Gina

npm version npm downloads GitHub stars Tests Socket Badge Node.js >= 22 Bun >= 1.2 License: MIT

Documentation: gina.io/docs · Issues: GitHub · Changelog: CHANGELOG.md

Node.js MVC framework with built-in HTTP/2, multi-bundle architecture, and scope-based data isolation — no Express dependency.

• HTTP/2 first. Built-in isaac server with TLS, h2c, ALPN, HTTP/1.1 fallback, and full CVE hardening (Rapid Reset, CONTINUATION flood, RST flood, HPACK bomb) — all on by default.
• Multi-bundle. One project hosts multiple independent bundles (API, web, admin, …). Each bundle has its own routing, controllers, models, and config. Share code via the project layer.
• Scope isolation. Run local, beta, and production from the same codebase. Scopes propagate through routing, config interpolation, and data (every DB record is stamped with _scope).

Features

Quick start

npm install -g gina@latest --prefix=~/.npm-global   # or, on the Bun runtime: bun add -g gina
gina project:add @myproject --path=$(pwd)/myproject
gina bundle:add api @myproject
gina bundle:start api @myproject
open https://localhost:3100

npm 12+ blocks install scripts by default, and gina's post-install bootstraps ~/.gina and the framework dependencies. Install with npm install -g gina@latest --allow-scripts=gina, or allow it once for all global installs with npm config set allow-scripts=gina --location=user. (Not needed on npm ≤ 11.)

What's in 0.5.17

• Fixed — npm install -g gina works under the npm 12 --allow-scripts=gina remedy. With the npm 12 install-script allowance set (the --allow-scripts=gina flag, or npm config set allow-scripts=gina --location=user), the global install no longer fails with EALLOWSCRIPTS: the nested framework-dependency install inside post-install now drops the inherited npm_config_allow_scripts for its duration (those dependencies carry no install scripts, so nothing is lost). This makes 0.5.17 the first Gina version installable on npm 12, where install scripts are blocked by default and the allowance is required. (#B106)
• Fixed — stale project cleanup is reliable. gina project:rm @<project> --force (the :rm alias) now removes the registration instead of erroring, and neither project:remove nor project:rm --force crashes with ENOENT when a stale project's path can no longer be created (a top-level path, or one under a read-only parent) — it goes straight to registry-only removal, cleaning ~/.gina/projects.json, its state-store mirror, and the project's port assignments without resurrecting an empty skeleton directory. (#B104 / #B105)
• Fixed — gina bundle:start honours a bundle's configured default scope. A typo in the scope-resolution expression returned an undefined property, so a bundle that declared a default scope in its manifest started with an undefined scope; the command now reads the correct property. (Bundles with no configured default scope were unaffected — they already fell back to the framework default scope.)

See the full Changelog and Roadmap.

Documentation

Full installation guide, tutorials, configuration reference, and API docs at gina.io/docs.

• Getting started
• Guides
• CLI reference
• Configuration reference
• Security & CVE compliance

Ecosystem

Governance

Gina is co-authored by Martin Luther ETOUMAN NDAMBWE (Rhinostone) and Fabrice DELANEAU (fdelaneau.com). Final decisions on direction, API design, and releases rest with Martin Luther. Community contributions and RFCs are welcome and taken seriously. See GOVERNANCE.md for details.

License (MIT)

Copyright © 2009-2026 Rhinostone

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.