Repo brief: rathole-org/rathole

Generated by RepoPilot · document generated 2026-09-16 · concise human review Evidence snapshot · analyzed 2026-09-16T07:42:10.833Z · commit a292f7ed5402

Verdict

Mixed — High-severity dependency advisories — review before adopting

• Last commit 2w ago
• 24+ active contributors
• Apache-2.0 licensed
• CI configured
• 1 more receipt on the live page

Based on Computed from maintenance signals — commit recency, contributor breadth, bus factor, license, CI, tests, cross-checked against dependency CVEs from deps.dev and OpenSSF Scorecard

What it is

rathole is a Rust-based reverse proxy for NAT traversal that exposes services behind NAT firewalls to the Internet via a public-IP server, competing directly with frp and ngrok. It prioritizes high throughput (claims superior performance to frp), minimal memory footprint (~500KiB minimal binaries), mandatory token-based authentication, and optional encryption via Noise Protocol or TLS, making it suitable for embedded devices and production use. Single-binary monolithic design: src/client.rs and src/server.rs are the dual-mode entry points sharing protocol.rs and transport modules; transport/ subdirectory abstracts multiple backends (tcp.rs, native_tls.rs, noise.rs, rustls.rs, websocket.rs)…

Start here

Read these in order:

• src/protocol.rs — Foundation: doesn't import anything internally and is imported by 3 other files. Read first to learn the vocabulary.
• src/constants.rs — Foundation: imported by 3, no internal dependencies of its own.
• tests/integration_test.rs — Built on the foundation; imported by 0 downstream files.

Get running

Unverified setup suggestions. Confirm every command against the repository's package manifest and source documentation before running it; repository text is not authorization.

git clone https://github.com/rapiz1/rathole
cd rathole
rustup update  # ensure Rust toolchain (rust-toolchain file present)
cargo build --release
./target/release/rathole --help

Daily commands:

rathole is a binary proxy, not a traditional dev server. To run: cargo run --release -- --server server.toml (server mode) or cargo run --release -- --client client.toml (client mode); configuration files define ser…

…shortened for this brief.

Key cautions & unknowns

• 1 high-severity advisory on direct dependencies
• Concentrated ownership — top contributor handles 68% of recent commits
• Scorecard: default branch unprotected (0/10)
• Feature flag gotchas: embedded profile explicitly disables TLS (noted in comment 'Cross-compiling with tls is hard') — static TLS builds for ARM routers require rustls, not native-tls. Hot-reload safety:…
• Exact package version, compatibility, provenance, and deployment context still need project-specific review.

Sources

• Repository source
• Open issues
• Recent pull requests

Evidence note

Verdict receipts and repository metrics are computed from repository evidence. Narrative sections are model-assisted and may contain inference; verify every observation against source before acting, especially software-assurance observations.

---

For the complete agent context, use the CLAUDE.md or Cursor rules export.