
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Transform shell scripts into production-ready APIs with REST, WebRTC, and gRPC support
Transform shell scripts into production-ready APIs with REST, WebRTC, and gRPC support
🚀 Quick Start | 📖 Documentation | 💡 Examples | 🤝 Contributing | 📄 License
# Install using pip
pip install shapi
# Or install from source
git clone https://github.com/wronai/shapi.git
cd shapi
pip install -e .
# Serve a script directly
shapi serve ./examples/echo.sh --port 8000
# Or run it as a daemon
shapi serve ./examples/echo.sh --name echo-service --port 8000 --daemon
# List running services
shapi service list
# List all running services
shapi service list
# Stop a service
shapi service stop service-name
# Restart a service
shapi service restart service-name
# Force stop if port is in use
shapi serve ./script.sh --port 8000 --force
# Generate complete service structure with Docker and tests
shapi generate /path/to/your/script.sh --name my-service
# Navigate to the generated service
cd my-service
# Install dependencies and run
pip install -r requirements.txt
python main.py
ShAPI comes with several example scripts that demonstrate its capabilities:
ls.sh
- List directory contentsps.sh
- Show running processesdf.sh
- Display disk usagefree.sh
- Show memory usagewhoami.sh
- Display current user informationdate.sh
- Show current date/time with formattingecho.sh
- Echo back input textSee the examples documentation for detailed usage and API examples.
my-service/
├── main.py # FastAPI service
├── Dockerfile # Container configuration
├── docker-compose.yml # Multi-service setup
├── Makefile # Build and deployment commands
├── requirements.txt # Python dependencies
├── test_service.py # Test suite
├── ansible/ # Infrastructure tests
│ └── test.yml
└── script.sh # Your original script
#!/bin/bash
# hello.sh
echo "Hello, $1!"
Generate the service:
shapi generate hello.sh --name greeting-service
cd greeting-service
python main.py
Access your API:
GET http://localhost:8000/health
GET http://localhost:8000/docs
POST http://localhost:8000/run
Every generated service includes:
GET /health
- Service health checkGET /info
- Script informationPOST /run
- Execute script (sync/async)GET /status/{task_id}
- Check async task statusGET /docs
- Interactive API documentation# Start multiple services on different ports
shapi serve ./service1.sh --name service1 --port 8000 --daemon
shapi serve ./service2.sh --name service2 --port 8001 --daemon
# List all running services
shapi service list
# Output:
# ┏━━━━━━━━━━━┳━━━━━━━━┳━━━━━━┳━━━━━━━━━┳━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┓
# ┃ Name ┃ PID ┃ Port ┃ Status ┃ Uptime ┃ Script ┃
# ┡━━━━━━━━━━━╇━━━━━━━━╇━━━━━━╇━━━━━━━━━╇━━━━━━━━━━╇━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┩
# │ service1 │ 12345 │ 8000 │ running │ 00:05:32 │ /path/to/service1.sh │
# │ service2 │ 12346 │ 8001 │ running │ 00:02:15 │ /path/to/service2.sh │
# └───────────┴────────┴──────┴─────────┴──────────┴─────────────────────────────────┘
# Stop a service
shapi service stop service1
# Force stop a service if it's not responding
shapi service stop service2 --force
# Restart a service
shapi service restart service1
# Start a service with automatic port conflict resolution
shapi serve ./service.sh --port 8000 --force
# The --force flag will automatically stop any service using port 8000
POST /run
{
"parameters": {
"name": "World",
"verbose": true
},
"async_execution": false
}
# Build and run with Docker
make docker-build
make docker-run
# Or use docker-compose
docker-compose up -d
# Run tests
make test
# Or directly
python -m pytest test_service.py -v
Create a config.yaml
file for advanced configuration:
service:
name: "my-advanced-service"
description: "Advanced shell script API"
version: "1.0.0"
protocols:
rest: true
grpc: true
webrtc: true
security:
auth_required: false
cors_enabled: true
monitoring:
health_check_interval: 30
metrics_enabled: true
# Generate service structure
shapi generate hello.sh --name service-name --output ./output
# Serve script directly
shapi serve hello.sh --host 0.0.0.0 --port 8008
# Test generated service
shapi test ./generated/service-name
# Build Docker image
shapi build ./generated/service-name
# Enable async execution for long-running scripts
response = requests.post("/run", json={
"parameters": {"input": "data"},
"async_execution": True
})
task_id = response.json()["task_id"]
# Check status
status = requests.get(f"/status/{task_id}")
The generated service supports multiple communication protocols:
# Using Makefile
make deploy
# Manual deployment
docker-compose up -d
Contributions are welcome! Please see our Contributing Guidelines.
Apache License 2.0 - see LICENSE file for details.
shapi - From shell to service in seconds! 🚀
"""
We welcome contributions to shapi! This document provides guidelines for contributing.
git clone https://github.com/wronai/shapi.git
cd shapi
python -m venv venv
source venv/bin/activate # On Windows: venv\Scripts\activate
pip install -e .[dev]
# Run all tests
pytest
# Run with coverage
pytest --cov=shapi
# Run specific test file
pytest tests/test_core.py -v
We use black for code formatting and flake8 for linting:
# Format code
black shapi/
# Check linting
flake8 shapi/
Please use the GitHub issue tracker to report bugs or request features. """
FAQs
Transform shell scripts into production-ready APIs with REST, WebRTC, and gRPC support
We found that shapi demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.