

jojin1709/RouteXcommunitylistedunreviewed
Use tool

Set up

Runs on your computer. Pick your agent and operating system.

This project does not publish an install method we can turn into a config. Follow the README instead.

README

synced Oct 27, 2026

[!NOTE] RouteX Production Gateway is Live: Hardened stateless HTTP/HTTPS web gateway with multi-layered SSRF defense, automated URL & resource rewriting, Model Context Protocol (MCP) server, 18 stateless inspector tools, multi-probe compatibility diagnostics, OpenAPI 3.1 specification, and optional Daytona compute integration.

RouteX

High-Performance Stateless HTTP/HTTPS Web Gateway for Cloudflare Workers

Developed by JOJIN JOHN

Cloudflare Workers License: MIT Zero Storage Tests Passing SSRF Protected Daytona Compatible

RouteX is an autonomous, stateless web gateway that fetches, rewrites, and sanitizes web content on Cloudflare's global edge network.

No persistent databases. No cookies saved. No browsing history logs. Pure stateless execution.

      

[!TIP] Need automated compatibility evaluation? Try GET /diagnostics?url=https://example.com for a factual 9-probe technical audit of DNS, HTTPS, HTML, CSS, fonts, images, and client-side SPA routing signals.

Table of Contents

What is RouteX?

RouteX is a production-grade, stateless HTTP/HTTPS web gateway designed from the ground up to run entirely within the serverless limits of Cloudflare Workers Free Tier.

It accepts destination URLs, verifies them against a strict multi-layer Server-Side Request Forgery (SSRF) policy, fetches upstream resources, and dynamically rewrites HTML, CSS, and resource attributes so that links and assets continue seamlessly through the gateway.

Most self-hosted proxies require persistent virtual private servers (VPS), Docker daemons, or databases with ongoing maintenance costs. RouteX rethinks the web gateway pattern:

  1. Serverless & Instant: Boots in under 2ms on Cloudflare's global edge network.
  2. Zero Maintenance: No servers to patch, no databases to back up, and no persistent state to corrupt.
  3. Free Tier Native: Designed specifically to operate within Cloudflare's standard free allocation without requiring paid add-ons.

RouteX enforces complete statelessness at the application level:

  • No Database: Does not use Cloudflare D1, KV, R2, Durable Objects, or external databases.
  • No Browsing History: Target URLs, requests, and proxy payloads are discarded immediately after streaming.
  • No User Profiles: No accounts, authentication sessions, or telemetry identifiers.
  • Header Isolation: Upstream Set-Cookie and dangerous frame headers are stripped to prevent session bleeding.

To maintain technical accuracy and clear expectations:

  • NOT a VPN: RouteX is an application-layer HTTP/HTTPS gateway, not a Virtual Private Network or system TUN/TAP driver.
  • NOT a WireGuard/OpenVPN server: It does not route raw TCP/UDP packets or mobile operating system network interfaces.
  • NOT an Anti-Bot Bypass Tool: RouteX does not circumvent CAPTCHAs, Cloudflare Turnstile, or device-fingerprinting systems (such as TikTok, dynamic SPA bot checks, or Canvas/WebGL verifications).
  • NOT an Unrestricted SOCKS Proxy: It only supports safe, publicly routable http:// and https:// web targets.

RouteX in Action

Live Gateway Verification Matrix

All tests executed live against the production deployment at https://routex-web-gateway.apkscope.workers.dev:

Target DomainCategoryGateway BehaviorStatus
example.comStandard HTML/CSSHTML links and assets automatically rewritten to /proxy?url=...Pass
Python DocumentationRich Technical DocsMulti-level stylesheets, navigation links, and search assets routed cleanlyPass
WikipediaWikimedia FoundationContent, vector skins, lazy-loaded thumbnails, and external links handledPass
W3C StandardsSpecifications & CSSStrict HTML5 specs, nested CSS imports, and media assets preservedPass
127.0.0.1 / LoopbackSSRF VectorBlocked at edge before request dispatch (400 Bad Request)Blocked
169.254.169.254Cloud Metadata VectorAWS/GCP/Azure instance metadata blocked at edge (400 Bad Request)Blocked
TikTok (Remix SPA)Client-Side SPAInitial HTML loads; dynamic client-side hydration remains limitedDocumented Limitation

Live Gateway & Interactive API Catalog

Production Access

RouteX is permanently hosted and maintained as a managed, high-performance edge service on Cloudflare Workers. You can immediately access the dashboard or proxy web resources without local setup:

