# Ultraviolet: a service worker web proxy for controlled sandboxes > Ultraviolet is a JavaScript web proxy that intercepts HTTP requests in the browser through a service worker, following the TompHTTP specifications, with client-side configuration and leak prevention. The repository says plainly that it is no longer maintained and has been superseded by Scramjet, which is the first fact an adopter needs. **titaniumnetwork-dev/Ultraviolet** — A sophisticated proxy used for evading internet censorship or accessing websites in a controlled sandbox using the power of service-workers. Succeeded by Scramjet. - Repository: https://github.com/titaniumnetwork-dev/Ultraviolet - Website: https://docs.titaniumnetwork.org/proxies/ultraviolet - Stars: 829 · Forks: 6,235 - Language: JavaScript - License: AGPL-3.0 - Published: 2026-10-20 · Updated: 2026-10-20 · Language: en - Canonical page: https://hysenlabs.com/projects/titaniumnetwork-dev-ultraviolet ## What Ultraviolet does and what it is not Ultraviolet is described as a highly advanced web proxy used for evading internet censorship or accessing websites in a controlled sandbox. The mechanism it uses is stated plainly in the README: it intercepts HTTP requests with a service worker, while adhering to the TompHTTP specifications. That placement is the whole design. A conventional proxy sits between a client and a destination and forwards traffic. Ultraviolet sits inside the browser, where a service worker can intercept a page's own requests and rewrite them, and the destination sees traffic arriving from the user's connection rather than from a server. That is why the service worker is a load-bearing part of the project rather than an implementation detail, and why the feature list mentions client-side configuration through service workers. The TompHTTP specification is the other load-bearing piece. It defines how a service-worker based proxy should rewrite requests and responses so that a proxied site behaves as if it were being served directly, which is a hard problem involving cookies, redirects, relative URLs and the response headers a site expects. The audience is therefore two different groups. One is people who want to reach a site that is blocked where they are. The other, and the one the README gives equal weight to, is people building a controlled environment, such as an embedded browser inside an application, where the point is that the user can browse the real web but the application controls the environment. The second use is the more ordinary engineering use of the tool. ## The feature list, read closely The features paragraph in the README is a run-on list, and a few of the items deserve unpacking because they say more about the design than they appear to. CAPTCHA and hCAPTCHA support is listed. This is the feature that distinguishes Ultraviolet from simpler service worker proxies, and it is also the one that raises the most questions about how a deployment handles the traffic involved. The README does not describe the mechanism, so a reader cannot tell from the documentation whether it is a solving service, a token relay or something else. URL encoding settings are described as being for added security, which refers to how the target URL is represented before it is requested, and it is the kind of knob that matters if a target site is picky about what it receives. Leak prevention is listed as a feature, and it is the one that matters most in a sandbox context. A web proxy that leaks means the destination learns the real client address or the real referrer, and a deployment that promises a controlled environment has to promise that the environment is actually controlled. Blacklist settings are described as being for easy hosting, so an operator can restrict which destinations the proxy will reach. Client-side configuration through service workers is the mechanism for pushing that configuration out. The README also claims high speed compared to other web proxies, and improved resource usage and speed for setups with a dedicated server instance. Both of these are relative claims, and the documentation gives no measurements, so they are best read as design intentions rather than as numbers you can check. ## bare-mux and the move to version 3 The single most important operational detail in the README is about bare-mux, and it is easy to miss because it sits in a section headed Older Ultraviolet versions. Starting from v3, Ultraviolet uses bare-mux, a library that allows you to switch out your Bare client. Bare is a JavaScript runtime that provides POSIX-like system calls in the browser, and a proxy that wants to make arbitrary requests needs something like it, because the browser's own fetch API is constrained by the same-origin policy. bare-mux abstracts over which Bare implementation is in use, so it can be swapped. The consequence for an operator is a compatibility constraint. If you are on an older Ultraviolet, the README encourages you to update, and points to a wiki guide for updating from any version to v3. If you are not going to do either, the README says you can install an outdated and unsupported version. ```sh npm install @titaniumnetwork-dev/ultraviolet@1 ``` That last line is the escape hatch, and it is deliberately marked as unsupported. The releases show the same progression, with v3.2.7 from 2024-08-01, v3.2.8 from 2026-06-06 and v3.2.10-headers from 2026-07-05, so the 3.2 line is