onionoo-fastapi 1.0.0__tar.gz

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (60) hide show
  1. onionoo_fastapi-1.0.0/.dockerignore +22 -0
  2. onionoo_fastapi-1.0.0/.github/workflows/ci.yml +37 -0
  3. onionoo_fastapi-1.0.0/.github/workflows/docker.yml +71 -0
  4. onionoo_fastapi-1.0.0/.github/workflows/release.yml +54 -0
  5. onionoo_fastapi-1.0.0/.gitignore +39 -0
  6. onionoo_fastapi-1.0.0/Dockerfile +56 -0
  7. onionoo_fastapi-1.0.0/LICENSE +22 -0
  8. onionoo_fastapi-1.0.0/PKG-INFO +379 -0
  9. onionoo_fastapi-1.0.0/README.md +337 -0
  10. onionoo_fastapi-1.0.0/app/__init__.py +1 -0
  11. onionoo_fastapi-1.0.0/app/main.py +151 -0
  12. onionoo_fastapi-1.0.0/app/mcp_stdio.py +189 -0
  13. onionoo_fastapi-1.0.0/app/mcp_tools.py +273 -0
  14. onionoo_fastapi-1.0.0/app/models/__init__.py +1 -0
  15. onionoo_fastapi-1.0.0/app/models/bandwidth.py +93 -0
  16. onionoo_fastapi-1.0.0/app/models/clients.py +31 -0
  17. onionoo_fastapi-1.0.0/app/models/details.py +261 -0
  18. onionoo_fastapi-1.0.0/app/models/envelope.py +80 -0
  19. onionoo_fastapi-1.0.0/app/models/history.py +37 -0
  20. onionoo_fastapi-1.0.0/app/models/misc.py +13 -0
  21. onionoo_fastapi-1.0.0/app/models/summary.py +62 -0
  22. onionoo_fastapi-1.0.0/app/models/uptime.py +50 -0
  23. onionoo_fastapi-1.0.0/app/models/weights.py +54 -0
  24. onionoo_fastapi-1.0.0/app/observability.py +139 -0
  25. onionoo_fastapi-1.0.0/app/routers/__init__.py +1 -0
  26. onionoo_fastapi-1.0.0/app/routers/aggregate.py +85 -0
  27. onionoo_fastapi-1.0.0/app/routers/bandwidth.py +50 -0
  28. onionoo_fastapi-1.0.0/app/routers/clients.py +47 -0
  29. onionoo_fastapi-1.0.0/app/routers/details.py +52 -0
  30. onionoo_fastapi-1.0.0/app/routers/params.py +224 -0
  31. onionoo_fastapi-1.0.0/app/routers/proxy.py +62 -0
  32. onionoo_fastapi-1.0.0/app/routers/summary.py +50 -0
  33. onionoo_fastapi-1.0.0/app/routers/uptime.py +47 -0
  34. onionoo_fastapi-1.0.0/app/routers/weights.py +48 -0
  35. onionoo_fastapi-1.0.0/app/services/__init__.py +1 -0
  36. onionoo_fastapi-1.0.0/app/services/aggregate.py +103 -0
  37. onionoo_fastapi-1.0.0/app/services/onionoo_client.py +302 -0
  38. onionoo_fastapi-1.0.0/app/settings.py +30 -0
  39. onionoo_fastapi-1.0.0/docker-compose.yml +50 -0
  40. onionoo_fastapi-1.0.0/pyproject.toml +58 -0
  41. onionoo_fastapi-1.0.0/tests/__init__.py +0 -0
  42. onionoo_fastapi-1.0.0/tests/conftest.py +69 -0
  43. onionoo_fastapi-1.0.0/tests/test_304.py +61 -0
  44. onionoo_fastapi-1.0.0/tests/test_aggregate.py +128 -0
  45. onionoo_fastapi-1.0.0/tests/test_cache.py +93 -0
  46. onionoo_fastapi-1.0.0/tests/test_correlation_id.py +65 -0
  47. onionoo_fastapi-1.0.0/tests/test_cors.py +85 -0
  48. onionoo_fastapi-1.0.0/tests/test_dedup.py +117 -0
  49. onionoo_fastapi-1.0.0/tests/test_fields_projection.py +57 -0
