sirosoft/api

Production-first PHP API framework with built-in debugging, replay, and testing workflows

0.35.1 2026-08-01 04:23 UTC

Requires

• php: >=8.2
• ext-json: *
• ext-mbstring: *
• ext-pdo: *
• sirosoft/core: ^0.35.0

Requires (Dev)

• phpstan/phpstan: ^2.1
• phpunit/phpunit: 11.5.50
• squizlabs/php_codesniffer: ^4.0

Suggests

• ext-curl: Required for HTTP Client (Http::get/post/...)
• ext-fileinfo: Required for file upload MIME type detection
• ext-openssl: Required for Encrypter (AES-256 encryption)
• ext-pdo_mysql: Required for MySQL/MariaDB database driver
• ext-pdo_sqlite: Required for SQLite database driver
• ext-redis: Required for Redis cache, session, and rate limiter drivers
• ext-sockets: Required for queue worker and WebSocket support
• sirosoft/mcp-server: MCP (Model Context Protocol) server for AI tool integration. Install via: composer require sirosoft/mcp-server

MIT

Published on Packagist.org on 2026-08-01 04:23 UTC

README

⚡ Siro

Production-first API framework for PHP.
Debug real production requests from your terminal. Zero dependencies.

Quick start

# Windows
iwr https://sirophp.com/downloads/install.ps1 -UseBasicParsing | iex

# Linux/macOS
curl -sS https://sirophp.com/downloads/install.sh | bash

cd my-api
php siro key:generate && php siro make:auth && php siro migrate && php siro serve

Your API is live — JWT auth, user CRUD, migrations ran. No config files. No Postman.

> Tip: `php siro t GET /api/auth/me` — shorthand for `api:test`, auto-auth.

Debug production in 1 command

php siro api:why POST /api/orders

  Request
  ────────────────────────────────────────────────────────
  Route:    POST /api/orders
  Status:   ✗ 500
  Duration: 143ms

  Middleware Pipeline
    └ ✗ OrderMiddleware       35ms ⚠ slow

  SQL Queries
    └ ⚠ UPDATE inventory      102ms ⚠ slow

  Exception
    PDOException: Deadlock found when trying to get lock

  Possible Cause
    • Concurrent transaction conflict
    • Missing retry logic for deadlock scenarios

  Suggested Fix
    ▸ Wrap transaction in retry loop (max 3 attempts)

  Replay
    [r] php siro replay siro_a1b2c3d4 --force
    [e] php siro replay siro_a1b2c3d4 --edit
    [d] php siro replay siro_a1b2c3d4 --diff
    [t] php siro make:test --from-trace=siro_a1b2c3d4

No other framework — PHP, Node, Go, Rust, Python, Ruby — has this flow.

Build → Ship → Why → Replay → Fix → Test → Regression

# 1. Build — CRUD in 2 seconds
php siro make:crud Product

# 2. Ship — deploy
php siro deploy

# 3. Why — debug production failure
php siro why

# 4. Replay & diff — so sánh trước/sau fix
php siro replay siro_a1b2c3d4 --diff

  === BEFORE ===                    === AFTER ===
  Status: 500                       Status: 200
  Body: {"success":false}           Body: {"success":true,"data":{"id":100}}
                                    ✅ Fixed!

# 5. Fix — watch mode, auto re-test
php siro fix

# 6. Test — generate from real trace
php siro make:test --from-trace=siro_a1b2c3d4

# 7. Regression — verify không break
php siro test:regression --fail

Killer features

Command	What it does	Why it matters
api:why	Debug by method + path	Instant root cause — no log diving
replay	Replay exact production request	Reproduce bugs in 5 seconds
make:test --from-trace	Generate PHPUnit test from real trace	Every bug becomes a permanent regression test
test:regression	Replay all traces, detect regressions	System gets stronger over time
make:crud	Full CRUD in 2 seconds	Model + Controller + Migration + Routes + Tests
fix	Watch mode — auto re-test on save	Fix and verify in one loop

What's inside

my-api/
├── app/Controllers/    # 7 pre-built (Auth + 6 CRUD)
├── app/Models/         # 6 pre-built (User, Product, Category...)
├── app/Services/       # 8 pre-built (BaseService pattern)
├── database/           # 13 migrations + 2 seeders
├── tests/              # 462 passing tests
├── docker-compose.yml  # FrankenPHP + Nginx + Caddy
├── Dockerfile          # Production build
└── k8s/                # Helm chart

Not an empty skeleton — production-grade, ready to deploy.

Quality & performance

Gate	Result		Metric
Core tests	19,034 — 0 failures		Cold boot (Linux)	~0.5 ms
App tests	462 — 0 failures		Cold boot (Win)	~2.4 ms
Fuzz tests	17,851 — 0 failures		Route dispatch	~300K ops/sec
DAST security	157 — 0 failures		Memory baseline	~4 MB
PHPStan	Level Max — 0 errors		Full-stack	~360K ops/sec
Composer audit	0 vulnerabilities

Built-in features

Zero packages needed. JWT auth, ORM, migrations, queue, mail, cache, validation, rate limiting, CSP, CORS, CSRF, OpenAPI, Prometheus metrics, CLI (80 commands). Full list →

Deployment

docker compose up -d    # FrankenPHP, HTTP/2, auto HTTPS
docker build -f Dockerfile.frankenphp -t my-api .

Docker + Kubernetes (Helm chart) included.

Philosophy

Traditional frameworks focus on writing code.
Siro focuses on operating APIs in production.

# Most frameworks:  log → guess → redeploy → wait → repeat
# Siro:            trace → replay → fix → regression → done

Requirements

PHP 8.2+ with ext-pdo, ext-json, ext-mbstring.

Website · Docs · Core · Packagist

MIT © SiroSoft