Business servers, secure from the first line
CKN Server is a framework for building APIs, WebSockets and server-rendered pages, built directly on Node.js with no Express or third-party HTTP stack. It gives your back-end a fast, secure foundation that you own end to end.
What CKN Server does
HTTP, HTTP/2 and WebSocket built in
The whole network layer is written on the Node.js standard library, so the protocols real business systems need work without extra libraries.
- HTTP/1.1, HTTPS and HTTP/2 on one port
- RFC 6455 WebSocket with rooms and broadcast
- NDJSON and SSE streaming
- Multipart file upload with file validation
Modules, controllers and Features
Every endpoint is one Feature that keeps its route, permissions, schema and documentation in one place, so new team members read the code and understand it quickly.
- Modules and controllers discovered from folders
- Each Feature has a project-wide unique code
- Scopes, tags and idempotency set per Feature
- Full Feature manifest from a single command
Security ready to use
One call to useSecureDefaults gives you the standard protections, and the authentication middleware enterprise systems need is included.
- Security headers, CORS, HPP and rate limiting
- JWT (HS/RS/PS/ES and JWKS) and API keys
- CSRF protection and persisted sessions
- Idempotency-Key to stop duplicate writes on retry
Validation and automatic API docs
Define a JSON Schema once. Input is checked before your logic runs and OpenAPI documentation is generated for you, so the docs never drift.
- Bad input answered with 400 and details before your code runs
- OpenAPI 3.1 documentation at /api-docs
- One error format everywhere (RFC 9457)
Built to run and to operate
It ships what operations teams need, from health checks to using every CPU core.
- /healthz, /readyz and /metrics endpoints
- Multi-worker cluster with rolling restart
- Graceful shutdown on SIGTERM
- Test server that runs without a real network
Screens, AI agents and shared editing
Beyond APIs, the server delivers web pages, exposes your features to AI agents and supports real-time shared document editing.
- Server-rendered pages with built-in themes and view engine
- UI bundling with SPA fallback and service worker
- MCP server so AI agents can call your Features
- Real-time collaboration rooms
Measured, not promised
Figures come from our internal benchmarks on an Apple M1 Pro (Node.js 24), with the load generator on the same machine and no database, so they measure the framework's own cost. Results on your hardware and workload will differ.
Figures come from CKN's own test suites and benchmarks. Real results depend on each system's hardware and data volume.
What your business gets
Own the whole stack
The HTTP layer, router, WebSocket and security middleware are written on Node.js, and the only runtime dependency is CKN Core. That shrinks your supply-chain exposure, and when a fix or a behaviour change is needed, we can make it ourselves without waiting on an outside maintainer.
Lower security risk
The standard protections, authentication, CSRF and idempotency ship with the framework and are exercised by attack tests such as path traversal and malformed headers. Every service starts from the same security baseline instead of each team assembling its own.
Faster delivery, predictable cost
Validation, OpenAPI docs, health checks and clustering are configuration, not new code. Teams spend more of their time on business logic, and when load grows you can use all the cores you already have before buying more machines.
One Feature: route, permissions and validation together
In use across the CKN stack
- The runtime for every CKN business service (inventory, transportation and more)
- Platform services such as identity, integration and portal
- Operations services such as console and engine, serving both API and screens
- Apps scaffolded with ckn init start on this framework
class OrderController extends Controller {
constructor() { super(); this.url = "orders"; }
create = {
code: "SALES.ORDER.CREATE", name: "Create order", method: Controller.Method.POST, url: "",
inputSchema: {
type: "object", additionalProperties: false, required: ["sku", "qty"],
properties: { sku: { type: "string", minLength: 1 }, qty: { type: "integer", minimum: 1 } }
},
scopes: ["orders:write"], sideEffects: "write", idempotent: true,
process: async (session: Session) => { session.send({ success: true, data: session.input }); }
};
}