
Security News
Axios Maintainer Confirms Social Engineering Attack Behind npm Compromise
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.
OpenAPI 3 and 3.1 schema generator and validator for Hono, itty-router and more!
OpenAPI 3 and 3.1 schema generator and validator for Hono, itty-router and more!
Documentation: chanfana.pages.dev
Source Code: github.com/cloudflare/chanfana
chanfana (previously known as itty-router-openapi) is a library that adds OpenAPI schema generation and validation to any router ( Hono, itty-router, etc), meant to be a powerful and lightweight library for Cloudflare Workers but runs on any runtime supported by the base router.
The key features are:
Chanfana provides AI coding assistant skills to help you build OpenAPI endpoints faster. Install them using npx skills:
npx skills install cloudflare/chanfana
Available skills:
Or scaffold it locally with the create-cloudflare CLI:
npm create cloudflare@latest -- --template https://github.com/cloudflare/chanfana/tree/main/template
The template includes a complete Task API with Hono, D1, and Zod v4 — full CRUD endpoints, a custom endpoint example, integration tests, and auto-generated docs at /api/docs.
See template/README.md for full setup instructions.
npm i chanfana --save
Chanfana includes a CLI tool to help you extract the OpenAPI schema from your Cloudflare Worker project. This is useful for generating a static schema file, for example, in CI/CD pipelines.
The basic command is:
npx chanfana
This will start your worker using wrangler dev, fetch the schema from /openapi.json, and save it to schema.json.
For more details on options and usage, please refer to the CLI Documentation.
import { fromHono, OpenAPIRoute } from 'chanfana'
import { Hono } from 'hono'
import { z } from 'zod'
export type Env = {
// Example bindings
DB: D1Database
BUCKET: R2Bucket
}
export type AppContext = Context<{ Bindings: Env }>
export class GetPageNumber extends OpenAPIRoute {
schema = {
request: {
params: z.object({
id: z.string().min(2).max(10),
}),
query: z.object({
page: z.number().int().min(0).max(20),
}),
},
}
async handle(c: AppContext) {
const data = await this.getValidatedData<typeof this.schema>()
return c.json({
id: data.params.id,
page: data.query.page,
})
}
}
// Start a Hono app
const app = new Hono<{ Bindings: Env }>()
// Setup OpenAPI registry
const openapi = fromHono(app)
// Register OpenAPI endpoints (this will also register the routes in Hono)
openapi.get('/entry/:id', GetPageNumber)
// Export the Hono app
export default app
chanfana aims to be at the core of new APIs built using Workers and define a pattern to allow everyone to have an OpenAPI-compliant schema without worrying about implementation details or reinventing the wheel.
chanfana is considered stable and production ready and is being used with the Radar 2.0 public API and many other Cloudflare products.
You can also talk to us in the Cloudflare Community or the Radar Discord Channel
FAQs
OpenAPI 3 and 3.1 schema generator and validator for Hono, itty-router and more!
We found that chanfana demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.