Network access infrastructure you can inspect.

SkiMasque's open-source components provide transparency and technical credibility while the hosted service adds operational capabilities.

Open architecture

Control plane: the control protocol a gateway speaks to a control plane is open and documented. The control-plane server itself is part of SkiMasque Cloud and is not open source; there is no open-source control-plane server.
Gateway: the gateway, skimasque-server, is open source and does full policy enforcement, deny by default and the SSRF floor on its own.
Protocol implementation: the MASQUE transport stack, the policy engine, OIDC verification and the control protocol are open source.
Configuration: policies are files (TOML or YAML) that the gateway re-reads in place; the gateway is configured with command-line flags and environment variables.
Deployment: run the gateway with Docker, systemd, a Helm chart or a Terraform starting point from the repository's deploy directory.
Extension points: the documented control protocol lets you implement your own control plane; the gateway does not change.

The open-source gateway is not crippled: core networking is not withheld to create a distinction. Licensed MIT OR Apache-2.0, at your option.

Open source components provide the core networking, which you can self-host.

PLANNED hosted-service additions still being built

Run SkiMasque yourself, or let us operate it for you.

Running your own control plane is the advanced path: you implement the documented control protocol or license SkiMasque's control-plane distribution.