  50. onionoo_fastapi-1.0.0/tests/test_healthz_ready.py +65 -0
  51. onionoo_fastapi-1.0.0/tests/test_limit_offset.py +58 -0
  52. onionoo_fastapi-1.0.0/tests/test_mcp.py +117 -0
  53. onionoo_fastapi-1.0.0/tests/test_mcp_stdio.py +114 -0
  54. onionoo_fastapi-1.0.0/tests/test_mcp_tools.py +287 -0
  55. onionoo_fastapi-1.0.0/tests/test_meta_block.py +54 -0
  56. onionoo_fastapi-1.0.0/tests/test_metrics.py +58 -0
  57. onionoo_fastapi-1.0.0/tests/test_rate_limit.py +61 -0
  58. onionoo_fastapi-1.0.0/tests/test_raw_passthrough.py +48 -0
  59. onionoo_fastapi-1.0.0/tests/test_retry.py +121 -0
  60. onionoo_fastapi-1.0.0/uv.lock +1527 -0
@@ -0,0 +1,22 @@
1
+ .git
2
+ .gitignore
3
+ .vscode
4
+ .idea
5
+
6
+ __pycache__
7
+ *.pyc
8
+ *.pyo
9
+ *.pyd
10
+
11
+ .venv
12
+ venv
13
+ .env
14
+ .env.*
15
+
16
+ .pytest_cache
17
+ .coverage
18
+ htmlcov
19
+ dist
20
+ build
21
+ *.egg-info
22
+
@@ -0,0 +1,37 @@
1
+ name: CI
2
+
3
+ on:
4
+ push:
5
+ branches: [main]
6
+ pull_request:
7
+
8
+ concurrency:
9
+ group: ci-${{ github.ref }}
10
+ cancel-in-progress: true
11
+
12
+ jobs:
13
+ test:
14
+ runs-on: ubuntu-latest
15
+ steps:
16
+ - uses: actions/checkout@v4
17
+
18
+ - name: Install uv
19
+ uses: astral-sh/setup-uv@v3
20
+ with:
21
+ enable-cache: true
22
+
23
+ - name: Set up Python
24
+ run: uv python install 3.13
25
+
26
+ - name: Sync dependencies
27
+ # `uv sync` includes the default dev group from pyproject.toml.
28
+ run: uv sync
29
+
30
+ - name: Lint
31
+ run: uv run ruff check .
32
+
33
+ - name: Format check
34
+ run: uv run ruff format --check .
35
+
36
+ - name: Test
37
+ run: uv run pytest -v
@@ -0,0 +1,71 @@
1
+ name: Docker image
2
+
3
+ on:
4
+ push:
5
+ branches: [main]
6
+ tags:
7
+ - "v*"
8
+ pull_request:
9
+ branches: [main]
10
+
11
+ permissions:
12
+ contents: read
13
+ packages: write
14
+
15
+ jobs:
16
+ build-and-push:
17
+ runs-on: ubuntu-latest
18
+ steps:
19
+ - uses: actions/checkout@v4
20
+
21
+ - name: Set up QEMU
22
+ uses: docker/setup-qemu-action@v3
23
+
24
+ - name: Set up Buildx
25
+ uses: docker/setup-buildx-action@v3
26
+
27
+ - name: Log in to GHCR
28
+ if: github.event_name != 'pull_request'
29
+ uses: docker/login-action@v3
30
+ with:
31
+ registry: ghcr.io
32
+ username: ${{ github.actor }}
33
+ password: ${{ secrets.GITHUB_TOKEN }}
34
+
35
+ - name: Compute image tags
36
+ id: meta
37
+ uses: docker/metadata-action@v5
38
+ with:
39
+ images: ghcr.io/${{ github.repository }}
40
+ tags: |
41
+ type=ref,event=branch
42
+ type=ref,event=pr
43
+ type=semver,pattern={{version}}
44
+ type=semver,pattern={{major}}.{{minor}}
45
+ type=sha,prefix=sha-
46
+
47
+ # PR builds run amd64-only for smoke coverage; push/tag builds publish
48
+ # the full multi-arch image. This keeps PR CI minutes reasonable.
