# Feature catalog — fatedier/frp

> Canonical page: https://codevetter.com/unpack/frp/feature-catalog

# Feature catalog — fatedier/frp

Scanned commit d20a232996007dfe6ab425abc0a39a3ae9a0889b (2026-09-10). Generated by codevetter codevetter 1.12.0 on 2026-09-22.

frp exposes eight proxy types (tcp, udp, http, https, tcpmux, stcp, sudp, xtcp) plus three visitor types (stcp, sudp, xtcp) for private/P2P access. Features include token and OIDC auth, per-proxy encryption/compression/bandwidth limits, load-balancer groups, health checks, PROXY protocol and host-header rewriting, HTTP server plugins, client plugins (static_file, unix_domain_socket, http(s) converters, socks5, tls2raw, virtual_net), NAT hole punching via STUN, an SSH tunnel gateway, a WireGuard-based VirtualNet, Prometheus metrics, dashboards for both daemons, and a rich frpc CLI with per-type subcommands, verify, nathole discover and admin commands.
- Eight proxy types are defined by proxyConfigTypeMap in pkg/config/v1/proxy.go (TCP, UDP, HTTP, HTTPS, TCPMUX, STCP, XTCP, SUDP); NewProxyConfigurerByType instantiates typed configurers via reflection. — [pkg/config/v1/proxy.go#L242-261](https://github.com/fatedier/frp/blob/d20a232996007dfe6ab425abc0a39a3ae9a0889b/pkg/config/v1/proxy.go#L242-L261)
- frpc auto-generates a cobra subcommand per proxy type (tcp, udp, tcpmux, http, https, stcp, sudp, xtcp) plus visitor subcommands for stcp/sudp/xtcp, wiring flags via config.RegisterClientCommonConfigFlags/RegisterProxyFlags. — [cmd/frpc/sub/proxy.go#L45-87](https://github.com/fatedier/frp/blob/d20a232996007dfe6ab425abc0a39a3ae9a0889b/cmd/frpc/sub/proxy.go#L45-L87)
- Auth supports token and OIDC methods: NewAuthSetter picks NewTokenAuth or Oidc setters/verifiers, and TokenSource can dynamically resolve tokens (file/exec) via Resolve. — [pkg/auth/auth.go#L64-81](https://github.com/fatedier/frp/blob/d20a232996007dfe6ab425abc0a39a3ae9a0889b/pkg/auth/auth.go#L64-L81) [pkg/auth/auth.go#L118-127](https://github.com/fatedier/frp/blob/d20a232996007dfe6ab425abc0a39a3ae9a0889b/pkg/auth/auth.go#L118-L127) [pkg/auth/oidc.go](https://github.com/fatedier/frp/blob/d20a232996007dfe6ab425abc0a39a3ae9a0889b/pkg/auth/oidc.go) [pkg/auth/token.go](https://github.com/fatedier/frp/blob/d20a232996007dfe6ab425abc0a39a3ae9a0889b/pkg/auth/token.go)
- Client-side plugins registered via init() include static_file, unix_domain_socket, http2http, http2https, https2http, https2https, socks5, tls2raw, virtual_net, and http_proxy; each registers a CreatorFn into pkg/plugin/client's creators map. — [pkg/plugin/client/plugin.go#L33-49](https://github.com/fatedier/frp/blob/d20a232996007dfe6ab425abc0a39a3ae9a0889b/pkg/plugin/client/plugin.go#L33-L49) [pkg/plugin/client/static_file.go](https://github.com/fatedier/frp/blob/d20a232996007dfe6ab425abc0a39a3ae9a0889b/pkg/plugin/client/static_file.go) [pkg/plugin/client/unix_domain_socket.go](https://github.com/fatedier/frp/blob/d20a232996007dfe6ab425abc0a39a3ae9a0889b/pkg/plugin/client/unix_domain_socket.go) [pkg/plugin/client/socks5.go](https://github.com/fatedier/frp/blob/d20a232996007dfe6ab425abc0a39a3ae9a0889b/pkg/plugin/client/socks5.go)
