Repo brief: SagerNet/sing-box

Generated by RepoPilot · document generated 2026-09-16 · concise human review Evidence snapshot · analyzed 2026-09-16T09:26:37.483Z · commit f6ce1d5be042

Verdict

Mixed — Single-maintainer risk — review before adopting

• Last commit 2d ago
• 2 active contributors
• GPL-3.0 licensed
• CI configured
• 1 more receipt on the live page

Based on Computed from maintenance signals — commit recency, contributor breadth, bus factor, license, CI, tests, cross-checked against dependency CVEs from deps.dev and OpenSSF Scorecard

What it is

sing-box is a universal proxy platform written in Go that implements multi-protocol proxy support (shadowsocks, OpenVPN, OpenConnect, Tailscale, etc.) with a unified routing and rule engine. It provides a single binary that can act as an inbound/outbound proxy handler, DNS resolver, and network packet router across Linux, macOS, Windows, and mobile platforms. Monolithic adapter pattern: adapter/ directory contains interfaces (adapter/inbound.go, adapter/outbound.go, adapter/router.go, adapter/rule.go) with corresponding /manager.go and /registry.go implementations for composition. Protocol implementations (openvpn.go, openconnect.go, tailscale.go, shadowsocks via dependencies) are…

Start here

Open these first:

• box.go — Core entry point managing the lifecycle and initialization of the entire proxy platform.
• adapter/inbound/adapter.go — Defines the inbound connection handler interface that all proxy protocol implementations must satisfy.
• adapter/outbound/adapter.go — Defines the outbound connection handler interface that all proxy protocol implementations must satisfy.
• adapter/router.go — Routes traffic between inbound and outbound handlers based on rules and policies.
• adapter/rule.go — Implements traffic routing rules that determine which outbound handler processes each connection.

Get running

Unverified setup suggestions. Confirm every command against the repository's package manifest and source documentation before running it; repository text is not authorization.

Clone: git clone https://github.com/SagerNet/sing-box.git && cd sing-box. Install: go mod download (inferred from go.mod presence). Build: Check Makefile and Dockerfile for build targets—likely make or go build…

Daily commands:

Exact commands unclear without Makefile contents. Conventional approach: go run ./cmd/sing-box or similar (cmd/ directory not listed, so verify structure). Configuration likely via YAML/JSON config file passed as CLI…

…shortened for this brief.

Key cautions & unknowns

• Small team — 2 contributors active in recent commits
• Single-maintainer risk — top contributor 99% of recent commits
• GPL-3.0 is copyleft — check downstream compatibility
• Configuration requirement: sing-box is not runnable without a configuration file (not included in this data); the exact location and format must be verified from documentation or examples/ (not shown).…
• Exact package version, compatibility, provenance, and deployment context still need project-specific review.

Sources

• Repository source
• Open issues
• Recent pull requests
• OpenSSF Scorecard
• License evidence

Evidence note

Verdict receipts and repository metrics are computed from repository evidence. Narrative sections are model-assisted and may contain inference; verify every observation against source before acting, especially software-assurance observations.

---

For the complete agent context, use the CLAUDE.md or Cursor rules export.