49
+ - name: Build and push
50
+ id: build
51
+ uses: docker/build-push-action@v6
52
+ with:
53
+ context: .
54
+ platforms: ${{ github.event_name == 'pull_request' && 'linux/amd64' || 'linux/amd64,linux/arm64' }}
55
+ push: ${{ github.event_name != 'pull_request' }}
56
+ load: ${{ github.event_name == 'pull_request' }}
57
+ tags: ${{ steps.meta.outputs.tags }}
58
+ labels: ${{ steps.meta.outputs.labels }}
59
+ cache-from: type=gha
60
+ cache-to: type=gha,mode=max
61
+
62
+ # On PRs the amd64 image is `load`-ed into the local Docker daemon, so
63
+ # we can boot it and verify imports + healthcheck before merging. Catches
64
+ # Python-version / dependency drift that wouldn't surface from `uv sync`.
65
+ - name: Smoke test image (PR only)
66
+ if: github.event_name == 'pull_request'
67
+ run: |
68
+ IMAGE="$(echo '${{ steps.meta.outputs.tags }}' | head -n1)"
69
+ echo "Testing $IMAGE"
70
+ docker run --rm --entrypoint python "$IMAGE" -c \
71
+ "import app.main; assert app.main.app is not None; print('app import ok')"
@@ -0,0 +1,54 @@
1
+ name: Release to PyPI
2
+
3
+ on:
4
+ push:
5
+ tags:
6
+ - "v*"
7
+
8
+ # Default permissions: read-only for the whole workflow. The publish job
9
+ # escalates to `id-token: write` only when it actually needs OIDC.
10
+ permissions:
11
+ contents: read
12
+
13
+ jobs:
14
+ build:
15
+ runs-on: ubuntu-latest
16
+ steps:
17
+ - uses: actions/checkout@v4
18
+
19
+ - name: Install uv
20
+ uses: astral-sh/setup-uv@v3
21
+ with:
22
+ enable-cache: true
23
+
24
+ - name: Set up Python
25
+ run: uv python install 3.13
26
+
27
+ - name: Build wheel and sdist
28
+ run: uv build
29
+
30
+ - name: Upload build artifacts
31
+ uses: actions/upload-artifact@v4
32
+ with:
33
+ name: dist
34
+ path: dist/
35
+
36
+ publish:
37
+ needs: build
38
+ runs-on: ubuntu-latest
39
+ # OIDC trusted-publishing token is scoped to this job only.
40
+ permissions:
41
+ id-token: write
42
+ environment:
43
+ name: pypi
44
+ url: https://pypi.org/project/onionoo-fastapi/
45
+ steps:
46
+ - uses: actions/download-artifact@v4
47
+ with:
48
+ name: dist
49
+ path: dist/
50
+
51
+ # Uses PyPI Trusted Publishing — no API token needed once the project is
52
+ # registered on PyPI with this workflow as a trusted publisher.
53
+ - name: Publish to PyPI
54
+ uses: pypa/gh-action-pypi-publish@release/v1
@@ -0,0 +1,39 @@
1
+ # Python
2
+ __pycache__/
3
+ *.py[cod]
4
+ *$py.class
5
+
6
+ # Virtual environments
7
+ .venv/
8
+ venv/
9
+ .envrc
10
+
11
+ # Environment variables / secrets
12
+ .env
13
+ .env.*
14
+
15
+ # Packaging
16
+ build/
17
+ dist/
18
+ *.egg-info/
19
+
20
+ # Test / coverage
21
+ .pytest_cache/
22
+ .coverage
23
+ coverage.xml
24
+ htmlcov/
25
+
26
+ # Type check / linters
27
+ .mypy_cache/
28
+ .ruff_cache/
29
+ .pytype/
30
+
31
+ # Logs
32
+ *.log
33
+
34
+ # OS / editor
35
+ .DS_Store
36
+ Thumbs.db
37
+ .vscode/
38
+ .idea/
39
+
@@ -0,0 +1,56 @@
1
+ ARG PYTHON_VERSION=3.13
2
+
3
+ FROM python:${PYTHON_VERSION}-alpine AS builder
4
+
5
+ ENV PYTHONDONTWRITEBYTECODE=1 \
6
+ PYTHONUNBUFFERED=1 \
7
+ UV_PROJECT_ENVIRONMENT=/app/.venv \
8
+ UV_LINK_MODE=copy \
9
+ PATH="/root/.local/bin:/app/.venv/bin:$PATH"
10
+
11
+ WORKDIR /app
12
+
13
+ # Build-only deps: curl pulls the uv installer; ca-certificates makes the TLS
14
+ # handshake to astral.sh / PyPI work. These stay in the builder stage and never
15
+ # reach the runtime image.