- Server manage plugins are HTTP webhooks configured via HTTPPlugins; plugin.Manager supports six ops (Login, NewProxy, CloseProxy, Ping, NewWorkConn, NewUserConn) that can reject or mutate request content. — [server/service.go#L207-211](https://github.com/fatedier/frp/blob/d20a232996007dfe6ab425abc0a39a3ae9a0889b/server/service.go#L207-L211) [pkg/plugin/server/manager.go#L27-44](https://github.com/fatedier/frp/blob/d20a232996007dfe6ab425abc0a39a3ae9a0889b/pkg/plugin/server/manager.go#L27-L44) [pkg/plugin/server/manager.go#L108-170](https://github.com/fatedier/frp/blob/d20a232996007dfe6ab425abc0a39a3ae9a0889b/pkg/plugin/server/manager.go#L108-L170) [pkg/plugin/server/http.go](https://github.com/fatedier/frp/blob/d20a232996007dfe6ab425abc0a39a3ae9a0889b/pkg/plugin/server/http.go)
- xtcp P2P mode uses NAT hole punching: client/visitor exchange NatHoleVisitor/NatHoleClient messages through frps' nathole.Controller, with STUN discovery defaulting to stun.easyvoip.com:3478 (natHoleStunServer). — [pkg/nathole/controller.go](https://github.com/fatedier/frp/blob/d20a232996007dfe6ab425abc0a39a3ae9a0889b/pkg/nathole/controller.go) [pkg/nathole/nathole.go#L118-120](https://github.com/fatedier/frp/blob/d20a232996007dfe6ab425abc0a39a3ae9a0889b/pkg/nathole/nathole.go#L118-L120) [pkg/config/v1/client.go#L50-89](https://github.com/fatedier/frp/blob/d20a232996007dfe6ab425abc0a39a3ae9a0889b/pkg/config/v1/client.go#L50-L89) [server/control.go#L730-732](https://github.com/fatedier/frp/blob/d20a232996007dfe6ab425abc0a39a3ae9a0889b/server/control.go#L730-L732)
- stcp/sudp 'secret' proxies require a shared secretKey; visitors bind a local port and connect through frps visitor-manager admission (admitVisitorByRunID / visitor.Manager). — [server/control.go#L289-303](https://github.com/fatedier/frp/blob/d20a232996007dfe6ab425abc0a39a3ae9a0889b/server/control.go#L289-L303) [server/visitor](https://github.com/fatedier/frp/blob/d20a232996007dfe6ab425abc0a39a3ae9a0889b/server/visitor) [client/visitor](https://github.com/fatedier/frp/blob/d20a232996007dfe6ab425abc0a39a3ae9a0889b/client/visitor)
- Load balancing groups exist for TCP (TCPGroupCtl), HTTP (HTTPGroupCtl), HTTPS and TCPMux, letting multiple proxies share a group key and remote port. — [server/service.go#L214-220](https://github.com/fatedier/frp/blob/d20a232996007dfe6ab425abc0a39a3ae9a0889b/server/service.go#L214-L220) [server/service.go#L348](https://github.com/fatedier/frp/blob/d20a232996007dfe6ab425abc0a39a3ae9a0889b/server/service.go#L348) [server/proxy/tcp.go#L51-65](https://github.com/fatedier/frp/blob/d20a232996007dfe6ab425abc0a39a3ae9a0889b/server/proxy/tcp.go#L51-L65) [server/group](https://github.com/fatedier/frp/blob/d20a232996007dfe6ab425abc0a39a3ae9a0889b/server/group)
- SSH tunnel gateway (SSHTunnelGateway.BindPort) accepts native ssh connections and forwards them into frps via an InternalListener handled like regular frp connections. — [server/service.go#L101](https://github.com/fatedier/frp/blob/d20a232996007dfe6ab425abc0a39a3ae9a0889b/server/service.go#L101) [server/service.go#L280-287](https://github.com/fatedier/frp/blob/d20a232996007dfe6ab425abc0a39a3ae9a0889b/server/service.go#L280-L287) [server/service.go#L381](https://github.com/fatedier/frp/blob/d20a232996007dfe6ab425abc0a39a3ae9a0889b/server/service.go#L381) [pkg/ssh/gateway.go](https://github.com/fatedier/frp/blob/d20a232996007dfe6ab425abc0a39a3ae9a0889b/pkg/ssh/gateway.go)
