Open-source alternatives to Pyramid

This project is a comprehensive security suite and knowledge base focused on the engineering and construction of trustworthy digital and physical systems. It provides a systematic framework for security engineering design, covering the establishment of high-assurance architectures and the implementation of security models that govern how a system achieves its safety goals. The project is distinguished by its focus on formal assurance and adversarial deterrence. It includes methodologies for creating security assurance cases and proofs to verify system trustworthiness, alongside economic and t

GAM is a command-line tool for administering Google Workspace and Cloud Identity. It translates command-line arguments into structured API calls, enabling administrators to manage users, groups, organizational units, and domain settings across a Google Workspace environment. The tool handles authentication through OAuth2 flows, service accounts, and workload identity federation, and supports multi-tenant configurations for managing multiple domains or cloud projects from a single installation. GAM distinguishes itself through its batch processing and automation capabilities. It can process la

mcp-agent is a framework for building AI agents that integrate with Model Context Protocol servers to execute tools and access data. It functions as a multi-agent orchestrator and protocol-compliant server, enabling the creation of agents that can discover and invoke tools from connected external servers. The project distinguishes itself through a durable workflow engine that supports long-running tasks capable of pausing, resuming, and surviving restarts. It implements complex orchestration patterns, including iterative evaluator-optimizer loops, hierarchical workflow nesting, and specialist

Wagtail is an open-source content management system built on the Django web framework. It provides a structured, tree-based approach to content modeling, allowing developers to define custom page types and reusable content components that are managed through a highly customizable administrative interface. The platform distinguishes itself through its flexible, block-based content composition system, which enables editors to assemble complex page layouts dynamically. It also offers robust support for multi-site and multi-lingual environments, allowing organizations to manage distinct websites

Hug is a Python API framework used for building web services by mapping functions to HTTP endpoints via decorators and type annotations. It functions as a type-based validator that automatically converts and validates incoming request data based on Python type hints and serves as a WSGI-compliant web framework for deployment on production servers. The project is distinguished by its ability to automatically generate API specifications and user-facing documentation derived from function signatures. It further extends the utility of internal logic by exposing functions as terminal commands thro

This project is a web application security standard and vulnerability framework. It provides a comprehensive list of the most critical security risks facing web applications, paired with technical guidance and a structured methodology for identifying and mitigating these flaws. The framework functions as a secure coding guide and a risk assessment methodology, offering a standardized approach to prioritizing vulnerabilities based on their potential impact and likelihood of exploitation. It defines architectural patterns and technical recommendations to help developers implement defense in dep

Robyn is a high-performance asynchronous web framework and server for Python that utilizes a Rust-powered runtime to execute code. It functions as an asynchronous Python web server designed to handle many concurrent requests efficiently through a multithreaded execution model. The project includes specialized capabilities for AI agent request routing, managing communication between agents and external tools. It also serves as a WebSocket communication server, maintaining persistent bidirectional channels for real-time data exchange. The framework covers a broad range of web infrastructure, i

Bottle is a lightweight Python web micro-framework and template engine. It functions as a WSGI web framework that routes HTTP requests to Python functions to generate dynamic content. The framework is distributed as a single Python file with no external dependencies. This minimalist distribution model allows for rapid application prototyping and the creation of web services with a small footprint. The project provides capabilities for dynamic request routing, REST API development, and dynamic HTML rendering. It includes a built-in HTTP development server for web application hosting and a plu

This project is a comprehensive security framework for PHP applications, providing a modular system for verifying user identities and enforcing access control policies. It functions as a security middleware that decouples authentication and authorization logic from core application code, allowing for centralized management of user sessions, credentials, and resource access. The framework distinguishes itself through a highly decoupled architecture that separates identity verification from storage mechanisms. It utilizes a strategy-based approach to authentication, enabling developers to imple

LoopBack Next is a Node.js API framework used for building REST and multi-protocol APIs. It functions as an OpenAPI server implementation that can either generate machine-readable specifications from code or produce implementation controllers and models from existing specifications. The framework distinguishes itself through a central dependency injection container and a repository-pattern data access layer. This architecture decouples application logic from component construction and persistent storage, allowing for a pluggable system where data sources and business logic are isolated throug

Iron is a Rust web framework used for building concurrent web applications and APIs. It functions as a concurrent HTTP server and provides a stateless route dispatcher to map incoming URL paths and globs to specific handler functions. The project is centered around a middleware-based request pipeline, which allows the request-response cycle to be extended via plugins and modifiers. It utilizes a thread-safe state container to store shared application memory accessible across all concurrent handlers and middleware. The framework covers broad capability areas including dynamic API routing, sta

Werkzeug is a comprehensive library and toolkit for building WSGI-compliant web applications in Python. It provides the fundamental building blocks for web development, including an HTTP request and response toolkit, a rule-based URL routing engine, and a library for managing the overall web application lifecycle. The project is distinguished by its integrated development suite, which includes a WSGI development server featuring automatic code reloading and a PIN-protected interactive browser debugger for inspecting call stacks. It also includes a specialized WSGI test client that enables the

Symfony Translation is a PHP library and framework component for internationalizing applications. It provides a complete system for managing message catalogs, handling locale-aware string translation, and formatting messages using ICU MessageFormat syntax to support pluralization, gender, and conditional selection. The component organizes translatable strings into named domains, supports key-based lookup that decouples source text from localized versions, and offers deferred rendering through translatable objects that store parameters and render only when output is needed. The library disting

Spring Security is a comprehensive security framework for Java applications that provides authentication and authorization for both web and non-web environments. It functions as an implementation of authentication and authorization logic integrated with the Java runtime environment to protect sensitive resources from unauthorized access. The framework includes toolkits for implementing OpenID Connect and OAuth 2.0 authorization servers and clients, as well as tools for integrating SAML 2.0 identity providers to enable cross-domain single sign-on. It utilizes a role-based access control system