16
+ RUN apk add --no-cache ca-certificates curl \
17
+ && update-ca-certificates \
18
+ && curl -LsSf https://astral.sh/uv/install.sh | sh
19
+
20
+ # Install dependencies first (better layer caching). `--no-install-project`
21
+ # skips the hatchling build step here so this layer survives changes to app/.
22
+ COPY pyproject.toml uv.lock /app/
23
+ RUN uv sync --frozen --no-install-project --no-dev
24
+
25
+ # Then install the project itself; this is what places the `onionoo-mcp`
26
+ # console script on PATH.
27
+ COPY app /app/app
28
+ COPY README.md LICENSE /app/
29
+ RUN uv sync --frozen --no-dev
30
+
31
+
32
+ FROM python:${PYTHON_VERSION}-alpine AS runtime
33
+
34
+ ENV PYTHONDONTWRITEBYTECODE=1 \
35
+ PYTHONUNBUFFERED=1 \
36
+ UV_PROJECT_ENVIRONMENT=/app/.venv \
37
+ PATH="/app/.venv/bin:$PATH"
38
+
39
+ WORKDIR /app
40
+
41
+ # Runtime needs CA bundle for outbound HTTPS to Onionoo, plus wget for the
42
+ # HEALTHCHECK probe. No uv, no curl, no toolchain in the final image.
43
+ RUN apk add --no-cache ca-certificates wget \
44
+ && update-ca-certificates \
45
+ && adduser -D -u 10001 appuser
46
+
47
+ COPY --from=builder --chown=appuser:appuser /app /app
48
+
49
+ USER appuser
50
+
51
+ EXPOSE 8000
52
+
53
+ HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
54
+ CMD wget -q -O- http://127.0.0.1:8000/healthz >/dev/null || exit 1
55
+
56
+ CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8000"]
@@ -0,0 +1,22 @@
1
+ MIT License
2
+
3
+ Copyright (c) 2026 Toomore Chiang (anoni.net)
4
+
5
+ Permission is hereby granted, free of charge, to any person obtaining a copy
6
+ of this software and associated documentation files (the "Software"), to deal
7
+ in the Software without restriction, including without limitation the rights
8
+ to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9
+ copies of the Software, and to permit persons to whom the Software is
10
+ furnished to do so, subject to the following conditions:
11
+
12
+ The above copyright notice and this permission notice shall be included in all
13
+ copies or substantial portions of the Software.
14
+
15
+ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16
+ IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17
+ FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18
+ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19
+ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20
+ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21
+ SOFTWARE.
22
+
@@ -0,0 +1,379 @@
1
+ Metadata-Version: 2.4
2
+ Name: onionoo-fastapi
3
+ Version: 1.0.0
4
+ Summary: FastAPI-based semantic/OpenAPI proxy for Tor Onionoo.
5
+ Project-URL: Repository, https://github.com/anoni-net/onionoo-fastapi
6
+ Project-URL: Issues, https://github.com/anoni-net/onionoo-fastapi/issues
7
+ License: MIT License
8
+
9
+ Copyright (c) 2026 Toomore Chiang (anoni.net)
10
+
11
+ Permission is hereby granted, free of charge, to any person obtaining a copy
12
+ of this software and associated documentation files (the "Software"), to deal
13
+ in the Software without restriction, including without limitation the rights
14
+ to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
15
+ copies of the Software, and to permit persons to whom the Software is
16
+ furnished to do so, subject to the following conditions:
17
+
18
+ The above copyright notice and this permission notice shall be included in all
19
+ copies or substantial portions of the Software.