InterfaceURLPurpose
RouteX Dashboardhttps://routex-web-gateway.apkscope.workers.dev/Web UI with Proxy, 9-Probe Diagnostics, Browser Lab, and Inspector
Interactive API Cataloghttps://routex-web-gateway.apkscope.workers.dev/apiFull interactive documentation, endpoint catalog, and live edge API console
Streaming Web Proxyhttps://routex-web-gateway.apkscope.workers.dev/proxy?url=https://example.comHigh-speed stateless proxy with automatic asset rewriting and SPA shimming
Health Checkhttps://routex-web-gateway.apkscope.workers.dev/healthEdge operational health check and compute capabilities status

Interactive API Catalog & Playground

The RouteX API directory dynamically negotiates content:

  • Browser Requests (Accept: text/html): Delivers an interactive, dark-mode developer playground with live endpoint testing, parameter forms, latency measurements, and 1-click cURL generators.
  • Programmatic Clients (Accept: application/json or ?format=json): Returns structured JSON metadata indexing all available gateway routes, inspector tools, and sandboxes.

Key Capabilities

  • Automated HTML Resource Rewriting: Conservatively rewrites <a href>, <link href>, <script src>, <img src>, <source src>, <video src poster>, <audio src>, <iframe src>, GET <form action>, inline style attributes, and <style> blocks.
  • Responsive Multi-Candidate srcset Parsing: Parses and rewrites candidate URL lists while preserving pixel density and viewport width descriptors (e.g. pic-1x.jpg 1x, pic-2x.jpg 2x).
  • Relative CSS Engine: Resolves url(...) and @import statements relative to the stylesheet's own origin, preventing broken assets on CDN-hosted styles.
  • Double-Proxy Prevention: Detects existing gateway prefixes and relative proxy query parameters to prevent recursive infinite proxy loops.
  • Enterprise-Grade SSRF Shield: Comprehensive IP range checking against loopback, private RFC1918, CGNAT, link-local metadata, IPv6 ULA, IPv4-mapped IPv6, and obfuscated octal/hex/decimal representations.
  • Optional Daytona Sandboxes: Isolated on-demand compute environments for Playwright browser tasks, screenshots, and PDF generation.
  • Factual Compatibility Diagnostics Engine: GET /diagnostics runs 9 independent technical probes to report factual compatibility (Full, Partial, or Limited).
  • 9 Stateless Web Inspector Tools: Standalone endpoints for headers, security headers, redirect tracer, link extractor, robots.txt viewer, sitemap parser, JSON formatter, XML viewer, and response metadata.
  • Zero Persistent Datastores: Absolutely no D1, KV, R2, Durable Objects, or external databases.

Architecture

RouteX executes entirely within the Cloudflare Worker lifecycle, handling incoming requests through isolated, specialized processing stages:

flowchart TD
    REQ["Incoming Client Request"] --> ROUTER{"RouteX Router"}

    ROUTER -- "/health" --> HEALTH["Health Status & Capabilities"]
    ROUTER -- "/api/daytona/*" --> DAYTONA_STATUS["Daytona Status Check"]
    ROUTER -- "/api/tools/render|screenshot|pdf" --> DAYTONA_TOOL{"Daytona Configured?"}
    ROUTER -- "/api/tools/*" --> TOOLS["11 Stateless Inspector Tools"]
    ROUTER -- "/diagnostics" --> DIAG["9-Probe Diagnostics Engine"]
    ROUTER -- "/api/browser/*" --> BROWSER{"Browser Rendering Binding?"}
    ROUTER -- "/proxy?url=..." --> SSRF{"SSRF & Security Shield"}

    DAYTONA_TOOL -- "Configured" --> DAYTONA_BOX["Ephemeral Daytona Sandbox (Playwright)"]
    DAYTONA_TOOL -- "Unconfigured" --> DAYTONA_501["501 Graceful Fallback"]

    BROWSER -- "Available" --> BR_EXEC["Execute Browser Headless Session"]
    BROWSER -- "Absent" --> BR_501["501 Graceful Fallback (Free Tier)"]

    SSRF -- "Blocked (127.0.0.1, Private IP, etc.)" --> ERR_400["400 Bad Request (Policy Violation)"]
    SSRF -- "Approved Public Target" --> UPSTREAM["Upstream HTTP/HTTPS Fetch"]

    UPSTREAM --> MIME{"Content-Type Evaluation"}

    MIME -- "text/html" --> HTML_RW["HTML & srcset Rewriter"]
    MIME -- "text/css" --> CSS_RW["CSS url() & @import Rewriter"]
    MIME -- "Binary / Media / JSON / JS" --> PASS["Pass-Through Stream"]

    HTML_RW --> SANITIZE["Header Sanitizer (Strip CSP/XFO/Cookies)"]
    CSS_RW --> SANITIZE
    PASS --> SANITIZE

    SANITIZE --> RES["Client Response + Access-Control-Allow-Origin: *"]

Daytona Integration

RouteX optionally supports Daytona for isolated browser and compute workloads.