Util is a comprehensive development framework for .NET designed to implement layered architectures and domain driven design. It provides a toolkit of base classes and tools for building full stack applications, specifically focusing on the creation of backend admin frameworks and management interfaces. The project distinguishes itself through a boilerplate generator that produces the necessary types and classes to standardize repetitive architectural patterns. It also includes a micro-frontend orchestrator that enables the splitting of large frontend modules into independent projects for sepa

Vendure is a Node.js e-commerce engine and headless commerce framework built with NestJS and TypeScript. It serves as a multi-channel commerce platform that manages product catalogs, orders, and customers via a strongly typed GraphQL API. The platform is distinguished by its highly extensible architecture, featuring a customizable administrative dashboard where developers can inject custom React components and entity views. It supports multi-channel commerce, allowing the isolation of products, currencies, and regional catalogs from a single unified backend. The engine covers a broad range o

Salvo is a comprehensive Rust web framework for building asynchronous HTTP servers and web applications. It features a hierarchical web router that uses a tree-based structure to map requests to handlers and an asynchronous middleware pipeline based on the onion model for request and response pre- and post-processing. The framework is distinguished by its native support for modern network protocols, including a QUIC-based HTTP/3 implementation alongside HTTP/1 and HTTP/2. It includes an integrated OpenAPI documentation generator that extracts schemas directly from handler signatures to produc

This project is a reference implementation and a collection of code samples for deploying the Apache Shiro security framework within Java-based web applications. It serves as a demonstration for implementing authentication, authorization, and user identity management. The implementation features distributed session management to coordinate user states across multiple server instances for high availability. It also includes samples for third-party OAuth2 integration, enabling external account authentication, and single sign-on support to grant access to multiple related applications. The proj

Oak is a cross-runtime HTTP middleware framework and web server designed to operate across Deno, Node.js, Bun, and Cloudflare Workers. It provides a unified system for building APIs and web servers using a sequential chain of middleware functions and a hierarchical routing engine that maps URL paths to handlers via a nested tree structure. The framework includes a runtime-agnostic serverless adapter that translates diverse cloud provider events into a standard request and response interface. It also features a dedicated WebSocket server implementation for bidirectional real-time communication

FastHTML is a full-stack Python web framework designed for building interactive web applications using pure Python. It functions as an HTMX integration framework and a Python HTML domain-specific language, allowing developers to generate HTML structures using native objects and functions instead of external templating files. The framework is distinguished by its native support for real-time bidirectional communication via WebSockets and Server-Sent Events, enabling server-side updates to be pushed to the browser without full page reloads. It further integrates identity management through OAut

single-spa is a microfrontend orchestration framework designed to compose multiple independent frontend applications into a single interface. It functions as a frontend routing engine and lazy-loading application loader that mounts and unmounts microfrontends based on the current URL without requiring a browser refresh. The framework enables multi-framework frontend integration, allowing different JavaScript frameworks to coexist on one page. This architecture supports distributed frontend development, where separate teams develop and deploy modules independently while maintaining a unified u

Cerbos is an open-source authorization service that provides a centralized, language-agnostic engine for managing access control. It functions as a policy-as-code platform, allowing teams to define, test, and distribute authorization rules using declarative YAML or JSON configurations. By decoupling access logic from application code, it enables consistent permission enforcement across diverse service stacks. The project distinguishes itself through its ability to translate high-level authorization policies into native database query filters. This capability allows applications to enforce sec

Goravel is a full-featured development scaffold and framework for building web applications, REST APIs, and gRPC services using the Go programming language. It implements a model-view-controller architecture and provides a comprehensive toolkit for high-performance remote procedure call servers and clients. The framework is distinguished by its extensive integrated ecosystem, which includes a fluent object-relational mapper for database management and a dedicated command-line interface toolkit for administrative automation and project scaffolding. It features a driver-based service abstractio

Apollo Universal Starter Kit is a full-stack application boilerplate and starter template designed to accelerate cross-platform development across web, mobile, and server environments. It provides a modular architecture that organizes code into independent, self-contained feature directories, combined with a GraphQL-driven data layer and a server-side rendering pipeline to optimize performance and search engine optimization. The project incorporates compile-time code generation tooling to automatically scaffold schemas, resolvers, and components, alongside a real-time subscription engine for

This project provides a comprehensive security framework for PHP applications, designed to manage the entire lifecycle of user authentication and authorization. It functions as a middleware layer that intercepts incoming HTTP requests to enforce security policies, resolve user identities, and maintain persistent sessions across web interactions. The framework distinguishes itself through a modular, event-driven architecture that integrates directly into the application lifecycle. It supports diverse authentication methods, including standard form-based logins, API bearer tokens, and federated

This project is a full-stack web framework built on PHP that provides a structured environment for developing complete web applications. It utilizes a model-view-controller architecture to separate application data, user interface, and control logic, facilitating the management of complex application requirements. The framework distinguishes itself through a suite of integrated tools designed to unify server-side logic and client-side interfaces. It supports isomorphic code execution to maintain consistent behavior across the stack and employs server-side data hydration to populate the client

ABP is an opinionated architectural framework for building enterprise software solutions using .NET and ASP.NET Core. It serves as a structural toolkit for implementing domain-driven design and microservices patterns, providing a modular enterprise architecture where functionality is organized into independent, pluggable modules. The platform is specifically designed to support multi-tenant SaaS architectures, isolating data and configurations for multiple independent customers within a single application instance. It provides enterprise boilerplate infrastructure and pre-configured templates