20
+
21
+ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
22
+ IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
23
+ FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
24
+ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
25
+ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
26
+ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
27
+ SOFTWARE.
28
+
29
+ License-File: LICENSE
30
+ Requires-Python: >=3.13
31
+ Requires-Dist: cachetools>=5.3
32
+ Requires-Dist: fastapi-mcp>=0.4
33
+ Requires-Dist: fastapi[standard]>=0.110
34
+ Requires-Dist: httpx>=0.27
35
+ Requires-Dist: prometheus-fastapi-instrumentator>=7.0
36
+ Requires-Dist: pydantic-settings>=2.2
37
+ Requires-Dist: slowapi>=0.1.9
38
+ Requires-Dist: structlog>=24.1
39
+ Requires-Dist: tenacity>=8.3
40
+ Requires-Dist: uvicorn[standard]>=0.27
41
+ Description-Content-Type: text/markdown
42
+
43
+ # onionoo-fastapi
44
+
45
+ FastAPI-based **semantic/OpenAPI proxy** for the Tor **Onionoo** API.
46
+
47
+ - GitHub: <https://github.com/anoni-net/onionoo-fastapi>
48
+ - Upstream data source: <https://onionoo.torproject.org>
49
+ - This service **does not store Onionoo data**, it only forwards requests and transforms responses.
50
+ - Primary motivation: Onionoo has a solid spec, but **no OpenAPI**; this service provides a friendly schema **for tooling/AI agents**.
51
+
52
+ Reference spec: [Tor Metrics – Onionoo](https://metrics.torproject.org/onionoo.html)
53
+
54
+ ## Hosted instance
55
+
56
+ - Service: `https://onionoo.anoni.net`
57
+ - Swagger UI: `https://onionoo.anoni.net/docs`
58
+
59
+ ## Releases
60
+
61
+ Tagged releases (`vX.Y.Z`) trigger two GitHub Actions workflows:
62
+
63
+ - `.github/workflows/release.yml` — builds the wheel/sdist and publishes to
64
+ PyPI via Trusted Publishing. Register this workflow as a trusted publisher
65
+ on the `onionoo-fastapi` PyPI project once before the first tag.
66
+ - `.github/workflows/docker.yml` — builds a multi-arch image and pushes to
67
+ `ghcr.io/<owner>/onionoo-fastapi`. Uses the default `GITHUB_TOKEN`.
68
+
69
+ Cut a release with:
70
+
71
+ ```bash
72
+ git tag -a v0.2.0 -m "Release 0.2.0"
73
+ git push origin v0.2.0
74
+ ```
75
+
76
+ ## License
77
+
78
+ MIT. See `LICENSE`.
79
+
80
+ ## Requirements
81
+
82
+ - Python 3.11+
83
+ - [`uv`](https://docs.astral.sh/uv/)
84
+
85
+ ## Install
86
+
87
+ ```bash
88
+ git clone https://github.com/anoni-net/onionoo-fastapi
89
+ cd onionoo-fastapi
90
+ uv sync
91
+ ```
92
+
93
+ Or if you already have the source:
94
+
95
+ ```bash
96
+ cd onionoo-fastapi
97
+ uv sync
98
+ ```
99
+
100
+ ## Run
101
+
102
+ ```bash
103
+ fastapi run app.main:app --reload --host 0.0.0.0 --port 8000
104
+ ```
105
+ **Note:** `fastapi run` requires FastAPI version 0.110.0 or newer.
