One engine · four products · early access

The edge we built for ourselves. Now yours.

A thread-per-core Rust engine that proxies 144,000 requests a second on 8 vCPU — with WAF, DDoS protection, TLS, HTTP/3 and device attestation built in. It runs every load balancer on NexLayer. On top of it we ship developer tunnels, API security, an MCP gateway, and sovereign on-prem deployments.

Explore the products See the engine
Sign in with a NexLayer account · $50 cloud credit included · no card required
zsh — dev
products

Four ways to put the engine to work.

Same core, different jobs: expose, protect, govern, or own it outright.

NexTunnel

LIVE — FREE BETA

Put localhost on the internet. One command, a public HTTPS URL — no interstitial pages, no session limits.

  • Instant HTTPS subdomain, custom domains with auto TLS
  • WebSockets, gRPC, SSE, HTTP/2 & HTTP/3 passthrough
  • Raw TCP tunnels for databases, SSH, game servers
  • Live request inspector in your panel
Free · Pro from $5/mo Details & pricing

NexShield

BETA

Device-bound API security: only clients you enrolled can call your API. Cryptographic proof, not fingerprint guesswork.

  • HTTP message signatures (RFC 9421) on every request
  • WebAuthn-based device enrolment, browser and mobile
  • HPKE-sealed request bodies for sensitive payloads
  • Device panel: enrol, inspect, revoke in one click
Free 1k devices · self-hosted · pricing at beta Request access

NexMCP

BETA

A managed gateway for AI agents: one endpoint in front of every MCP server your organisation runs.

  • Aggregate N MCP servers behind a single endpoint
  • Auth, per-tool quotas and rate limits
  • Full audit log of every tool call
  • Tool-level routing, SSE streaming support
Free 1 gateway · pricing at beta Join the beta

Sovereign Edge

ENTERPRISE

The whole platform — WAF, gateway, attestation, admin panel — on your own hardware, in your own jurisdiction.

  • Single-binary on-prem install, air-gap friendly
  • Source review under NDA, local-language support
  • Multi-tenant admin panel with audit trail
  • A fraction of the cost of legacy WAF appliances
Annual licence + support Talk to us
the engine

One Rust core under everything.

144,000requests/second proxied on 8 vCPU
+19%faster than nginx as a reverse proxy
+136%faster than Envoy, same box, same test
5.5 MBsingle binary, thread-per-core, no GC
WAF DDoS & rate limiting TLS + ACME auto-certificates HTTP/1.1 · 2 · 3 (QUIC) gRPC & gRPC-Web gRPC ⇄ HTTP transcoding WebSocket & SSE L4 TCP/UDP proxying Kubernetes Ingress & Gateway API Load balancing & session affinity Circuit breaker & retries Response cache & compression JWT · API keys · OAuth2 plugins Client attestation — RFC 9421 · WebAuthn · HPKE MCP gateway & aggregation Native plugin system OpenTelemetry / OTLP tracing Multi-tenant admin panel Hot reload — zero-downtime config Tunnels with per-frame encryption

Every product on this page terminates on this engine — the same one that runs NexLayer's load balancers in production. The benchmark is reproducible: wrk with 8 threads and 256 connections against an nginx backend on the same 8 vCPU box — run the same setup yourself before trusting it.

nextunnel

The free tunnel you relied on got tighter.

As of February 2026, ngrok's free tier lists 1 GB of bandwidth, two-hour sessions and an interstitial page before your visitors reach you. Terms change — check each provider's current plans. We think a tunnel should just work, and stay out of your visitors' way.

NexTunnelngrokCloudflare Tunnel
Free bandwidth10 GB/mo1 GB/moUnmetered
Session limitNone2 hoursNone
Page shown to your visitorsNeverInterstitial on freeNone
SetupOne command, instant subdomainOne commandYour own domain + dashboard config
Paid entry$5/mo$8/moFree, domain required

Comparison based on each provider's publicly listed plans as of February 2026; check their current terms before deciding. Cloudflare Tunnel is genuinely free and good if you already keep a domain on Cloudflare and don't mind the setup — NexTunnel is for the moments you just need a URL, now.

nextunnel pricing

Free where it matters. Cheap where it counts.

Launch pricing — early-access users keep these rates for 12 months after general availability. NexShield and NexMCP pricing opens with their betas.

Free

$0
  • 3 concurrent tunnels
  • 10 GB traffic / month
  • HTTPS subdomain, instantly
  • No session limits, no interstitial
Start free
MOST POPULAR

Pro

$5 /month
  • 10 tunnels, 100 GB / month
  • Custom domains + auto TLS
  • TCP tunnels
  • Reserved subdomains
Get Pro

Team

$19 /month
  • 5 seats, shared tunnels
  • 500 GB / month
  • Password & IP access rules
  • Priority support
Get Team
sovereign edge

Your infrastructure. Your jurisdiction. Our engine.

Banks, telecoms and public-sector teams in Central Asia are being asked to keep traffic and keys inside the country. Legacy WAF appliances cost six figures a year and support arrives in the wrong language and time zone. Sovereign Edge is the full platform — WAF, gateway, TLS, attestation, multi-tenant admin — installed on your hardware, supported locally.

  • On-prem or private-cloud, air-gap friendly single binary
  • Source review under NDA before you commit
  • Local support in Uzbek, Russian and English
  • Pilot deployment first — pay when it proves itself

Request a pilot

Or email us directly at hello@nexlayer.app.