Tanuki framework offers readable no-magic MVC for PHP with opt-in auth and admin

A middle ground between full frameworks and plain PHP

According to the announcement post on dev.to, published on 6 September 2026 by the framework's developer, Tanuki is a lightweight PHP MVC framework built for developers stuck between two unsatisfying starting points for small projects: adopting a heavyweight framework whose ORM, templating language, container and folder conventions demand more learning than the application itself, or going completely raw, where routing, database wrappers, CSRF protection and session handling get rebuilt hastily every single time.

Tanuki's pitch is to solve that routine groundwork once, in code small enough to read end to end. The author estimates that the entire request lifecycle — entry script, environment loading, autoloader registration, error configuration, route matching and controller dispatch — fits into a source tree a developer can absorb in roughly ten minutes.

Deliberate omissions

Routes are declared as data in a plain array, mapping patterns such as GET /todo/{id} to a controller method, with no decorators or attribute-based tricks. The Model base class is a small layer over PDO that turns calls like a where() filter into ordinary prepared statements a developer could have typed out manually. Views are simply PHP files with an escaping helper, not a new template syntax. There is no ORM, no template engine and no dependency injection container — omissions the author presents as features rather than gaps.

The repository ships a complete to-do application as a learning reference. Its controller demonstrates CSRF verification, repopulating form fields after failed validation, and flash messages — practical patterns the author says you adapt for your own resources instead of configuring form-request classes.

Security made visible rather than buried

Per the dev.to post, every model method uses prepared statements, and column and table names are validated against a strict identifier pattern. The author says a column-name injection flaw was discovered and fixed during development, with a regression test covering it. CSRF protection is handled through explicit helpers added per form rather than a policy silently applied to every route — a blanket approach the author argues would break session-less endpoints such as webhooks. Passwords rely on PHP's native hashing functions, password recovery tokens are single-use SHA-256 hashes with expiry, and session IDs regenerate on login and logout to prevent fixation attacks.

Extensions that stay inert until wired in

Two modules ship in the repository but register nothing until enabled. tanuki_login provides session-based authentication — login, registration, email-based password recovery and profile editing — with zero routes activated by default. tanuki_admin is a Django-inspired admin panel: register a model in a single configuration array and receive a full CRUD interface for it. Removing either module means deleting its folder and the two lines referencing it in the routes file; the author describes that isolation as a deliberate design constraint from the start.

Translations kept to a minimum

Internationalisation consists of one JSON dictionary per language plus a single helper with placeholder interpolation. A missing key falls back to English; if it is missing everywhere, the raw key is returned instead of breaking the page. An optional URL-based language switcher (/en/todo, /es/todo) stays inactive unless ACCEPTED_LANGUAGES is defined in the environment file, and once a visitor picks a language the choice persists in the session so every other link works without a prefix. Single-language projects never see any of this machinery.

Getting started and longevity claims

Setup involves a composer create-project command, copying an example environment file, filling in database credentials and running PHP's built-in server. The two announcement posts disagree on the exact package name: the English version points to forja-de-onix/tanuki-framework on Packagist, while the Spanish version shows what appears to be a placeholder, so the English post is the reliable reference. It also links a GitHub repository and a documentation wiki.

The author is explicit that Tanuki does not compete with Laravel or Symfony on features. The stated goal is stability: a project built on it today should keep working, unchanged, five years from now, receiving only minor patches and no breaking rewrites.

Why it matters

Most attention in the PHP ecosystem goes to large, convention-heavy frameworks, and developers building small applications often pay a learning and maintenance tax for capabilities they never use. Tanuki is a bet that a framework can be small enough to read, explicit enough to debug, and stable enough to outlast trends — and its opt-in design for authentication, admin tooling and i18n shows one way to keep convenience from turning into obligation.

The caveats are the usual ones for a young project: every claim above comes from the developer's own announcement rather than independent review, there is no adoption data yet, and a five-year stability promise is only as strong as the maintainer behind it. Still, for developers who prefer plain SQL, plain PHP templates and a codebase they can hold in their head, this release is worth a look.