One platform.
Five products.
Start with Elchi Core — the complete Envoy management platform — and license security, discovery, and traffic products as you need them.
Elchi Core
The foundation of the Elchi platform: a visual control plane for your entire Envoy fleet — full xDS, multi-version support, safe publish …
Learn more →Elchi API Security
Shield is an ext_proc engine running next to each Envoy: authentication, rate limiting, bot defense, data-loss prevention, and a built-in…
Learn more →Elchi API Discovery
Turns live Envoy traffic into a continuously scored API inventory: shadow endpoints, missing auth, PII exposure, drift — with a one-click…
Learn more →Elchi GSLB
CoreDNS-based authoritative DNS driven by distributed health checking: region-scoped answers, per-record failover zones, and anti-flappin…
Learn more →Elchi WAF
A WAF that runs inside Envoy as an in-process WASM filter: versioned rule configs, a full CRS browser, per-domain directives — managed ce…
Learn more →Everything you need.
Nothing you don't.
Comprehensive platform for enterprise proxy management with modern UI and powerful automation.
Proto-Driven Configuration
Typed models and field metadata are generated from each Envoy version's protobufs. Listeners, Clusters, Endpoints, Routes — with full TypeScript safety.
Interactive Dependency Graphs
Interactive visual diagrams display relationships between Envoy resources. Understand data flow and troubleshoot interactively.
Shield — Edge API Security
A per-edge ext_proc sidecar that enforces API security in the request path: WAF (OWASP CRS), authentication, rate limiting, and bot defense — twelve engines plus built-in DLP, rolled out safely from detect to block.
API Discovery & Inventory
Turn live traffic into a continuously-scored inventory of every API you expose — shadow endpoints, missing auth, PII leaks, enumeration — check it against your OpenAPI specs and export it as OpenAPI.
Quick Start Scenarios
Guided wizards that build a complete set of resources for common setups, such as an HTTP or TCP proxy, plus your own reusable scenarios.
Lightweight Edge Agent
A lightweight agent on every edge host. Auto-registration, health monitoring, log export to Syslog/ELK.
Full xDS Protocol Support
Complete implementation of xDS (ADS, CDS, EDS, LDS, RDS, VHDS). Delta xDS for efficient updates.
Two-Step Validation
Validation in the editor and again on the server ensures configurations are correct before deployment.
Save & Publish Workflow
Draft mode for safe configuration changes. Save incrementally and publish bulk updates atomically. Every change is recorded in the audit log.
Multi-Version Envoy Support
Manage multiple Envoy versions from a single interface. Intelligent version routing with seamless migration X → Y.
Project-Based Multi-Tenancy
Organize configurations by teams, environments, or customers. 4-tier RBAC (Owner, Admin, Editor, Viewer).
Built for the work,
not the workaround.
See how Elchi compares to hand-written Envoy configuration and to a service mesh.
AI-Assisted Analysis
On-demand AI review of configuration and logs, with your own OpenRouter key.
Proto-Driven Models
Typed models and field metadata come from each Envoy version's protos, so the editors follow the Envoy API closely.
Version Routing
Each Envoy is served by the control plane of its own version.
Enterprise Ready
Built from the ground up for multi-tenancy, RBAC, two-factor authentication and a complete audit trail.
Seamless Upgrades
Move a listener and its resources to a new Envoy version and cut over with a hot restart, without dropped requests.
Enterprise Auth
LDAP / AD integration for centralized authentication and authorization.
Log Centralization
Ship logs with Filebeat to Elasticsearch or Logstash, or through rsyslog.
Advanced Metrics
Built-in dashboards with Grafana integration for comprehensive monitoring.
Designed for the operator,
built for the platform team.
Captured from a live environment — real Envoy traffic, Shield blocks and discovered APIs. Drag the slider to see each screen in light and dark.
Versatile by design.
Versatile platform designed for diverse deployment scenarios.
API Gateway Management
Centralized management of clients as an API gateway for microservices architectures.
- › Rate limiting & traffic control
- › Authentication & authorization
- › Request/response transformation
- › API versioning & routing
Load Balancing & Traffic Steering
Run Envoy fleets as load balancers in front of your services, with health checks and controlled rollouts.
- › Weighted traffic splitting & canary
- › Circuit breaking, retries & outlier detection
- › Active health checks
- › Metrics & live traffic view
Multi-Site & Multi-Cluster Backends
Put edge fleets in front of several sites and Kubernetes clusters, managed from one control plane.
- › Kubernetes node discovery per cluster
- › GSLB failover between sites
- › Active/passive edge HA pairs
- › Unified policy enforcement
Enterprise Microservices
Enterprise-grade client management with multi-tenancy and role-based access control.
- › Team-based config isolation
- › Complete audit trail
- › Centralized policy management
- › Self-service configuration
Cloud-Native Applications
Run the control plane on Kubernetes and keep the edge proxies in step with your clusters.
- › Control plane on Kubernetes via Helm
- › Kubernetes node discovery
- › Zero-downtime listener upgrades
- › Health checking & monitoring
Edge Proxy & Ingress
Run Envoy at the edge to terminate TLS, protect incoming traffic and route it.
- › SSL/TLS termination with ACME certificates
- › Rate limits & connection limits
- › Bot & IP-reputation blocking (Shield)
- › Region-scoped DNS answers with GSLB
Whatever your use case, Elchi provides the flexibility and power you need.
Ready to simplify your
client management?
Try the stack solution for proxy management with our demo, or deploy to your Kubernetes cluster using our Helm chart.