106
+
107
+ OpenAPI docs:
108
+
109
+ - Swagger UI: `http://localhost:8000/docs`
110
+ - OpenAPI JSON: `http://localhost:8000/openapi.json`
111
+
112
+ ## Test
113
+
114
+ ```bash
115
+ uv sync --extra dev
116
+ uv run pytest
117
+ ```
118
+
119
+ ## Docker
120
+
121
+ Build and run with Docker Compose:
122
+
123
+ ```bash
124
+ docker compose up -d --build
125
+ ```
126
+
127
+ If port 8000 is already in use, override host port (example: 8001):
128
+
129
+ ```bash
130
+ HOST_PORT=8001 docker compose up -d --build
131
+ ```
132
+
133
+ Stop:
134
+
135
+ ```bash
136
+ docker compose down
137
+ ```
138
+
139
+ Configuration via environment variables (example):
140
+
141
+ ```bash
142
+ ONIONOO_BASE_URL=https://onionoo.torproject.org HOST_PORT=8001 docker compose up -d --build
143
+ ```
144
+
145
+ ## API
146
+
147
+ This service exposes semantic endpoints under `/v1/*`:
148
+
149
+ - `GET /v1/summary`
150
+ - `GET /v1/details`
151
+ - `GET /v1/bandwidth`
152
+ - `GET /v1/weights`
153
+ - `GET /v1/clients`
154
+ - `GET /v1/uptime`
155
+
156
+ Aggregate (server-side group-by, sorted by relay count):
157
+
158
+ - `GET /v1/aggregate/countries` — buckets by two-letter country code
159
+ - `GET /v1/aggregate/as` — buckets by autonomous system number
160
+ - `GET /v1/aggregate/flags` — buckets by directory-authority flag (a relay can fall into multiple flag buckets)
161
+
162
+ Plus:
163
+
164
+ - `GET /healthz` — static liveness
165
+ - `GET /healthz/ready` — verifies upstream reachability (cached)
166
+ - `GET /metrics` — Prometheus format
167
+
168
+ ### Example requests
169
+
170
+ ```bash
171
+ # Summary (semantic keys; upstream short keys are transformed)
172
+ curl -s 'http://localhost:8000/v1/summary?limit=1' | jq .
173
+
174
+ # Details (supports Onionoo query parameters + details-only `fields`)
175
+ curl -s 'http://localhost:8000/v1/details?limit=1&search=moria&fields=nickname,fingerprint' | jq .
176
+
177
+ # Bandwidth
178
+ curl -s 'http://localhost:8000/v1/bandwidth?limit=1&search=moria' | jq .
179
+
180
+ # Weights (relays only)
181
+ curl -s 'http://localhost:8000/v1/weights?limit=1&search=moria' | jq .
182
+
183
+ # Clients (bridges only)
184
+ curl -s 'http://localhost:8000/v1/clients?limit=1' | jq .
185
+
186
+ # Uptime
187
+ curl -s 'http://localhost:8000/v1/uptime?limit=1&search=moria' | jq .
188
+ ```
189
+
190
+ ### Semantic field mapping notes
191
+
192
+ - `/v1/summary` transforms Onionoo short keys:
193
+ - relay: `n,f,a,r` → `nickname,fingerprint,addresses,running`
194
+ - bridge: `n,h,r` → `nickname,hashed_fingerprint,running`
195
+ - For some bridge documents (`/bandwidth`, `/clients`, `/uptime`), Onionoo uses the key name `fingerprint` even though the value is a **hashed fingerprint**; this API exposes that as `hashed_fingerprint`.
196
+
197
+ ### Caching / 304 behavior
198
+
199
+ If the client includes `If-Modified-Since`, it will be forwarded upstream. If Onionoo replies with `304`, this service will reply `304` too.
