Gathering detailed insights and metrics for @tsoa/cli
Gathering detailed insights and metrics for @tsoa/cli
Build OpenAPI-compliant REST APIs using TypeScript and Node
Installations
npm install @tsoa/cliDeveloper Guide
BETA
Typescript
No
Module System
CommonJS
Min. Node Version
>=18.0.0
Node Version
22.12.0
NPM Version
lerna/8.1.9/node@v22.12.0+x64 (linux)
Releases
98
Languages
3
TypeScript
Handlebars
JavaScript
TypeScript (96.56%)
Handlebars (2.22%)
JavaScript (1.22%)
Developer
lukeautry
Download Statistics
Total Downloads
0
Last Day
0
Last Week
0
Last Month
0
Last Year
0
GitHub Statistics
MIT License
3,823 Stars
1,958 Commits
522 Forks
26 Watchers
31 Branches
181 Contributors
Updated on Jul 12, 2025
Maintainers
2
Package Meta Information
Latest Version
6.6.0
Package Id
@tsoa/cli@6.6.0
Unpacked Size
533.97 kB
Size
95.40 kB
File Count
117
NPM Version
lerna/8.1.9/node@v22.12.0+x64 (linux)
Node Version
22.12.0
Published on
Dec 08, 2024
Total Downloads
Cumulative downloads
Total Downloads
NaN
Last Day
0%
NaN
Compared to previous day
Last Week
0%
NaN
Compared to previous week
Last Month
0%
NaN
Compared to previous month
Last Year
0%
NaN
Compared to previous year
Weekly Downloads
Monthly Downloads
Yearly Downloads
Goal
- TypeScript controllers and models as the single source of truth for your API
- A valid OpenAPI (formerly Swagger) spec (2.0 or 3.0 if you choose 😍) is generated from your controllers and models, including:
- Paths (e.g. GET /users)
- Definitions based on TypeScript interfaces (models)
- Parameters/model properties marked as required or optional based on TypeScript (e.g. myProperty?: string is optional in the OpenAPI spec)
- jsDoc supported for object descriptions (most other metadata can be inferred from TypeScript types)
- Routes are generated for middleware of choice
- Express, Hapi, and Koa currently supported, other middleware can be supported using a simple handlebars template
- Validate request payloads
Philosophy
- Rely on TypeScript type annotations to generate API metadata if possible
- If regular type annotations aren't an appropriate way to express metadata, use decorators
- Use jsdoc for pure text metadata (e.g. endpoint descriptions)
- Minimize boilerplate
- Models are best represented by interfaces (pure data structures), but can also be represented by classes
- Runtime validation of tsoa should behave as closely as possible to the specifications that the generated OpenAPI 2/3 schema describes. Any differences in validation logic are clarified by logging warnings during the generation of the OpenAPI Specification (OAS) and/or the routes.
- Please note that by enabling OpenAPI 3 you minimize the chances of divergent validation logic since OpenAPI 3 has a more expressive schema syntax.
Getting Started
Examples
Check out the guides
See example controllers in the tests
See example models in the tests
Help wanted
Contributing code
To contribute (via a PR), please first see the Contributing Guide
Becoming a maintainer
tsoa wants additional maintainers! The library has increased in popularity and has quite a lot of pull requests and issues. Please post in this issue if you're willing to take on the role of a maintainer.
No vulnerabilities found.
Reason
no dangerous workflow patterns detected
Reason
no binaries found in the repo
Reason
license file detected
Details
- Info: project has a license file: LICENSE:0
- Info: FSF or OSI recognized license: MIT License: LICENSE:0
Reason
security policy file detected
Details
- Info: security policy file detected: SECURITY.md:1
- Info: Found linked content: SECURITY.md:1
- Warn: One or no descriptive hints of disclosure, vulnerability, and/or timelines in security policy
- Info: Found text in security policy: SECURITY.md:1
Reason
Found 9/14 approved changesets -- score normalized to 6
Reason
3 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 2
Reason
detected GitHub workflow tokens with excessive permissions
Details
- Warn: no topLevel permission defined: .github/workflows/closeStaleIssuesAndPRs.yml:1
- Warn: no topLevel permission defined: .github/workflows/runTestsOnPush.yml:1
- Warn: no topLevel permission defined: .github/workflows/welcome-first-time-contributors.yml:1
- Info: no jobLevel write permissions found
Reason
no effort to earn an OpenSSF best practices badge detected
Reason
dependency not pinned by hash detected -- score normalized to 0
Details
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/closeStaleIssuesAndPRs.yml:10: update your workflow using https://app.stepsecurity.io/secureworkflow/lukeautry/tsoa/closeStaleIssuesAndPRs.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/runTestsOnPush.yml:14: update your workflow using https://app.stepsecurity.io/secureworkflow/lukeautry/tsoa/runTestsOnPush.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/runTestsOnPush.yml:17: update your workflow using https://app.stepsecurity.io/secureworkflow/lukeautry/tsoa/runTestsOnPush.yml/master?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/runTestsOnPush.yml:26: update your workflow using https://app.stepsecurity.io/secureworkflow/lukeautry/tsoa/runTestsOnPush.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/welcome-first-time-contributors.yml:15: update your workflow using https://app.stepsecurity.io/secureworkflow/lukeautry/tsoa/welcome-first-time-contributors.yml/master?enable=pin
- Warn: npmCommand not pinned by hash: .github/workflows/runTestsOnPush.yml:24
- Info: 0 out of 4 GitHub-owned GitHubAction dependencies pinned
- Info: 0 out of 1 third-party GitHubAction dependencies pinned
- Info: 0 out of 1 npmCommand dependencies pinned
Reason
project is not fuzzed
Details
- Warn: no fuzzer integrations found
Reason
branch protection not enabled on development/release branches
Details
- Warn: branch protection not enabled for branch 'master'
Reason
SAST tool is not run on all commits -- score normalized to 0
Details
- Warn: 0 commits out of 25 are checked with a SAST tool
Reason
14 existing vulnerabilities detected
Details
- Warn: Project is vulnerable to: GHSA-968p-4wvh-cqc8
- Warn: Project is vulnerable to: GHSA-h5c3-5r3r-rr8q
- Warn: Project is vulnerable to: GHSA-rmvr-2pp2-xj38
- Warn: Project is vulnerable to: GHSA-xx4v-prfh-6cgc
- Warn: Project is vulnerable to: GHSA-qq4x-c6h6-rfxh
- Warn: Project is vulnerable to: GHSA-5pq3-h73f-66hr
- Warn: Project is vulnerable to: GHSA-qc59-cxj2-c2w4
- Warn: Project is vulnerable to: GHSA-jr5f-v2jv-69x6
- Warn: Project is vulnerable to: GHSA-v6h2-p8h4-qcjw
- Warn: Project is vulnerable to: GHSA-75v8-2h7p-7m2m
- Warn: Project is vulnerable to: GHSA-x2rg-q646-7m2v
- Warn: Project is vulnerable to: GHSA-44fp-w29j-9vj5
- Warn: Project is vulnerable to: GHSA-4pg4-qvpc-4q3h
- Warn: Project is vulnerable to: GHSA-g5hg-p3ph-g8qg
Score
3.8
/10
Last Scanned on 2025-07-07
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.
Learn More