🛡️ Secure by default · Zero runtime deps

Security-first, zero-runtime-dependency TypeScript HTTP client for Node.js 18+ backends — Axios-like ergonomics with SSRF protection, redirect safety, resilience, and typed redacted errors.

Get started → Why Neutrx API reference GitHub

📦 npm neutrx ⚙️ Node ≥ 18 🧩 ESM · CJS · .d.ts ⚖️ MIT

0Runtime dependencies

3Security profiles

9+First-party plugins

2Builds: Node + Browser

Install

npm install neutrx

Requires Node.js >= 18. Zero runtime dependencies. Ships ESM + CommonJS + .d.ts, plus a separate browser build.

import neutrx from 'neutrx';

const api = neutrx.create({
  baseURL: 'https://api.example.com',
  security: { profile: 'standard' },
});

const { data } = await api.get('/users/1');

Neutrx is callable and an object: neutrx(url), neutrx.get(url), and neutrx.create(config) all work. The default export is a global instance; create() returns an isolated client with its own defaults, cache, circuit state, and metrics.

Overview

🛡️ Security by default SSRF + DNS pinning (TOCTOU-safe), redirect-downgrade protection, cross-origin credential stripping, cloud-metadata and dangerous-port blocking, TLS controls + cert pinning, size/timeout caps. 🔁 Resilience Retries with four backoff strategies, jitter, and budgets; per-origin circuit breaker; per-origin bulkhead with optional adaptive concurrency — no retry storms. ⚡ Performance Response caching (Cache-Control, SWR, stale-if-error, network-first), in-flight deduplication, async pagination, and DataLoader batching. 🔌 Extensible Plugin SDK plus first-party plugins: AWS SigV4, HAR recording, OpenTelemetry, W3C/B3 trace context, validation, logging, mocks, GraphQL, OAuth2. 🧭 Observable Metrics with latency percentiles, Prometheus export, structured redacting errors, an OpenTelemetry client-span bridge, and trace-context propagation. 🌐 Node + Browser Shared request API across a Node build and a browser build, with honest platform limits (no SSRF/DNS/TLS guarantees in the browser).

A fuller example

import neutrx, { isNeutrxError, NeutrxHTTPError } from 'neutrx';

// Create one client per upstream service. Service-wide policy lives here;
// per-request config overrides only what a single call needs.
const api = neutrx.create({
  baseURL: 'https://billing.example.com', // prepended to relative request paths
  timeout: 8_000,                         // total deadline across retries (ms)

  // Security is enforced on every request. `standard` blocks private/metadata
  // IPs and dangerous ports; `allowedHosts` pins egress to one host.
  security: {
    profile: 'standard',
    allowedHosts: ['billing.example.com'],
  },

  // Resilience wraps the transport: retry -> bulkhead -> circuit breaker.
  resilience: {
    maxRetries: 3,             // retry idempotent calls up to 3 times
    retryStrategy: 'exponential', // 1s, 2s, 4s ... (with jitter), capped
    failureThreshold: 5,       // open the circuit after 5 consecutive failures
    maxConcurrent: 10,         // bulkhead: max in-flight requests per origin
  },

  // Stale-while-revalidate: serve cached data instantly, refresh in background.
  performance: { cacheStrategy: 'swr', cacheTTL: 60_000 },
});

try {
  // `data` is typed via generics/schema; `cached` is true on a cache hit.
  const { data, status, cached } = await api.get('/invoices', {
    params: { page: 1 }, // serialized to ?page=1
  });
  console.log(status, cached, data);
} catch (error) {
  // Re-throw anything that isn't a Neutrx error (programmer errors, etc.).
  if (!isNeutrxError(error)) throw error;

  // toJSON() is log-safe: secrets in URLs/headers/body are redacted.
  console.error(error.code, error.category, error.toJSON());

  // Narrow to a specific subclass for status-aware handling.
  if (error instanceof NeutrxHTTPError) console.error('HTTP', error.status);
}

Get started

Getting Started Install, send your first request, create a client, pick a security profile, handle errors. Node Usage Build a backend service client: methods, concurrency helpers, HTTP/2, TLS, sockets. Node Infrastructure Docker sockets, proxies, redirects, decompression, bandwidth caps, egress gateways. Security Features Profiles, exact per-profile defaults, SSRF internals, egress policy, redaction. Migrate from Axios Verb mapping, defaults, interceptors, cancellation, and security differences. Config Reference Every config block: core, security, egress, resilience, performance, distributed state. API Reference Methods, request config, the response shape, plugins, state, batching, errors. Errors The typed error hierarchy, codes, categories, and redacting toJSON().

Project facts

• License: MIT
• Runtime deps: none (optional @opentelemetry/api peer, detected lazily)
• Node: >= 18
• Entry points: neutrx, neutrx/node, neutrx/browser, neutrx/plugins, neutrx/errors, neutrx/headers, neutrx/adapters, neutrx/instrumentation
• Changelog · npm · Report an issue

Frequently asked questions

What is Neutrx?

Neutrx is a security-first, zero-runtime-dependency TypeScript HTTP client for Node.js 18+ backends. It offers Axios-like ergonomics plus built-in SSRF protection, redirect safety, retries, circuit breaking, caching, metrics, and redacted typed errors.

How is Neutrx different from Axios?

Neutrx adds Node-level security controls Axios does not — SSRF protection, DNS pinning, redirect validation on every hop, TLS controls, and secret-redacting errors — while keeping a familiar request API and shipping zero runtime dependencies.

Does Neutrx have any runtime dependencies?

No. Neutrx has zero runtime dependencies. The only optional peer is @opentelemetry/api, which is detected lazily and never required.

Does Neutrx work in the browser?

Yes, via a separate browser build that shares the request API. However, Node-level security guarantees (SSRF/DNS pinning, TLS, raw sockets) apply only to the Node build, never the browser build.

What Node.js version does Neutrx require?

Neutrx requires Node.js 18 or newer. It ships ESM, CommonJS, and .d.ts type declarations.