200
+
201
+ ### Configuration
202
+
203
+ Upstream / cache:
204
+
205
+ - `ONIONOO_BASE_URL` (default: `https://onionoo.torproject.org`)
206
+ - `ONIONOO_TIMEOUT_SECONDS` (default: `30`)
207
+ - `DEFAULT_LIMIT` (default: `100`)
208
+ - `MAX_LIMIT` (default: `200`)
209
+ - `USER_AGENT`
210
+ - `CACHE_MAXSIZE` (default: `1024`)
211
+ - `CACHE_DEFAULT_TTL_SECONDS` (default: `300`)
212
+ - `UPSTREAM_RETRY_ATTEMPTS` (default: `2`)
213
+
214
+ Observability / production hardening:
215
+
216
+ - `LOG_LEVEL` (default: `INFO`)
217
+ - `LOG_FORMAT` (`json` or `console`, default `json`)
218
+ - `METRICS_ENABLED` (default: `true`) — exposes `/metrics` in Prometheus format
219
+ - `CORS_ALLOWED_ORIGINS` (default: empty, CORS disabled). Example: `["https://example.com"]`
220
+ - `RATE_LIMIT_ENABLED` (default: `false`)
221
+ - `RATE_LIMIT_PER_MINUTE` (default: `120`)
222
+ - `HEALTHZ_READY_CACHE_SECONDS` (default: `30`)
223
+
224
+ ### Resource sizing
225
+
226
+ A single-worker container (the default `uvicorn` CMD in the Dockerfile) measured on Alpine 3.23 / Python 3.14 / aarch64 against the real Onionoo upstream:
227
+
228
+ | Phase | RSS | Notes |
229
+ |---|---:|---|
230
+ | **Idle** (just after start) | ~75 MiB | Python + FastAPI + Pydantic + httpx + fastapi-mcp + structlog + Prometheus instrumentator loaded; cache empty. |
231
+ | **Typical agent traffic** | ~90 MiB | After ~15 mixed `/v1/*` calls (details + aggregates), only a handful of distinct upstream payloads cached. |
232
+ | **Cache near saturation** | ~180 MiB | After 200 distinct `/v1/details` queries with `fields=` projection; cache holds ~200 entries. |
233
+
234
+ From these measurements, each cached entry costs **~0.5 MiB on average** when callers use the `fields=` projection. With the default `CACHE_MAXSIZE=1024` that yields a **~500 MiB upper bound** under realistic agent traffic.
235
+
236
+ If you expect callers to hit `/v1/details` **without** `fields=`, a single response can be several MiB (Onionoo returns ~10k full relay objects). A fully saturated cache of unfiltered details would then sit in the **1–5 GiB** range — bound it by tuning `CACHE_MAXSIZE` down.
237
+
238
+ Suggested memory limits for `docker run --memory` / Kubernetes requests:
239
+
240
+ | Deployment shape | Memory request | Memory limit |
241
+ |---|---:|---:|
242
+ | Personal / single-agent test | 128 MiB | 256 MiB |
243
+ | Hosted instance, mostly cached requests | 256 MiB | 512 MiB |
244
+ | Public instance, agents may issue unfiltered `/details` | 512 MiB | 1–2 GiB |
245
+
246
+ CPU is light — a single worker handles 10s of QPS comfortably; scale with replicas if you need more throughput. (`uvicorn ... --workers N` is also an option, but each worker keeps its own in-memory cache; horizontal scaling via separate containers is usually a better fit.)
247
+
248
+ ### Health checks
249
+
250
+ - `GET /healthz` — static liveness probe, never hits upstream.
251
+ - `GET /healthz/ready` — pings Onionoo (`summary?limit=1`); 200 when reachable, 503 otherwise. Result is cached for `HEALTHZ_READY_CACHE_SECONDS`.
252
+
253
+ ### Request tracing
254
+
255
+ Every request is assigned an `X-Request-ID`. Clients may supply one to correlate across systems; the same value is echoed back on the response and bound into every log record produced during the request.
256
+
257
+ ### Metrics
258
+
259
+ `/metrics` exposes Prometheus-format counters / histograms, including:
260
+
261
+ - `onionoo_cache_hits_total`, `onionoo_cache_misses_total`
262
+ - `onionoo_upstream_seconds{method=...}` (histogram)
263
+ - `onionoo_upstream_errors_total{method=..., status=...}`
264
+ - Standard `http_request_duration_seconds` from the FastAPI instrumentator
265
+
266
+ ### Raw passthrough
267
+
268
+ For large payloads (`/v1/details`), pass `?raw=true` to skip Pydantic re-validation and forward the upstream JSON verbatim. Trade-off: raw mode does **not** apply semantic key remapping (e.g. on `/v1/summary` you'll see `n,f,a,r` rather than `nickname,fingerprint,addresses,running`) and **no `_meta` block is injected**.
269
+
270
+ ### Response metadata (`_meta`)
271
+
272
+ Non-raw responses on `/v1/*` include a proxy-injected `_meta` block at the top of the envelope:
273
+
274
+ ```json
275
+ {
276
+ "_meta": {
277
+ "cache_age_seconds": 12.345,
278
+ "upstream_last_modified": "Thu, 15 May 2026 12:00:00 GMT"
279
+ },
280
+ "version": "9.0",
281
+ ...
