Envoy Logo

Extension Catalog

Discover 23 ready to use extensions for your Envoy® Proxy

Decodes Anthropic Messages API requests and responses and exposes structured metadata for downstream filters

aianthropicdecodergohttpllmmessagesmetadata

Azure AI Content Safety integration for LLM prompt protection and content moderation

aiazurecontent-safetygoguardrailshttpllmprompt-injectionprotected-materialsecuritytask-adherence

Apply AWS Bedrock Guardrails for LLM prompt protection and content moderation.

aibedrockfiltergoguardrailshttpllmprompt-injectionprotected-material

Inline Cedar policy evaluation for HTTP request authorization

authorizationcedarfiltergohttpmtlspolicysecurityspiffe

Decodes OpenAI Chat Completion requests and responses and exposes structured metadata for downstream filters

aichat-completionsdecodergohttpllmmetadataopenai
NetworkTraffic Control

Traffic routing in a peered Envoy mesh.

filtergohttpmeshrouting

Web Application Firewall (WAF) for HTTP traffic using Coraza

corazacrsgohttpmodsecurityowaspsecuritywaf

Example `ext_proc` extension that adds a custom response header.

exampleext-procfilterhttp

Example composer embedded go plugin for HTTP filters

filtergohttp
Examples

Comprehensive example demonstrating Envoy Lua HTTP filter capabilities

bodyexampleheadersloggingmetadatareferencessl

Example Wasm extension (Go) that adds a custom response header.

examplefiltergohttpwasm

Serve static files from the local filesystem through Envoy

filesfiltergohttpstatic

Built-in loader that hosts standalone Go plugins at runtime; always compiled into composer

plugin-loader

IP-based access control using allowlists or denylists

access-controldynamic-moduleexampleip-filteringrustsecurity

Decrypt JWE tokens and recover the inner JWT for Envoy to process

encryptionfiltergohttpjwesecurity

Routes LLM API requests by the module name and monitors token usage and latency via Envoy metadata and metrics.

aianthropicgohttpllmmetadataopenaiproxy

Resolve virtual IPs back to domain and metadata as filter state

access-controldnsegressnetworkingroutingrustsecuritytransparent-proxyvirtual-ip

Inline OPA policy evaluation for HTTP request authorization

authorizationfiltergohttpmtlsopapolicysecurityspiffe

Validate HTTP requests against an OpenAPI specification

apifiltergohttpopenapisecurityvalidation

Inline OpenFGA authorization for Envoy, Envoy Gateway, and AI Gateway — no sidecar required

ai-gatewayauthorizationfiltergohttpopenfgasecurity

Intercept DNS queries and allocate virtual IPs per domain

access-controldnsegressnetworkingroutingrustsecuritytransparent-proxyvirtual-ip
AuthenticationSecurity

SAML 2.0 Service Provider authentication for Envoy HTTP traffic

authenticationfiltergohttpsamlsecuritysso
AuthenticationSecurity

OAuth2 token exchange for Envoy HTTP traffic

filtergohttpoauth2securitytokenexchange