where the active work was in 2026 while a 1.x version remains installable for anyone stuck on the older architecture. The bare-mux dependency appears in the package.json at version 2.1.7 or later, alongside the parse5 HTML parser, meriyah as a JavaScript parser, astring as a JavaScript generator, set-cookie-parser and idb for IndexedDB. That set of dependencies is a reasonable map of what a service worker proxy has to do: parse and rewrite HTML, parse and rewrite JavaScript, handle cookies and keep state. ## Building the package and what it contains The package is published to npm as @titaniumnetwork-dev/ultraviolet, and the package.json describes it as a highly sophisticated proxy used for evading internet censorship or accessing websites in a controlled sandbox using the power of service workers. The build is a single script. ```bash npm run build npm run dev ``` The build script runs node build.js, and the dev variant adds a --dev flag. esbuild is the bundler in the dev dependencies, along with rimraf for cleaning and prettier and eslint for the code style tasks, and the lint and format scripts are wired to those two tools directly. The published files list is dist, lib, uv.d.ts and client.d.ts, with lib/index.cjs as the main entry point and the package marked as an ES module. The type declarations are worth a note. uv.d.ts and client.d.ts sit at the top level of the repository and are shipped in the package, so a consuming project gets the types for the Ultraviolet client interface and the service worker side separately. That is a deliberate split, and it matches the architecture, where the client and the worker are two pieces that meet over a messaging channel rather than one bundle. The repository also carries a CHANGELOG.md, and the README says changes are documented there, plus a LICENSE file at the root and an .eslintrc-era eslint.config.mjs for the flat config ESLint expects in recent versions. The pnpm-lock.yaml tells you pnpm is the expected package manager for development, even though the npm install command in the README is the documented way to get the older version. ## Where Ultraviolet is the wrong tool The first limitation is the one the README puts in a caution box at the very top. The project is not really maintained anymore, and it has been superseded by Scramjet, with a note to check that before opening an issue. An example application setup is pointed at in the Scramjet-App repository. The last push was on 2026-07-05, so the code is not archived, but the maintainers have said in writing that they have moved on. That is decisive for most adopters. A proxy is security-sensitive infrastructure, and a component that intercepts every request a page makes is exactly the kind of component where an unpatched dependency or an unnoticed bug matters. Adopting an explicitly unmaintained dependency into that position is a decision that has to be made deliberately, with the successor project in view. The second limitation is that this repository cannot be deployed on its own. The README says it can be built but cannot be deployed to any services, and points to the Ultraviolet-App repository for a complete and customisable setup that you can deploy. So the deployable artefact is a separate project, which means adopting Ultraviolet means adopting and configuring two repositories. The third is the dependency on a specific interception model. A service worker proxy only works in a browser, only for pages the service worker controls, and only over HTTPS or on localhost. It cannot be used from a native client, and it cannot be used as a system-wide proxy for a desktop. The fourth is the licence ambiguity, which is worth resolving before anything ships. The repository description records AGPL-3.0, while the package.json inside the same repository declares a license of MIT. Those are different obligations, with AGPL covering network use. Which one governs the published npm package is not something the README settles, so an organisation deploying this needs to ask. The fifth is that the supported site list is a claim rather than a guarantee. Google, YouTube, Spotify, Discord, Reddit, GeForce NOW and now.gg are named as supported, and the sites most likely to be listed are exactly the ones that change their anti-automation behaviour regularly. ## Ultraviolet compared with Scramjet and with the other web proxy projects Scramjet is the successor and the comparison the README itself directs you to, and the difference in approach is that Scramjet is presented as a complete application setup rather than only a library. The README points at Scramjet-App as an example setup for Scramjet, and at Ultraviolet-App for the same thing here, so the two projects are comparable in shape, with the newer one being the one carrying the work. The other names in the ecosystem are the ones Ultraviolet is used by or that came from the same circle. Holy Unblocker LTS, Alu, Incognito, Nebula, AnuraOS, Terbium, and Metallic are all listed as projects using Ultraviolet. Nebula and AnuraOS in particular are operating system and browser distribution projects where a web proxy is a component, and that tells you the real use case: a browser or appliance that ships with a proxy built in, where the proxy is part of the product rather than a tool the user installs. A third comparison is with a traditional server-side proxy such as a Squid instance or a commercial web proxy service. The