[!IMPORTANT] Daytona is NOT required for the core RouteX gateway.

  • Core Gateway: Cloudflare Workers (always handles standard web proxy requests independently).
  • Optional Compute: Daytona Sandboxes (created ephemerally on demand for Playwright browser tasks, screenshots, and PDF generation).

Daytona Architecture

                    ROUTEX
                       |
              Cloudflare Worker
                       |
             ┌─────────┴─────────┐
             |                   |
        Web Gateway        Optional Tools
             |                   |
        Target Website       Daytona
                                 |
                         Isolated Sandbox
                                 |
                       Browser / Playwright

Role in RouteX

Daytona is utilized only for optional workloads that benefit from an isolated, ephemeral compute runtime:

  1. Browser / Rendering Tasks: Executing headless Chromium via Playwright to inspect fully rendered client-side DOMs.
  2. Playwright Compatibility Testing: Automated verification of dynamic pages that require client execution.
  3. Screenshot Generation: Capturing pixel-accurate viewport screenshots without local browser binaries.
  4. PDF Generation: Rendering print-accurate vector PDF documents.
  5. Heavy Diagnostic Tasks: Isolating resource-intensive audits away from edge proxy workers.

Setup & Secrets

The Daytona API key is never hardcoded in source code and never committed to Git. It is supplied exclusively as an environment variable or Cloudflare Worker secret:

# Set secret in Cloudflare Workers environment
npx wrangler secret put DAYTONA_API_KEY

For local development, store the key in .dev.vars (which is excluded from Git):

DAYTONA_API_KEY=your_daytona_api_key_here

Endpoints & Predefined Tools

EndpointMethodInputDescription
GET /api/daytona/statusGETNoneReports Daytona configuration and availability without exposing secrets.
POST /api/tools/renderPOST{"url": "https://example.com"}Runs Playwright in an ephemeral sandbox and returns rendered HTML.
POST /api/tools/screenshotPOST{"url": "https://example.com"}Captures a high-resolution PNG screenshot via Playwright.
POST /api/tools/pdfPOST{"url": "https://example.com"}Renders and returns a print-ready PDF document.

Sandbox Lifecycle & Security Controls

Create Ephemeral Sandbox
       ↓
Run Predefined RouteX Task (Playwright)
       ↓
Collect Result Payload (capped at 5MB)
       ↓
Guaranteed Cleanup / Delete (finally block)
       ↓
Return Response to Client
  • Zero Arbitrary Code Execution: Public requests can never submit shell commands (command: "...") or arbitrary code. Only fixed, predefined RouteX scripts are executed.
  • SSRF Protection Enforced: Destination URLs are validated by RouteX's SSRF engine before any sandbox is scheduled.
  • Strict Execution Timeouts: Tasks are bounded by a 45-second execution deadline.
  • Output Size Caps: Results are limited to 5 MB to prevent memory exhaustion.
  • Guaranteed Cleanup: Sandboxes are created with ephemeral: true and explicitly deleted in a finally block to protect Free tier allowances.

Security Model & SSRF Defense

RouteX implements a comprehensive multi-layered Server-Side Request Forgery defense before any network connection is attempted.

Prohibited Destinations

Requests to any of the following are terminated at the edge with 400 Bad Request:

CategoryPatterns & Ranges Blocked
Loopback127.0.0.0/8, localhost, localhost.localdomain, ::1
Current / Unspecified0.0.0.0/8, ::
Private RFC191810.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16
Carrier-Grade NAT (CGNAT)100.64.0.0/10
Cloud Metadata & Link-Local169.254.0.0/16 (169.254.169.254), metadata.google.internal, instance-data
IPv6 RestrictedLink-Local (fe80::/10), Unique Local (fc00::/7), IPv4-mapped IPv6 (::ffff:127.0.0.1)
Obfuscated EncodingsOctal (e.g. 0177.0.0.1), Hex (e.g. 0x7f.0.0.1), Decimal integer (e.g. 2130706433)
Internal & Single-Label DomainsSingle-label hosts without dots, .local, .internal, .localhost, .onion
Unsupported Schemesfile://, ftp://, gopher://, javascript:, data:, ws://, wss://
Embedded Credentialshttp://user:pass@host (rejected & stripped)

Allowed Protocols & Methods

  • Protocols: Strictly http: and https:.
  • HTTP Methods: Strictly GET, HEAD, and OPTIONS. Arbitrary state-changing methods (POST, PUT, PATCH, DELETE) are rejected with 405 Method Not Allowed.

