Tornado
Python async web framework and networking library with native WebSocket support, a non-blocking HTTP client, and an IOLoop that now wraps asyncio — well-suited for long-lived connection patterns.
Score Breakdown
⚙ Agent Friendliness
🔒 Security
TLS handled at server level via ssl_options. Built-in XSRF protection via xsrf_cookies setting. Secure cookie signing uses HMAC-SHA256. No auth framework included.
⚡ Reliability
Best When
You need battle-tested WebSocket or long-polling support with a mature async HTTP client in a single library, especially for legacy codebases.
Avoid When
You are starting a new REST API and do not need Tornado's specific WebSocket or long-polling strengths — modern ASGI frameworks are better choices.
Use Cases
- • Building long-polling or WebSocket endpoints for agents that need persistent server-push channels
- • Implementing async HTTP proxy handlers where the non-blocking HTTP client fetches upstream APIs concurrently
- • Hosting agent callback receivers that handle many simultaneous webhook deliveries without thread overhead
- • Running comet-style (server-sent events / chunked streaming) endpoints for incremental agent output delivery
- • Maintaining legacy Tornado services that integrate with modern async Python agent code via asyncio compatibility
Not For
- • Greenfield REST APIs where FastAPI or Starlette provide better DX and automatic validation
- • Teams unfamiliar with async Python who want a synchronous WSGI framework
- • Applications requiring automatic OpenAPI/Swagger generation out of the box
Interface
Authentication
No built-in auth — Tornado provides secure_cookie signing helpers but full auth is developer-implemented.
Pricing
Open source Apache-2.0.
Agent Metadata
Known Gotchas
- ⚠ Mixing Tornado's older @gen.coroutine style with native async/await in the same handler can cause subtle event loop issues
- ⚠ WebSocketHandler.on_message is called synchronously in the IOLoop — blocking operations inside it stall all other connections
- ⚠ The AsyncHTTPClient fetch() method raises an exception on non-2xx responses by default; agents must catch tornado.httpclient.HTTPClientError
- ⚠ Tornado does not support ASGI — it cannot be deployed behind standard ASGI servers like uvicorn; it has its own server (tornado.httpserver)
- ⚠ Error responses from RequestHandler are plain text by default; agents expecting JSON error bodies must override write_error in a base class
Alternatives
Full Evaluation Report
Comprehensive deep-dive: security analysis, reliability audit, agent experience review, cost modeling, competitive positioning, and improvement roadmap for Tornado.
AI-powered analysis · PDF + markdown · Delivered within 30 minutes
Package Brief
Quick verdict, integration guide, cost projections, gotchas with workarounds, and alternatives comparison.
Delivered within 10 minutes
Score Monitoring
Get alerted when this package's AF, security, or reliability scores change significantly. Stay ahead of regressions.
Continuous monitoring
Scores are editorial opinions as of 2026-03-07.