AI ERP with agents inside the systems you run
AI phone and voice agents for real calls
LLM.coPrivate, self-hosted LLM deployments
Legal AI infrastructure for firms
AI RFP discovery and response drafting
Automatic.coBusiness process automation
CyberAttack.aiThreat detection and defense
Secure AI virtual data roomstoxiproxy
Toxiproxy is a TCP proxy tool that simulates network failures and degradation for testing application resilience. It lets you inject latency, packet loss, timeouts, and outages into connections during development and testing without requiring root access or platform-specific tools.
Key facts
Objective fields from the source. Values we can't verify are shown as “Unknown” rather than guessed.
| Field | Value |
|---|---|
| Repository | Shopify/toxiproxy |
| Owner | Shopify |
| Primary language | Go |
| License | MIT — OSI-approved |
| Stars | 12.1k |
| Forks | 503 |
| Open issues | 105 |
| Latest release | v2.12.0 (2025-03-18) |
| Last updated | 2026-07-06 |
| Source | https://github.com/Shopify/toxiproxy |
What toxiproxy is
Written in Go, Toxiproxy intercepts TCP connections and applies configurable "toxics" (latency, bandwidth limits, reset, slicer, timeout, down, slow_close, packet_loss, limit_data) via an HTTP API. It supports deterministic tampering for unit tests and randomized chaos for integration tests, with client libraries available in Ruby, Python, Java, Node.js, Go, Rust, Elixir, Haskell, and PHP.
Get the toxiproxy source
Clone the repository and explore it locally.
git clone https://github.com/Shopify/toxiproxy.gitcd toxiproxy# follow the project's README for install & configurationNeed it deployed, integrated, or customized instead? DEV.co ships production installs.
Best use cases
Implementation considerations
- Client library selection must match Toxiproxy server version (2.x servers require 2.x clients); breaking API changes exist between major versions.
- Populate proxy routes in application boot code before establishing connections; routing must be configured before tests/scenarios run.
- Toxics are scoped to individual proxies and can be applied upstream (client→proxy) or downstream (proxy→upstream); ensure toxic direction matches test intent.
- Memory and CPU overhead scales with connection count and data volume; monitor when proxying high-throughput services.
- HTTP API access should be restricted to localhost or trusted networks in test environments; no built-in authentication.
When to avoid it — and what to weigh
- Requires Protocol-Level Inspection — Toxiproxy operates at the TCP layer and applies generic network conditions. It cannot parse or selectively corrupt application-level protocol data (e.g., specific HTTP endpoints or message fields).
- Production Traffic Manipulation — Toxiproxy is designed for testing/CI/dev environments. Using it in production to proxy live traffic introduces latency, memory overhead, and a single point of failure without security hardening.
- High-Frequency, Low-Latency Scenarios — Toxiproxy adds measurable overhead. Applications requiring microsecond-level latency or extremely high throughput may find the proxy introduces too much jitter or becomes a bottleneck.
- UDP or Non-TCP Protocols — Toxiproxy is TCP-only. Applications using UDP, gRPC over HTTP/2 with connection reuse, or custom binary protocols may require alternative tooling or integration patterns.
License & commercial use
Licensed under MIT (MIT License), a permissive OSI-approved license allowing commercial use, modification, and distribution with minimal restrictions.
MIT license permits commercial use without restrictions. Shopify maintains and uses Toxiproxy internally in production development and CI environments. No license fees or commercial support obligations; support and contributions are community-driven via GitHub.
DEV.co evaluation signals
Editorial assessment — not user reviews. Directional, with an explicit confidence level.
| Signal | Assessment |
|---|---|
| Maintenance | Active |
| Documentation | Strong |
| License clarity | Clear |
| Deployment complexity | Low |
| DEV.co fit | Strong |
| Assessment confidence | High |
Toxiproxy is designed for test/dev/CI use, not production. HTTP API lacks authentication; access should be restricted to localhost or trusted networks. No encryption of traffic between Toxiproxy and upstream services. Code has been maintained since 2014 by Shopify; specific security audit status unknown. No known CVEs from the data provided, but formal security review requires explicit vendor statement.
Alternatives to consider
Linux tc (traffic control) / NetEm
Native kernel-level network emulation; lower overhead. Drawback: Linux-only, requires root, not suitable for CI/containerized environments, steeper learning curve.
Pumba / Gremlin
Container-native chaos tools for orchestrated fault injection. Drawback: container-focused; less fine-grained TCP-level control, typically require more infrastructure setup.
Mock/Stub Libraries (e.g., Mockito, unittest.mock)
Lightweight, language-native; no external process needed. Drawback: application-level mocks cannot simulate realistic network behavior (jitter, partial data arrival, race conditions).
Build on toxiproxy with DEV.co software developers
Toxiproxy is open-source and ready to integrate into your test suite. Start with the GitHub repository, choose a client library in your language, and begin injecting faults into your development and CI pipelines.
Talk to DEV.coRelated on DEV.co
Explore the category and the services that help you build with it.
toxiproxy FAQ
Does Toxiproxy support TLS/HTTPS?
Can I use Toxiproxy in production?
What's the difference between upstream and downstream toxics?
Do I need to restart Toxiproxy to change toxics during a test?
Custom software development, end to end
Standing up toxiproxy properly takes more than a deploy. As a software development agency, DEV.co handles the open-source testing architecture, the web development on top, and the operational work underneath.
Ready to Test Your Resilience?
Toxiproxy is open-source and ready to integrate into your test suite. Start with the GitHub repository, choose a client library in your language, and begin injecting faults into your development and CI pipelines.