Resource & Size Limits

  • Maximum Target URL Length: 4,096 characters.
  • Maximum Processing Buffer: 2 MB for in-memory HTML and CSS stream transformation.
  • Redirect Limit: Maximum 5 hops to prevent redirect-loop resource exhaustion.

Content-Type Routing & Rewriting

MIME Type / CategoryGateway Behavior
text/htmlRewrites attributes (href, src, poster, action, srcset, inline CSS, <style>) to route through /proxy?url=.
text/cssRewrites url(...) and @import resolved strictly against the stylesheet's own URL origin.
application/javascriptTransparent pass-through. JavaScript source code is not modified.
application/jsonPass-through with Access-Control-Allow-Origin: * injected.
image/*Binary pass-through with upstream caching headers (ETag, Cache-Control) preserved.
font/*, .woff2Binary pass-through.
video/*, audio/*Binary streaming with HTTP Range request support.
application/pdfBinary pass-through.

Stateless Inspector Tools

RouteX includes 18 independent inspection tools accessible via REST endpoints:

EndpointTool NameDescription
GET /api/tools/dns?domain=...DNS-over-HTTPS LookupQueries Cloudflare 1.1.1.1 for A, AAAA, MX, TXT, NS, and CNAME records.
GET /api/tools/tls?url=...SSL/TLS Security AuditEvaluates TLS configuration, HSTS header presence, max-age grade, and HTTPS compliance.
GET /api/tools/cert?domain=...SSL Cert TransparencyQueries public crt.sh logs for certificate issuer, validity window, and days until expiration.
GET /api/tools/archive?url=...Wayback Machine CheckerQueries official archive.org availability API for historical snapshots of any public URL.
GET /api/tools/headers?url=...HTTP Header InspectorReturns raw upstream HTTP response headers and status codes.
GET /api/tools/security-headers?url=...Security Header CheckerObjective assessment of HSTS, CSP, X-Frame-Options, Referrer-Policy, and Permissions-Policy.
GET /api/tools/redirects?url=...Redirect TracerTraces up to 10 HTTP redirect hops with status codes and location targets.
GET /api/tools/links?url=...Link ExtractorParses HTML anchor tags and returns resolved internal, external, and resource links.
GET /api/tools/robots?url=...robots.txt ViewerFetches and returns raw directives and sitemaps from /robots.txt.
GET /api/tools/sitemap?url=...sitemap.xml ParserFetches and extracts URLs listed in /sitemap.xml.
GET /api/tools/json?url=...JSON FormatterFormats, validates, and pretty-prints JSON payloads.
GET /api/tools/xml?url=...XML ViewerInspects and validates XML feeds and documents.
GET /api/tools/markdown?url=...Article & Markdown ExtractorStrips boilerplate HTML, returning clean Markdown optimized for AI prompts and CLI usage.
GET /api/tools/metadata?url=...Open Graph & SEO MetadataExtracts Open Graph (og:*), Twitter Cards, canonical tags, favicons, and JSON-LD structured data.
GET /api/tools/whois?domain=...Domain & RDAP WhoisQueries ICANN RDAP for domain registrar, statuses, nameservers, and registration events.
GET /api/tools/feed?url=...RSS & Atom Feed ParserParses syndicated RSS 2.0 / Atom XML feeds into structured JSON objects.
POST /api/tools/batchBatch URL Multi-ProbeConcurrently probes up to 5 URLs in parallel returning status, content-type, and latency.
GET /api/tools/response-info?url=...Response InfoAnalyzes response size, content type, transfer encoding, and HTTP status.
GET /ipEdge Client IP & DatacenterReturns client IP, Cloudflare edge Colo code, ASN, country, and TLS cipher suite.
GET /echoDeveloper Request EchoEchoes client request headers, HTTP method, client IP, and Cloudflare context.
GET /mcp & POST /mcpModel Context Protocol (MCP)JSON-RPC 2.0 endpoint for AI assistants (Cursor, Claude Desktop, Antigravity).
GET /r/:url or GET /r?url=...Direct Markdown ReaderFetches and returns raw text/markdown directly without wrapper, designed for curl and LLMs.
GET /docsScalar API ReferenceModern interactive API documentation powered by Scalar and OpenAPI 3.1.
GET /openapi.jsonOpenAPI 3.1 SpecFormal schema definition for Swagger UI, Postman, and MCP integrations.