difference in approach is the position in the stack and the consequences. A server-side proxy is a separate machine, it sees and can alter every byte, it has to be operated and secured as a service, and it can be blocked as an infrastructure provider. A service worker proxy runs inside the browser, needs no server of its own, and the destination sees traffic from the user's own connection, which is precisely what makes it useful where a server-side proxy would be blocked. The cost of that same property is that the interception happens with the user's own network position and identity, which is why the leak prevention feature exists and why it deserves attention in any deployment. ## Licence, maintenance state and what to check first The licence field on the repository records AGPL-3.0, and the LICENSE file sits at the root, while the package.json in the same tree declares MIT. Because the package is published from this repository and the two declarations disagree, the practical first step for anyone considering deployment is to ask the maintainers which one applies to the distributed package. The maintenance state is unambiguous. The README's caution box says the project is not really maintained anymore and has been superseded by Scramjet. The recent releases are v3.2.10-headers from 2026-07-05, v3.2.8 from 2026-06-06 and v3.2.7 from 2024-08-01, so the last publish was a patch in the 3.2 line in mid 2026, and the last push was on the same day. Three things are worth checking before you build on it. First, whether you actually want Ultraviolet or Scramjet. The README names Scramjet as the successor and an example setup exists for it, and the ecosystem projects listed as using Ultraviolet are the natural place to look for how the two are used in practice. Second, the version. If you are on the 3.x line you are on bare-mux, and the wiki has an upgrading guide from any version to v3. If you are on 1.x you are on the old architecture and the README describes that version as outdated and unsupported. Third, the deployment path. This repository is a library and does not deploy itself, so the Ultraviolet-App repository is where a working setup comes from, and the configuration for leak prevention, blacklists and the service worker side is set there. For anyone reading this who wants to try it, the honest summary is that Ultraviolet is a well-built and widely deployed piece of work that its authors have deliberately retired in favour of a successor. ## Conclusion Ultraviolet fits someone who needs a browser-based proxy for a controlled sandbox, such as an in-app browser or a kiosk, and who wants the interception logic in a service worker rather than on a server. It is the wrong choice for a new deployment, because the README states the project is no longer maintained and points to Scramjet as its successor, and the wrong choice for anyone who needs a proxy they can rely on for daily use. Before adopting it, read the upgrading guide for the move to v3, since versions from v3 onward depend on bare-mux, and check the licence fields, because the repository records AGPL-3.0 while the published package metadata says MIT. ## FAQ ### What is Ultraviolet and how does it intercept traffic? It is a JavaScript web proxy that intercepts HTTP requests with a service worker while adhering to the TompHTTP specifications. The service worker rewrites requests inside the browser rather than forwarding them from a separate server. ### Is Ultraviolet still maintained? No. The README carries a caution that the project is not really maintained anymore and has been superseded by Scramjet, with a note to check that before opening an issue. The last push was on 2026-07-05 and the most recent release is v3.2.10-headers from the same day. ### What is bare-mux and why does it matter for Ultraviolet? Starting from v3, Ultraviolet uses bare-mux, a library that allows you to switch out your Bare client. The README points to a wiki guide for updating from any version to v3, and older versions can still be installed with npm install @titaniumnetwork-dev/ultraviolet@1, which the README describes as outdated and unsupported. ### How do I deploy Ultraviolet? This repository can be built but cannot be deployed to any services, according to the README. A complete and customisable setup that you can deploy is in the Ultraviolet-App repository. ### Which licence applies to Ultraviolet? The repository description records AGPL-3.0 and there is a LICENSE file at the root, while the package.json inside the same repository declares MIT. The two declarations disagree, so the applicable terms for the published package have to be confirmed with the maintainers. ### How do I build the Ultraviolet package from source? Run npm run build, which invokes node build.js, and npm run dev for a development build. The published files are dist, lib, uv.d.ts and client.d.ts, and the bundler in use is esbuild. ## Sources - [License: AGPL-3.0](https://github.com/titaniumnetwork-dev/Ultraviolet/blob/main/LICENSE) - [Project website](https://docs.titaniumnetwork.org/proxies/ultraviolet) - [README](https://github.com/titaniumnetwork-dev/Ultraviolet/blob/main/README.md) - [Releases](https://github.com/titaniumnetwork-dev/Ultraviolet/releases) - [titaniumnetwork-dev/Ultraviolet on GitHub](https://github.com/titaniumnetwork-dev/Ultraviolet) --- Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/titaniumnetwork-dev-ultraviolet