- VirtualNet creates a TUN device (water + wireguard-go) so visitors get an IP on a virtual network; enabled via featureGates.VirtualNet and virtualNet.address, and cannot be enabled by hot reload alone. — [client/service.go#L220-222](https://github.com/fatedier/frp/blob/d20a232996007dfe6ab425abc0a39a3ae9a0889b/client/service.go#L220-L222) [client/service.go#L515-520](https://github.com/fatedier/frp/blob/d20a232996007dfe6ab425abc0a39a3ae9a0889b/client/service.go#L515-L520) [pkg/vnet/controller.go](https://github.com/fatedier/frp/blob/d20a232996007dfe6ab425abc0a39a3ae9a0889b/pkg/vnet/controller.go) [pkg/vnet/tun_linux.go](https://github.com/fatedier/frp/blob/d20a232996007dfe6ab425abc0a39a3ae9a0889b/pkg/vnet/tun_linux.go)
- frps dashboard API exposes /healthz, /api/serverinfo, /api/proxy/{type}[/{name}], /api/traffic/{name}, /api/clients, DELETE /api/proxies, plus a parallel /api/v2 surface (users, system/info, system/prune, clients, proxies) and /metrics when EnablePrometheus. — [server/api_router.go#L27-60](https://github.com/fatedier/frp/blob/d20a232996007dfe6ab425abc0a39a3ae9a0889b/server/api_router.go#L27-L60) [server/http](https://github.com/fatedier/frp/blob/d20a232996007dfe6ab425abc0a39a3ae9a0889b/server/http)
- frpc admin API exposes /api/reload, /api/stop, /api/status, GET/PUT /api/config, per-proxy/visitor config reads, and CRUD under /api/store/proxies|visitors when the store source is enabled. — [client/api_router.go#L36-55](https://github.com/fatedier/frp/blob/d20a232996007dfe6ab425abc0a39a3ae9a0889b/client/api_router.go#L36-L55)
- frpc CLI extras: 'verify' subcommand validates auth against a server, 'nathole discover' probes NAT behavior, and admin subcommands call the admin API. — [cmd/frpc/sub/verify.go#L27-30](https://github.com/fatedier/frp/blob/d20a232996007dfe6ab425abc0a39a3ae9a0889b/cmd/frpc/sub/verify.go#L27-L30) [cmd/frpc/sub/nathole.go#L34-47](https://github.com/fatedier/frp/blob/d20a232996007dfe6ab425abc0a39a3ae9a0889b/cmd/frpc/sub/nathole.go#L34-L47) [cmd/frpc/sub/admin.go#L48-54](https://github.com/fatedier/frp/blob/d20a232996007dfe6ab425abc0a39a3ae9a0889b/cmd/frpc/sub/admin.go#L48-L54)
- Per-proxy transport features include useEncryption/useCompression (golib io wrappers), bandwidthLimit with client/server mode (rate.Limiter), and proxyProtocolVersion headers built by BuildProxyProtocolHeaderStruct. — [client/proxy/proxy.go#L66-70](https://github.com/fatedier/frp/blob/d20a232996007dfe6ab425abc0a39a3ae9a0889b/client/proxy/proxy.go#L66-L70) [client/proxy/proxy.go#L134-154](https://github.com/fatedier/frp/blob/d20a232996007dfe6ab425abc0a39a3ae9a0889b/client/proxy/proxy.go#L134-L154) [client/proxy/proxy.go#L210-215](https://github.com/fatedier/frp/blob/d20a232996007dfe6ab425abc0a39a3ae9a0889b/client/proxy/proxy.go#L210-L215)
- Health checking of local services lives in client/health, and event hooks in client/event let proxies react to lifecycle events. — [client/health/health.go](https://github.com/fatedier/frp/blob/d20a232996007dfe6ab425abc0a39a3ae9a0889b/client/health/health.go) [client/event/event.go](https://github.com/fatedier/frp/blob/d20a232996007dfe6ab425abc0a39a3ae9a0889b/client/event/event.go)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)