Skip to content
Back to skills

2083 Tornado 23352d91

ASecurity

Tornado is a Python web framework and asynchronous networking library, originally developed at FriendFeed (acquired by Facebook in 2009). By using non-blocking network I/O, Tornado can scale to tens...

  • 9 stars
  • 0 votes
  • 0 copies
  • 0 views
  • Added October 11, 2026
developmentpythongobashfastapitestinggitapifrontendsecurityperformance

Works with

  • claude code
  • cli
  • api
  • mcp

Security analysis

A96/100
  • mediumInstalls packages at runtime which could introduce malicious dependencies

Pro shows the line behind each finding and how to fix it

Scanned October 11, 2026

npx -y skills add tools-only/X-Skills --skill 2083-tornado_23352d91 --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of 2083 Tornado 23352d91?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for 2083 Tornado 23352d91
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/tools-only-2083-tornado-23352d91/badge)](https://www.skillsdirectory.com/skills/tools-only-2083-tornado-23352d91)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

SKILL.md
---
name: Tornado
description: Tornado is a Python web framework and asynchronous networking library, originally developed at FriendFeed (acquired by Facebook in 2009). By using non-blocking network I/O, Tornado can scale to tens...
license: Apache-2.0
metadata:
  topic: tornado
  category: api-frameworks
  layer: "2"
  language: python
  stack: python-tornado
  source_url: https://www.tornadoweb.org/en/stable/
  github: tornadoweb/tornado
  version: "6.5.4 (latest); 6.5.0 released 2025-05-15"
  verified: "2026-02-05"
  next_review: "2026-05-05"
---

## Overview

Tornado is a Python web framework and asynchronous networking library, originally developed at FriendFeed (acquired by Facebook in 2009). By using non-blocking network I/O, Tornado can scale to tens of thousands of open connections, making it ideal for long polling, WebSockets, and other applications requiring long-lived connections to each user. Unlike most Python web frameworks, Tornado is not based on WSGI and is typically run with only one thread per process.

---

## Problem Addressed

| Problem                                           | Solution                                                                     |
| ------------------------------------------------- | ---------------------------------------------------------------------------- |
| Traditional frameworks block on I/O operations    | Non-blocking I/O enables handling thousands of concurrent connections        |
| WebSockets require long-lived connections         | Native WebSocket support with automatic ping/pong and connection management  |
| Long polling needs efficient connection handling  | Event-driven architecture optimized for persistent connections               |
| Python async ecosystem fragmentation              | Full asyncio integration since v5.0; libraries can be mixed freely           |
| Real-time applications need low latency           | Single-threaded event loop minimizes context switching overhead              |
| WSGI limitations for streaming responses          | Non-WSGI design supports chunked encoding and streaming natively             |
| Thread safety complexity in async code            | Single-threaded model with explicit executor for blocking operations         |

---

## Key Statistics

| Metric            | Value                     | Date Gathered |
| ----------------- | ------------------------- | ------------- |
| GitHub Stars      | 22,437                    | 2026-02-05    |
| GitHub Forks      | 5,544                     | 2026-02-05    |
| Open Issues       | 213                       | 2026-02-05    |
| Contributors      | 376                       | 2026-02-05    |
| Monthly Downloads | 95,420,268                | 2026-02-05    |
| Primary Language  | Python                    | 2026-02-05    |
| Repository Age    | Since September 2009      | 2026-02-05    |
| Python Versions   | 3.9, 3.10, 3.11, 3.12, 3.13, 3.14 | 2026-02-05 |

---

## Key Features

### Web Framework (`tornado.web`)

- **Request Handlers**: Class-based handlers with HTTP method dispatching (get, post, put, delete, etc.)
- **URL Routing**: Regex-based URL patterns with captured groups as handler arguments
- **Templates**: Built-in template engine with control structures, inheritance, and escaping
- **Static Files**: Built-in static file serving with cache headers
- **Cookies**: Signed/encrypted cookie support for session management
- **Authentication**: Built-in authentication decorators and OAuth mixins
- **Localization**: i18n support with locale-based translation

### Asynchronous Networking

- **IOLoop**: Event loop implementation integrated with asyncio (default since v5.0)
- **IOStream**: Non-blocking socket wrapper for reading/writing with buffering
- **TCPServer**: Base class for non-blocking TCP servers
- **TCPClient**: Non-blocking TCP client with connection pooling
- **Unix Sockets**: Support for Unix domain sockets including Linux abstract namespace

### HTTP Components

- **HTTPServer**: High-performance non-blocking HTTP server
- **AsyncHTTPClient**: Non-blocking HTTP client with connection reuse
- **curl_httpclient**: Alternative HTTP client using libcurl (optional pycurl dependency)
- **HTTP/1.1**: Full HTTP/1.1 support with keepalive and pipelining

### WebSocket Support

- **WebSocketHandler**: Server-side WebSocket implementation
- **websocket_connect**: Client-side WebSocket connections
- **Ping/Pong**: Automatic ping/pong with configurable intervals and timeouts
- **Compression**: Per-message deflate compression support