Model Context Protocol (MCP) Integration

RouteX provides an Anthropic-compliant Model Context Protocol (MCP) JSON-RPC 2.0 endpoint at /mcp. This allows AI developer tools (Claude Desktop, Cursor, Antigravity, Claude Code) to use RouteX autonomously as an external web gateway and inspection engine.

Available MCP Tools

  1. routex_fetch_markdown: Fetches any webpage, strips HTML boilerplate, and returns clean Markdown.
  2. routex_dns_lookup: Queries Cloudflare 1.1.1.1 DoH for DNS records (A, AAAA, MX, TXT, NS, CNAME).
  3. routex_whois_lookup: Performs official ICANN RDAP domain registration queries.
  4. routex_metadata: Extracts Open Graph, Twitter Cards, canonical links, and JSON-LD structured data.
  5. routex_security_headers: Performs an automated audit of HSTS, CSP, X-Frame-Options, and Referrer-Policy.
  6. routex_archive_lookup: Queries the Wayback Machine (archive.org) for closest historical snapshots.

Claude Desktop & Cursor Configuration

Add RouteX to your claude_desktop_config.json or .cursor/mcp.json:

{
  "mcpServers": {
    "routex": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "https://routex-web-gateway.apkscope.workers.dev/mcp"
      ]
    }
  }
}

Or query the MCP endpoint directly with JSON-RPC:

curl -s -X POST "https://routex-web-gateway.apkscope.workers.dev/mcp" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"routex_dns_lookup","arguments":{"domain":"cloudflare.com"}}}'

Raw Markdown Reader & Developer Utilities

Direct Markdown Reader (/r/:url)

Designed specifically for terminal CLI usage, curl, and LLM ingest pipelines. Strips scripts, navigation, and styles, returning pure text/markdown:

curl -s https://routex-web-gateway.apkscope.workers.dev/r/https://en.wikipedia.org/wiki/Cloudflare

Edge Client Inspector (/ip)

Returns your public IP, country, city, ASN, and Cloudflare edge data center (Colo) code with zero database lookups:

curl -s https://routex-web-gateway.apkscope.workers.dev/ip

Developer Request Echo (/echo)

Echoes incoming headers, HTTP methods, client IP, and TLS handshake metadata back as formatted JSON (an edge-fast alternative to httpbin.org):

curl -s https://routex-web-gateway.apkscope.workers.dev/echo -H "X-Custom-Header: test"

Optional Cloudflare Browser Rendering

RouteX includes hooks for Cloudflare Workers Browser Rendering:

  • GET /api/browser/info — Checks if headless browser execution is enabled.
  • GET /api/browser/screenshot?url=... — Captures a full-page snapshot.
  • GET /api/browser/pdf?url=... — Generates a print-ready PDF document.
  • GET /api/browser/rendered-html?url=... — Returns post-JavaScript DOM.

[!NOTE] Free Tier Isolation: Browser Rendering is strictly an optional diagnostic tool with platform quotas. The core RouteX proxy functions completely independently and never requires Browser Rendering. If unconfigured, the endpoint returns 501 Not Implemented with setup instructions.

Privacy Model & Platform Transparency

Accurate Privacy Policy: RouteX does not intentionally persist browsing history, target URLs, proxy content, cookies, request bodies, or user profiles in an application database.

Platform Transparency: Do not claim that "nothing anywhere is stored." Cloudflare as the underlying edge infrastructure provider processes network packets, HTTP metadata, and operational telemetry under its standard platform privacy and security policies. RouteX simply avoids creating any application-specific storage layer.

