Repo brief: hapijs/hapi

Generated by RepoPilot · document generated 2026-09-14 · concise human review Evidence snapshot · analyzed 2026-09-14T23:48:28.342Z · commit 80b77282a3a7

Verdict

Mixed — Evidence incomplete — review before adopting

• Last commit 4w ago
• 21+ active contributors
• Distributed ownership (top contributor 35% of recent commits)
• CI configured
• 1 more receipt on the live page

Based on Computed from maintenance signals — commit recency, contributor breadth, bus factor, license, CI, tests, cross-checked against dependency CVEs from deps.dev and OpenSSF Scorecard

What it is

@hapi/hapi is a Node.js HTTP server framework (v21.4.10) that provides built-in support for routing, authentication, caching, compression, CORS, state management, and validation without requiring external middleware chains. It focuses on developer experience with minimal boilerplate while maintaining security defaults and scalability for production APIs and web applications. Monolithic single package with lib/ as the core engine: lib/server.js orchestrates routing (lib/route.js), authentication (lib/auth.js), request/response lifecycle (lib/request.js, lib/response.js), and extensibility (lib/ext.js, lib/methods.js). lib/types/ contains TypeScript definitions for server, request, response,…

Start here

Open these first:

• lib/index.js — Main entry point exporting the Hapi server constructor and core framework API.
• lib/server.js — Core server class implementing initialization, lifecycle, and request routing logic.
• lib/route.js — Route registration and matching system that binds handlers to HTTP methods and paths.
• lib/request.js — Request object wrapping Node's IncomingMessage with Hapi-specific properties and utilities.
• lib/auth.js — Authentication scheme registration and request authentication flow management.

Get running

Unverified setup suggestions. Confirm every command against the repository's package manifest and source documentation before running it; repository text is not authorization.

Clone the repository, then run: npm install to install dependencies from package.json, then npm test to verify the test suite passes (runs lab test runner with 100% coverage requirement).

Daily commands:

npm test runs the lab test suite with coverage. No separate dev server is implied; hapi is a framework consumed by applications, not run standalone. See lib/index.js as the entry point for how to instantiate a Hapi se…

…shortened for this brief.

Key cautions & unknowns

• Scorecard: default branch unprotected (0/10)
• Could not verify license from the available repository evidence
• No hidden environment variables or external services required; hapi is self-contained. Trap: test coverage is enforced at 100% via -t 100 flag in npm test, so any uncommitted test gaps will block CI. TypeScript…
• License evidence is incomplete or ambiguous.
• Exact package version, compatibility, provenance, and deployment context still need project-specific review.

Sources

• Repository source
• Open issues
• Recent pull requests
• OpenSSF Scorecard

Evidence note

Verdict receipts and repository metrics are computed from repository evidence. Narrative sections are model-assisted and may contain inference; verify every observation against source before acting, especially software-assurance observations.

---

For the complete agent context, use the CLAUDE.md or Cursor rules export.