Go access control library that enforces ACL, RBAC, and ABAC authorization policies, configured through model and policy files.
zenstackhq/zenstack
A TypeScript data layer with a Prisma-compatible ORM, built-in access control, and automatic CRUD APIs and TanStack Query hooks.
Open-source alternative to:Prisma
- Stars
- 2,960
- Forks
- 160
- Open issues
- 178
- Last commit
- 2 days ago
What is it?
ZenStack is a database toolkit for full-stack or backend Node.js and Bun applications. It uses a schema-first approach with a Prisma-compatible schema and query API, and its ORM is built on Kysely in version 3, so developers can combine high-level ORM queries with a typed Kysely query builder when they need lower-level control.
The project adds access control and data validation directly to the data model, so permission rules live alongside the schema rather than being scattered through application code. It can also generate automatic CRUD web APIs with adapters for popular frameworks, TanStack Query hooks for frontend data fetching, and Zod schemas.
According to its documentation, ZenStack V3 is a pure TypeScript implementation with no Rust or WASM components, and it supports advanced modeling patterns such as polymorphism.
Key features
- 01Prisma-compatible schema and query API built on Kysely
- 02Built-in access control and data validation in the data model
- 03Automatic CRUD web APIs with framework adapters
- 04Generated TanStack Query hooks for frontend data access
- 05Zod schema generation
- 06Pure TypeScript implementation without Rust or WASM components
Use cases
- Building a full-stack TypeScript SaaS app that needs row-level permission rules
- Replacing Prisma in a Node.js backend while keeping its query API
- Quickly exposing CRUD endpoints and frontend hooks from a data schema
- Adding typed raw-query escape hatches alongside an ORM
Quick start
- 1
Scaffold a new project with ZenStack configured
npm create zenstack@latest my-project - 2
Or initialize an existing project with the CLI
npx @zenstackhq/cli@latest init
Things to know
- Version 3 is a major rewrite that replaced Prisma ORM with a new engine, so it may differ from earlier versions.
Topics
FAQ
- What is zenstack?
- A TypeScript data layer with a Prisma-compatible ORM, built-in access control, and automatic CRUD APIs and TanStack Query hooks. ZenStack is a database toolkit for full-stack or backend Node.js and Bun applications. It uses a schema-first approach with a Prisma-compatible schema and query API, and its ORM is built on Kysely in version 3, so developers can combine high-level ORM queries with a typed Kysely query builder when they need lower-level control.
- Is zenstack free to use? What license does it have?
- zenstack is open source under the MIT license. Check the license terms before using it in commercial products.
- Is zenstack still maintained?
- Actively maintained. The last commit to zenstack was on Nov 6, 2026.
- What can I use zenstack for?
- Building a full-stack TypeScript SaaS app that needs row-level permission rules Replacing Prisma in a Node.js backend while keeping its query API Quickly exposing CRUD endpoints and frontend hooks from a data schema Adding typed raw-query escape hatches alongside an ORM
- How do I install zenstack?
- Scaffold a new project with ZenStack configured: npm create zenstack@latest my-project Or initialize an existing project with the CLI: npx @zenstackhq/cli@latest init
- Where can I get zenstack?
- The source code and installation instructions are on GitHub: https://github.com/zenstackhq/zenstack
Summary generated by AI from the project's README. GitHub stats refresh daily.
Related projects
Open-source authorization service inspired by Google Zanzibar for building fine-grained RBAC, ReBAC and ABAC access controls outside your app code.
A collection of ready-to-run example projects showing how to use Prisma ORM with Next.js, Express, GraphQL, and many databases.
A lightweight, headless TypeScript ORM for PostgreSQL, MySQL and SQLite that works across Node.js, Bun, Deno and edge runtimes.
A Laravel package for storing users, roles and permissions in the database and checking them through Laravel's gate.
A general-purpose policy engine that lets you write authorization and compliance rules in Rego and evaluate them from services, Kubernetes, and other systems.