tRPC
End-to-end type-safe RPC framework for TypeScript. tRPC generates TypeScript types from server-side router definitions and shares them with the client — no code generation, no schema files. Calling a server procedure from the client has full TypeScript autocomplete for inputs and outputs. Works as HTTP/JSON under the hood. Designed for TypeScript monorepos (Next.js, T3 stack).
Score Breakdown
⚙ Agent Friendliness
🔒 Security
Procedures require explicit protection — unprotected procedures are callable by anyone. Use protectedProcedure pattern with middleware that validates auth context. tRPC's transport is HTTP/JSON — standard HTTPS security applies.
⚡ Reliability
Best When
You're building a full-stack TypeScript application in a monorepo (T3 stack, Next.js) and want end-to-end type safety without REST or GraphQL overhead.
Avoid When
Your API needs to be consumed by non-TypeScript clients or third parties — use REST or GraphQL with an OpenAPI/GraphQL schema.
Use Cases
- • Build full-stack TypeScript applications where server procedures are called with full type safety and autocomplete on the client
- • Eliminate API schema maintenance (OpenAPI, GraphQL) by inferring types directly from router definitions
- • Use with Next.js (App Router or Pages Router) for type-safe API routes in the same repo
- • Replace REST APIs in TypeScript monorepos where client and server share code
- • Build real-time subscriptions using tRPC's WebSocket-based subscription support
Not For
- • Public APIs consumed by non-TypeScript clients — tRPC's type safety only works within TypeScript codebases
- • Microservice architectures where server and client are in separate repos with different languages
- • Applications needing standard REST endpoints for third-party integration — tRPC's RPC style is not REST-compatible
Interface
Authentication
tRPC is a framework without auth. Auth is implemented via tRPC context (ctx) passed to procedures — context creation reads session/JWT from request.
Pricing
Free and open source.
Agent Metadata
Known Gotchas
- ⚠ tRPC v10 and v11 have incompatible APIs — tutorials from 2022-2023 may use v10 syntax; always check version when following examples
- ⚠ tRPC type safety requires both client and server to be in the same TypeScript project or to export router types — across separate repos, tRPC loses its core value proposition
- ⚠ Input validation requires Zod schemas — tRPC doesn't validate inputs without a Zod schema; unvalidated inputs accept any value at runtime
- ⚠ tRPC procedures are either 'query' (GET) or 'mutation' (POST) — attempting to call a mutation as a query or vice versa throws a TRPCClientError
- ⚠ Context creation runs on every request — expensive operations in createContext (DB queries, auth checks) run for every procedure call including unauthenticated ones
- ⚠ Subscriptions require WebSocket adapter and separate WebSocket server — HTTP-only deployments (serverless) cannot use subscriptions; use polling or SSE instead
Full Evaluation Report
Detailed scoring breakdown, competitive positioning, security analysis, and improvement recommendations for tRPC.
Scores are editorial opinions as of 2026-03-06.