Automated Testing

RouteX is backed by an automated 166-test verification suite covering URL rewriting, SSRF matrix validation, header handling, tools, diagnostics, and Daytona integration:

npm test

Raw Test Execution Summary

==================================================
  RouteX Production Test Suite
==================================================

--- Section 1: Core URL & Resource Rewriting ---
  [PASS] Relative ../ resolution
  [PASS] Relative ./ resolution
  [PASS] Root-relative / resolution
  [PASS] Protocol-relative // resolution
  [PASS] Absolute https:// resolution
  [PASS] Query string and fragment preserved in target
  [PASS] Fragment-only anchor untouched
  [PASS] javascript: URL untouched
  [PASS] data: URI untouched
  [PASS] mailto: link untouched
  [PASS] tel: link untouched
  [PASS] Double-proxy prevention (relative /proxy?url=)
  [PASS] Double-proxy prevention (absolute gateway URL)
  [PASS] srcset multi-candidate rewriting
  [PASS] CSS @import string relative to CSS file
  [PASS] CSS url(...) relative ../img/pattern.png resolved relative to CSS file
  [PASS] CSS root-relative /shared/icon.svg resolved to CSS origin
  [PASS] CSS data: URL preserved untouched
  [PASS] HTML <link href> rewritten
  [PASS] HTML <script src> rewritten
  [PASS] HTML <a href> rewritten
  [PASS] HTML fragment <a href='#section'> untouched
  [PASS] HTML <img src> rewritten
  [PASS] HTML <video src and poster> rewritten
  [PASS] HTML <source src> rewritten
  [PASS] HTML <audio src> rewritten
  [PASS] HTML <iframe src> rewritten
  [PASS] HTML GET <form action> rewritten
  [PASS] HTML POST <form action> left untouched
  [PASS] HTML inline style attribute rewritten
  [PASS] HTML <style> block rewritten
  [PASS] Response headers: content-type preserved
  [PASS] Response headers: etag preserved
  [PASS] Response headers: cache-control preserved
  [PASS] Response headers: dangerous CSP stripped
  [PASS] Response headers: X-Frame-Options stripped
  [PASS] Response headers: Set-Cookie stripped
  [PASS] Response headers: content-encoding stripped on rewritten text
  [PASS] Response headers: content-length stripped on rewritten text
  [PASS] Response headers: Access-Control-Allow-Origin: * injected
  [PASS] Response headers: X-RouteX-Gateway: 1 injected

--- Section 2: Security & SSRF Protection ---
  [PASS] SSRF Block: 127.0.0.1 Loopback
  [PASS] SSRF Block: 127.x.x.x Loopback CIDR
  [PASS] SSRF Block: 0.0.0.0 Current network
  [PASS] SSRF Block: 10.0.0.1 Private Class A
  [PASS] SSRF Block: 10.255.255.255 Private Class A
  [PASS] SSRF Block: 172.16.0.1 Private Class B
  [PASS] SSRF Block: 172.31.255.255 Private Class B
  [PASS] SSRF Block: 192.168.0.1 Private Class C
  [PASS] SSRF Block: 192.168.1.254 Private Class C
  [PASS] SSRF Block: 169.254.169.254 Link-local AWS metadata
  [PASS] SSRF Block: 100.64.0.1 CGNAT
  [PASS] SSRF Block: 224.0.0.1 Multicast
  [PASS] SSRF Block: 240.0.0.1 Reserved
  [PASS] SSRF Block: 255.255.255.255 Broadcast
  [PASS] SSRF Block: localhost
  [PASS] SSRF Block: localhost.localdomain
  [PASS] SSRF Block: .local mDNS
  [PASS] SSRF Block: .internal internal hostname
  [PASS] SSRF Block: .localhost domain
  [PASS] SSRF Block: .onion Tor hidden service
  [PASS] SSRF Block: GCP metadata hostname
  [PASS] SSRF Block: AWS instance-data alias
  [PASS] SSRF Block: IPv6 Loopback [::1]
  [PASS] SSRF Block: IPv6 Unspecified [::]
  [PASS] SSRF Block: IPv6 Link-Local [fe80::1]
  [PASS] SSRF Block: IPv6 ULA [fc00::1]
  [PASS] SSRF Block: IPv6 ULA [fd12::1]
  [PASS] SSRF Block: IPv4-mapped IPv6 loopback
  [PASS] SSRF Block: IPv4-mapped IPv6 private
  [PASS] SSRF Block: Decimal integer representation of 127.0.0.1
  [PASS] SSRF Block: Hex representation of 127.0.0.1
  [PASS] SSRF Block: Octal leading-zero representation
  [PASS] SSRF Block: file:// scheme
  [PASS] SSRF Block: ftp:// scheme
  [PASS] SSRF Block: gopher:// scheme
  [PASS] SSRF Block: javascript: scheme
  [PASS] SSRF Block: data: scheme
  [PASS] SSRF Block: ws:// scheme
  [PASS] SSRF Block: wss:// scheme
  [PASS] SSRF Block: Embedded credentials in URL
  [PASS] SSRF Block: Oversized URL (> 4096 chars)
  [PASS] Valid public target allowed (https://example.com/test)