### Coroutines and Concurrency

- **Native async/await**: Full support for Python async/await syntax
- **asyncio Integration**: Shares event loop with standard library asyncio
- **gen.coroutine**: Legacy decorator for pre-async/await compatibility
- **run_in_executor**: Bridge to run blocking code in thread pool

### Security Features

- **XSRF Protection**: Built-in cross-site request forgery protection
- **Secure Cookies**: Cryptographic signing of cookie values
- **Header Validation**: Strict validation of HTTP headers per RFC specifications (v6.5+)

---

## Technical Architecture

### Stack Components

| Component         | Technology                                                 |
| ----------------- | ---------------------------------------------------------- |
| Event Loop        | IOLoop (asyncio-based since v5.0)                          |
| HTTP Server       | tornado.httpserver (non-blocking, single-threaded)         |
| Web Framework     | tornado.web (class-based handlers)                         |
| Template Engine   | tornado.template (compiled Python templates)               |
| HTTP Client       | tornado.httpclient (async, with curl option)               |
| WebSocket         | tornado.websocket (client and server)                      |

### Threading Model

```text
Main Thread (Event Loop)
      |
  IOLoop (asyncio-based)
      |
  ├── HTTP Server (accepts connections)
  ├── Request Handlers (process requests)
  ├── WebSocket Handlers (maintain connections)
  └── Timers/Callbacks (scheduled work)

Thread Pool Executor (for blocking operations)
      |
  └── run_in_executor() calls
```

### Core Modules

```text
tornado
├── web.py          # RequestHandler, Application, routing
├── ioloop.py       # Event loop (wraps asyncio)
├── iostream.py     # Non-blocking socket I/O
├── httpserver.py   # HTTP server implementation
├── httpclient.py   # Async HTTP client
├── websocket.py    # WebSocket client/server
├── template.py     # Template engine
├── escape.py       # HTML/URL/JSON escaping
├── locale.py       # i18n support
├── auth.py         # OAuth/OpenID mixins
├── options.py      # Command-line parsing
├── testing.py      # Test utilities
├── gen.py          # Legacy coroutine support
├── concurrent.py   # Future utilities
├── netutil.py      # Network utilities
├── tcpserver.py    # Base TCP server
├── tcpclient.py    # Base TCP client
└── wsgi.py         # Limited WSGI adapter
```

### Platform Support

| Platform    | Support Level | Notes                                           |
| ----------- | ------------- | ----------------------------------------------- |
| Linux       | Full          | Best performance with epoll                     |
| macOS/BSD   | Full          | Uses kqueue                                     |
| Solaris     | Full          | Uses /dev/poll                                  |
| Windows     | Limited       | Not recommended for production; missing features|

---

## Installation and Usage

### Installation

```bash
# Basic installation
pip install tornado

# Using uv
uv pip install tornado

# Add to pyproject.toml
dependencies = ["tornado>=6.5.0"]

# Optional: pycurl for curl-based HTTP client
pip install pycurl

# Optional: pycares for non-blocking DNS
pip install pycares
```

### Minimal Web Application

```python
import asyncio
import tornado.web

class MainHandler(tornado.web.RequestHandler):
    def get(self):
        self.write("Hello, world")

def make_app():
    return tornado.web.Application([
        (r"/", MainHandler),
    ])

async def main():
    app = make_app()
    app.listen(8888)
    await asyncio.Event().wait()

if __name__ == "__main__":
    asyncio.run(main())
```

### Async Request Handler

```python
import tornado.web
import tornado.httpclient

class AsyncHandler(tornado.web.RequestHandler):
    async def get(self):
        http_client = tornado.httpclient.AsyncHTTPClient()
        response = await http_client.fetch("https://api.example.com/data")
        self.write(response.body)
```

### WebSocket Server

```python
import tornado.websocket
import tornado.web

class ChatHandler(tornado.websocket.WebSocketHandler):
    connections = set()

    def open(self):
        self.connections.add(self)

    def on_message(self, message):
        for conn in self.connections:
            conn.write_message(message)

    def on_close(self):
        self.connections.discard(self)

app = tornado.web.Application([
    (r"/ws", ChatHandler),
])
```

### Running Blocking Code

```python
import tornado.web
import asyncio
from concurrent.futures import ThreadPoolExecutor

executor = ThreadPoolExecutor(max_workers=4)

class BlockingHandler(tornado.web.RequestHandler):
    async def get(self):
        loop = asyncio.get_event_loop()
        result = await loop.run_in_executor(
            executor, self.blocking_operation
        )
        self.write(result)

    def blocking_operation(self):
        # CPU-bound or blocking I/O work
        return "result"
```

### Template Usage

```python
import tornado.web

class TemplateHandler(tornado.web.RequestHandler):
    def get(self):
        self.render("template.html",
                    title="My Page",
                    items=["a", "b", "c"])
```

```html
<!-- template.html -->
<html>
  <head><title>{{ title }}</title></head>
  <body>
    <ul>
      {% for item in items %}
        <li>{{ escape(item) }}</li>
      {% end %}
    </ul>
  </body>
</html>
```

---

## Relevance to Claude Code Development

### Direct Applications

1. **Long-Running MCP Connections**: Tornado's WebSocket support makes it suitable for MCP servers that need to maintain persistent connections with AI clients.

