Reverse proxy for the hot path: passive TLS, HTTP/2, and TCP SYN (eBPF) fingerprints, injected as trusted headers. Load-tested under concurrent HTTPS — tens of thousands of requests per second with fingerprinting on.
Open source all the way down. Fingerprints come from Huginn Net — proxy and signature engine alike, dual-licensed MIT/Apache-2.0. No proprietary core, no separate license for commercial use.

Values are produced by the proxy and override any client-supplied spoofed headers.
| Header | Layer / note |
|---|---|
x-tls-ja4 (+ -r / -o / -ro) | TLS ClientHello: FoxIO-LLC JA4 family (hashed & raw variants) |
x-tls-ja4-s1 (+ -rs1) | TLS ClientHello: stable JA4 (ephemeral extensions excluded) |
x-http2-akamai | HTTP/2 only |
x-tcp-p0f | TCP SYN via eBPF (XDP or TC) when enabled |