--- Section 3: Stateless Tools & Diagnostics ---
  [PASS] JSON Inspector: Valid JSON parsing
  [PASS] Security Header Checker: Objective observations returned
  [PASS] Diagnostics: example.com returns Full compatibility rating
  [PASS] Diagnostics: Report includes technical probes
  [PASS] Diagnostics: SSRF target correctly flagged as Limited with fail probe
  [PASS] Browser Tools: Correctly reports unavailable when env.BROWSER is absent
  [PASS] Turnstile: Cleanly handles unconfigured secret key

--- Section 4: Optional Daytona Integration & Security ---
  [PASS] Daytona Disabled: Correctly reports disabled when DAYTONA_API_KEY is absent
  [PASS] Daytona Disabled: getDaytonaStatus reports configured=false and enabled=false
  [PASS] Daytona Configured: Correctly reports configured when key present
  [PASS] Daytona Configured: getDaytonaStatus reports configured=true and enabled=true
  [PASS] Daytona Unconfigured: Tool request returns 501 Not Implemented
  [PASS] Daytona Security: Invalid URL is rejected with 400 Bad Request
  [PASS] Daytona Security: SSRF loopback target is rejected with 400
  [PASS] Daytona Security: Cloud metadata target is rejected with 400
  [PASS] Daytona Security: file:// protocol is rejected with 400
  [PASS] Daytona Security: Arbitrary command parameter without url is rejected with 400
  [PASS] Daytona Parser: Render tool target correctly parsed and validated
  [PASS] Daytona Parser: Screenshot tool target correctly parsed and validated
  [PASS] Daytona Parser: PDF tool target correctly parsed from query string
  [PASS] Daytona Limits: Max output bytes limit enforced at 5MB
  [PASS] Daytona Limits: Default timeout capped at 45 seconds
  [PASS] Gateway Independence: Normal RouteX proxy functions completely independently of Daytona
  [PASS] Daytona Viewport: Mobile mode parsed correctly
  [PASS] Daytona Viewport: Desktop mode defaulted when omitted
  [PASS] Daytona Viewport: Query string viewport parameter parsed correctly
  [PASS] Daytona Snapshot: Snapshot configured flag set when DAYTONA_SNAPSHOT present
  [PASS] Daytona Snapshot: Snapshot configured flag false when DAYTONA_SNAPSHOT absent
  [PASS] Daytona Error Handling: Unreachable target or client failure returns 502 Bad Gateway without crashing

--- Section 5: HTTP Status Sanitization & Gateway Resilience ---
  [PASS] Status Sanitization: Standard 200 OK preserved
  [PASS] Status Sanitization: Standard 301 Redirect preserved
  [PASS] Status Sanitization: Standard 404 Not Found preserved
  [PASS] Status Sanitization: Standard 500 Server Error preserved
  [PASS] Status Sanitization: Non-standard status 999 (LinkedIn Request Denied) safely mapped to 502
  [PASS] Status Sanitization: Non-standard status < 200 mapped to 502
  [PASS] Status Sanitization: Non-standard status > 599 mapped to 502
  [PASS] StatusText Sanitization: Normal ASCII reason phrase preserved
  [PASS] StatusText Sanitization: Empty or <none> string returns undefined
  [PASS] StatusText Sanitization: Control characters and newlines stripped
  [PASS] Regression Test: Worker /proxy handles non-standard upstream status 999 without throwing RangeError (Error 1101)
  [PASS] Regression Test: Worker preserves original non-standard upstream code in X-Upstream-Status
  [PASS] Regression Test: Gateway identifier X-RouteX-Gateway present on sanitized error response
  [PASS] SPA Navigation: Direct unproxied route redirected to /proxy?url=... via cookie
  [PASS] API Catalog: Returns JSON when requested via Accept: application/json
  [PASS] API Catalog: Includes core, diagnostics and inspector endpoint groups
  [PASS] API Catalog: Serves api.html when requested from a browser with Accept: text/html
  [PASS] API Catalog: Returns JSON directly via /api.json
  [PASS] DNS Tool: SSRF loopback target rejected with 400 Bad Request
  [PASS] DNS Tool: Returns DNS records structure for public domain
  [PASS] TLS Tool: Non-HTTPS target flags isHttps=false
  [PASS] Raw Passthrough: Attaches X-RouteX-Mode: raw-passthrough header