2. **High-Concurrency Tool Servers**: When Claude Code tools need to handle many simultaneous requests (e.g., batch processing, webhooks), Tornado's non-blocking architecture excels.

3. **Real-Time Streaming**: Tornado's chunked response support enables streaming responses for long-running AI operations.

4. **Legacy System Integration**: Many production systems use Tornado; understanding it helps when building tools that interface with these systems.

5. **Jupyter Integration**: Jupyter kernels and notebook servers use Tornado extensively; understanding Tornado helps when building notebook-related tools.

### Patterns Worth Adopting

1. **Single-Threaded Async Model**: Tornado's approach of one thread per process with explicit executor for blocking work simplifies reasoning about concurrency.

2. **Class-Based Handlers**: The RequestHandler pattern provides clear separation of HTTP methods and lifecycle hooks.

3. **Coroutine Composition**: Tornado's clean async/await patterns for composing asynchronous operations are directly applicable to skill implementations.

4. **Connection Management**: Tornado's WebSocket connection tracking patterns (sets of active connections, broadcast helpers) are useful for multi-client scenarios.

5. **Graceful Shutdown**: Tornado's shutdown patterns for long-lived connections inform how to build robust MCP servers.

### Integration Opportunities

1. **WebSocket-Based MCP Transport**: Build MCP servers using Tornado's WebSocket support for bidirectional communication.

2. **Streaming Tool Responses**: Use Tornado's chunked encoding for tools that produce streaming output.

3. **Webhook Receivers**: Tornado excels at handling high volumes of webhooks from external services.

4. **Proxy Services**: Build AI-aware proxy services that route requests based on content analysis.

5. **Real-Time Dashboards**: Combine Tornado WebSockets with frontend frameworks for live AI monitoring.

### Comparison with Related Frameworks

| Aspect              | Tornado                          | FastAPI                       | aiohttp                       |
| ------------------- | -------------------------------- | ----------------------------- | ----------------------------- |
| Architecture        | Single-threaded, non-blocking    | ASGI (Starlette)              | Async client/server           |
| Primary Use Case    | WebSockets, long-polling         | REST APIs                     | HTTP client/server            |
| Validation          | Manual                           | Pydantic (automatic)          | Manual                        |
| Documentation       | Manual                           | Auto-generated OpenAPI        | Manual                        |
| Learning Curve      | Moderate                         | Low (Python types)            | Moderate                      |
| Maturity            | Since 2009 (17 years)            | Since 2018 (8 years)          | Since 2015 (11 years)         |
| Throughput          | High (C10K capable)              | High (uvloop)                 | High                          |

### When to Choose Tornado Over FastAPI

- WebSocket-heavy applications requiring many concurrent connections
- Long-polling implementations
- Real-time streaming responses
- Integration with Jupyter ecosystem
- Legacy systems already using Tornado
- Single-binary deployments without uvicorn

### When to Choose FastAPI Over Tornado

- REST API development with automatic validation
- OpenAPI documentation requirements
- Type-hint-based development workflow
- Modern Python ecosystem alignment (Pydantic, Starlette)
- MCP server development (via FastMCP)

---

## Enterprise Adoption

Tornado has been deployed in production at scale by major organizations:

- **Facebook**: Original adopter via FriendFeed acquisition; used for real-time features
- **Quora**: Powers high-traffic question-answer platform
- **Bitly**: URL shortening service handling billions of requests
- **Jupyter**: Notebook server and kernel communication

---

## References

| Source                      | URL                                                                | Accessed   |
| --------------------------- | ------------------------------------------------------------------ | ---------- |
| Official Documentation      | <https://www.tornadoweb.org/en/stable/>                            | 2026-02-05 |
| GitHub Repository           | <https://github.com/tornadoweb/tornado>                            | 2026-02-05 |
| GitHub README               | <https://github.com/tornadoweb/tornado/blob/stable/README.rst>     | 2026-02-05 |
| PyPI Package                | <https://pypi.org/project/tornado/>                                | 2026-02-05 |
| Release Notes v6.5.0        | <https://www.tornadoweb.org/en/stable/releases/v6.5.0.html>        | 2026-02-05 |
| GitHub API (stats)          | <https://api.github.com/repos/tornadoweb/tornado>                  | 2026-02-05 |
| PyPI Stats                  | <https://pypistats.org/packages/tornado>                           | 2026-02-05 |
| User's Guide                | <https://www.tornadoweb.org/en/stable/guide.html>                  | 2026-02-05 |

**Research Method**: Information gathered from official GitHub repository README, GitHub API (stars, forks, issues, contributors), PyPI metadata, official documentation, and release notes. Download statistics from PyPI Stats API.

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…

Newsletter

Get the weekly list of safe new skills, and the ones we pulled.