---
title: "Framework Adapters"
url: "https://docs.caracal.run/v1.0/sdks/adapters/"
markdown_url: "https://docs.caracal.run/markdown/v1.0/sdks/adapters.md"
description: "Framework adapters for Caracal-protected resource servers."
page_type: "page"
concepts: []
requires: []
---

# Framework Adapters

Canonical URL: https://docs.caracal.run/v1.0/sdks/adapters/
Markdown URL: https://docs.caracal.run/markdown/v1.0/sdks/adapters.md
Description: Framework adapters for Caracal-protected resource servers.
Page type: page
Concepts: none
Requires: none

---

Framework adapters bind the lower-level identity and verify packages to common server frameworks. Use them before reaching for lower-level verification APIs.

Adapters are inbound enforcement only. They do not start Sessions, mint mandates, proxy to Gateway, or manage product state.

## Adapter Map

| Adapter | Package | Use it for |
| --- | --- | --- |
| [Express](/v1.0/sdks/adapters/express/) | `@caracalai/express` | Protecting Express 5 routes with Caracal mandate verification. |
| [ASGI](/v1.0/sdks/adapters/asgi/) | `caracalai-asgi` | Protecting FastAPI, Starlette, and other Python ASGI apps with Caracal mandate verification. |
| [FastMCP](/v1.0/sdks/adapters/fastmcp/) | `@caracalai/fastmcp`, `caracalai-fastmcp` | Verifying FastMCP bearer tokens before tool execution. |
| [Go net/http](/v1.0/sdks/adapters/nethttp/) | `github.com/garudex-labs/caracal/packages/adapters/nethttp/go` | Protecting Go HTTP handlers. |

No adapter fits, or you need a custom boundary? Route through [Verification Layer Overview](/v1.0/sdks/verification-layer/) to choose between the verify engine, identity package, and revocation stores.

## Boundary Semantics

Every HTTP adapter maps verification failures through one canonical status function in `@caracalai/verify` (`httpStatusForAuthError` in TypeScript, `verify.HTTPStatus` in Go), so the boundary behaves identically across frameworks and languages:

* **401** - the credential itself was not accepted: `missing_token`, `invalid_token`, `invalid_zone`, `session_revoked`, `delegation_stale`.
* **403** - the mandate verified but its authority is insufficient for the route: `insufficient_scope`, `session_required`, `delegation_required`, `chain_mismatch`, `hop_count_exceeded`.

Adapters never re-derive these status codes; they consume the shared mapping.

All adapters require trusted issuer, audience, zone, and route-authority requirements. In-memory revocation is suitable only for tests or one process; replicated deployments need a shared backend.

## Related State Backends

* [Redis Revocation Store](/v1.0/sdks/backends/redis/)

## Related Guides

* [Verification Layer Overview](/v1.0/sdks/verification-layer/)
* [Protect an MCP Server](/v1.0/guides/protect-mcp/)
* [Protect an Express App](/v1.0/guides/protect-express/)
* [Protect a FastAPI App](/v1.0/guides/protect-fastapi/)
* [Protect a FastMCP App](/v1.0/guides/protect-fastmcp/)
* [Protect a Go net/http Service](/v1.0/guides/protect-nethttp/)