--- Section 8: OpenAPI 3.1, Markdown, Metadata & Downloads ---
  [PASS] OpenAPI 3.1: Serves valid schema via /openapi.json
  [PASS] OpenAPI 3.1: Spec includes all core and inspector endpoints
  [PASS] Proxy Download Mode: Sets Content-Disposition attachment header
  [PASS] XML Inspector Tool: Returns HTTP 200 with structured parsing info
  [PASS] Markdown Extractor Tool: Returns 200 with title and markdown content
  [PASS] Metadata Tool: Returns 200 with title, canonical and openGraph object
  [PASS] CORS Proxy Endpoint: Automatically activates raw mode with CORS headers
  [PASS] Static Assets: Serves /robots.txt from ASSETS binding
  [PASS] Static Assets: Serves /favicon.svg from ASSETS binding
  [PASS] Turnstile Config: Reports disabled when secret key not configured
  [PASS] Turnstile Config: Reports enabled and exposes siteKey when keys present
  [PASS] Direct Markdown Reader (/r/:url): Returns raw text/markdown
  [PASS] Direct Markdown Reader (/r?url=...): Returns 200 with text/markdown
  [PASS] Scalar Docs (/docs): Serves docs.html from ASSETS binding
  [PASS] Whois Tool: SSRF loopback target rejected with 400 Bad Request
  [PASS] Whois Tool: Returns structured domain details
  [PASS] Feed Parser: Returns structured feed analysis object
  [PASS] Edge Client IP (/ip): Returns client IP and Cloudflare edge metadata
  [PASS] Request Echo (/echo): Echoes client headers and request details
  [PASS] MCP Server (GET /mcp): Returns MCP capabilities and tools spec
  [PASS] MCP Server (initialize): Responds with JSON-RPC 2.0 handshake
  [PASS] MCP Server (tools/list): Returns tool declarations for LLM agents
  [PASS] MCP Server (tools/call): Executes tool and returns content array
  [PASS] Cert Tool: SSRF loopback target rejected with 400 Bad Request
  [PASS] Archive Tool: SSRF cloud metadata target rejected with 400 Bad Request
  [PASS] Batch Tool: GET method rejected with 405 Method Not Allowed
  [PASS] Batch Tool: Executes parallel probes and returns summary

==================================================
  TEST SUMMARY
==================================================
  TOTAL:  166 tests
  PASSED: 166
  FAILED: 0

All automated tests passed successfully!

Technologies & Infrastructure

  • Cloudflare Workers: Primary serverless edge runtime and streaming proxy.
  • Cloudflare Turnstile: Optional abuse control and CAPTCHA validation.
  • Cloudflare WAF: Rate limiting and edge traffic defense.
  • Daytona: Isolated ephemeral compute sandboxes for browser automation and Playwright tasks.

About the Developer

RouteX was engineered and architected by:

JOJIN JOHN

Software Engineer & Security Researcher

Common Questions (FAQ)

How can I access RouteX?

You can access RouteX directly via the official live deployment at https://routex-web-gateway.apkscope.workers.dev/. It is globally distributed across 300+ Cloudflare edge locations with sub-20ms initial response latency and zero installation required.

Is RouteX a VPN?

No. RouteX is an application-level HTTP/HTTPS web gateway and URL-rewriting proxy. It does not provide TUN/TAP virtual network adapters, WireGuard routing, or device-wide traffic forwarding.

Does RouteX store my browsing logs?

No. RouteX is completely stateless at the application level. It has no database bindings (no KV, D1, R2, or Durable Objects) and does not store browsing histories, target URLs, or user accounts.

How does SSRF protection work?

Before fetching any destination, RouteX validates the hostname, scheme, and IP address. Any attempt to access loopback (127.0.0.0/8, ::1), private ranges (10.x, 172.16.x, 192.168.x), cloud metadata services (169.254.169.254), single-label local hostnames, or obfuscated IP encodings is immediately blocked with 400 Bad Request.

How does Daytona fit into RouteX?

Daytona acts as an optional compute backend for tasks requiring an isolated browser engine (Playwright rendering, screenshots, and PDFs). The core RouteX proxy never depends on Daytona and continues functioning normally if Daytona is unconfigured or unreachable.

License

RouteX is open source software licensed under the MIT License.

↑↓ navigate openesc close