282
+ }
283
+ ```
284
+
285
+ `cache_age_seconds = 0.0` means the response was just fetched from Onionoo. A non-zero value means the proxy served it from its in-memory cache.
286
+
287
+ ### Trimming payloads with `fields=`
288
+
289
+ All `/v1/*` endpoints accept `?fields=a,b,c`. On `/summary` and `/details` Onionoo applies the projection at the upstream level; on history endpoints (bandwidth, weights, clients, uptime) Onionoo applies it where supported. Using it on large queries can shrink LLM input by an order of magnitude.
290
+
291
+ ## Use as an MCP server
292
+
293
+ This project ships an [MCP](https://modelcontextprotocol.io) server with two
294
+ transports — pick whichever fits your client.
295
+
296
+ ### Tools
297
+
298
+ **Task-oriented (recommended for agents)**
299
+
300
+ - `find_relay(query)` — free-form lookup; auto-detects fingerprint, AS, IP, or nickname
301
+ - `get_relay_health(fingerprint)` — composite snapshot (details + uptime + bandwidth)
302
+ - `top_relays_by_bandwidth(country?, flag?, limit)` — top-N by consensus weight
303
+ - `compare_relays(fingerprints)` — parallel side-by-side details
304
+ - `country_summary(country)` — running relay count, total bandwidth, flag distribution
305
+
306
+ **Low-level pass-through (raw Onionoo endpoints)**
307
+
308
+ - `onionoo_summary`, `onionoo_details`, `onionoo_bandwidth`, `onionoo_weights`,
309
+ `onionoo_clients`, `onionoo_uptime` — each takes a `params` dict matching the
310
+ [Onionoo query spec](https://metrics.torproject.org/onionoo.html).
311
+
312
+ **Aggregates**
313
+
314
+ - `aggregate_relays(group_by="country"|"as"|"flag", running=True, top=N)` — server-side group-by, sorted by relay count.
315
+
316
+ > Streamable HTTP `/mcp` exposes the six low-level endpoints (`get_summary` …
317
+ > `get_uptime`) plus the three aggregate endpoints (`aggregate_countries`,
318
+ > `aggregate_as`, `aggregate_flags`). The task-oriented tools and the unified
319
+ > `aggregate_relays` live in the stdio server. Both transports can run side by side.
320
+
321
+ ### Streamable HTTP transport (recommended for hosted use)
322
+
323
+ Run the FastAPI app — `/mcp` is mounted automatically.
324
+
325
+ Inspect with MCP Inspector:
326
+
327
+ ```bash
328
+ npx @modelcontextprotocol/inspector
329
+ # Transport: Streamable HTTP
330
+ # URL: http://localhost:8000/mcp
331
+ ```
332
+
333
+ Claude Desktop / Cursor:
334
+
335
+ ```json
336
+ {
337
+ "mcpServers": {
338
+ "onionoo": {
339
+ "type": "http",
340
+ "url": "https://onionoo.anoni.net/mcp"
341
+ }
342
+ }
343
+ }
344
+ ```
345
+
346
+ ### stdio transport (recommended for local agents)
347
+
348
+ `uv sync` installs an `onionoo-mcp` console script:
349
+
350
+ ```bash
351
+ onionoo-mcp
352
+ ```
353
+
354
+ Claude Desktop / Cursor:
355
+
356
+ ```json
357
+ {
358
+ "mcpServers": {
359
+ "onionoo": {
360
+ "command": "uvx",
361
+ "args": ["--from", "/path/to/onionoo-fastapi", "onionoo-mcp"]
362
+ }
363
+ }
364
+ }
365
+ ```
366
+
367
+ Or, if the repo is checked out and you have `uv`:
368
+
369
+ ```json
370
+ {
371
+ "mcpServers": {
372
+ "onionoo": {
373
+ "command": "uv",
374
+ "args": ["--directory", "/path/to/onionoo-fastapi", "run", "onionoo-mcp"]
375
+ }
376
+ }
377
+ }
378
+ ```
379
+