Port 9321 fronts many danmu sources and formats
Danmu API runs an HTTP service on port 9321 and translates the viewer comments attached to shows across several Chinese and East Asian video platforms. The Chinese README documents DandanPlay-compatible search, episode, matching, and comment endpoints. Responses can be JSON, XML, or one of several player-specific forms supported through dan-any. It also accepts direct video URLs and can merge, filter, recolor, sample, or time-shift comments.
This is more than a thin format converter. The server remembers manual selections, supports title and episode mapping, caches searches, stores favorites, imports local danmu files, and has a web management interface for configuration and logs. Those features help when filenames and platform titles disagree. They also create state that an operator must understand. A bad automatic match can return perfectly valid comments for the wrong episode, which is harder to spot than an HTTP error.
Node.js 18 supports local use, while serverless loses scheduling
The local path requires Node.js 18 or newer, npm install, a configuration file or environment variables, and npm start. Docker images and a Dockerfile are available. Deployment instructions also cover Vercel, Netlify, EdgeOne, Cloudflare, and Hugging Face Spaces. The many buttons make first deployment approachable, yet the platforms do not provide the same service. The README recommends local Docker when stability matters.
Node and Docker deployments can write favorites and uploaded comments under .cache, provided that directory is mounted for container persistence. They can also execute scheduled favorite refreshes in the Asia/Shanghai timezone. Serverless deployments disable that scheduler and need Redis to preserve favorites or local uploads across cold starts. Ordinary search and comment caches remain instance memory according to the documentation, even when Redis is configured. That difference should decide the host before a team fills out the long environment file.
What happened when we ran it
Our sandbox installed 63 npm packages in 44 seconds and left 112 MB on disk. The repository at commit ea88a15 contained 116 files, about 57,381 lines of source, and a 2.4 MB checkout. Npm audit reported 0 known vulnerabilities, including 0 critical, high, moderate, and low findings. Four CI workflow files and a Dockerfile were present; our scan found no tests directory.
There was no build script or target, so the build step was skipped. There was also no test script or target, so our harness skipped tests. The README mentions direct node --test commands for selected files, but that does not change the measured result: a conventional checkout-level test target was unavailable. Buyers should decide which manual commands represent the release gate and run them explicitly; our lab data cannot say whether they pass.
The install result only covers repository mechanics. We did not query video providers, verify comment accuracy, exercise Redis persistence, or compare player output formats. None of those should be inferred from the 44-second install. A useful acceptance run would use shows the operator knows, check that each returned episode is correct, restart the chosen host, and confirm that favorites and local uploads survive exactly where the README says they will.
Three requests per minute do not fix upstream failures
The default comment limit is 3 requests per minute for one IP, and the documented default token is 87654321. When that default remains in use, the README says callers may omit the token from the URL. Public deployments should set their own token, configure an administrator token for management, and check which read endpoints remain public. Logs are held in memory and disappear on restart, so a reverse proxy or external log path is needed for longer incident history.
Source access is the recurring operational cost. Some platform paths need a Bilibili or Douban cookie, a proxy, or a TMDB key. Open issue 447 shows the Aiyifan source returning HTTP 403. The README also says Cloudflare can be blocked or truncate later comments because of request limits. Danmu API can retry and reorder sources, but it cannot guarantee that an upstream site will keep serving the same unofficial access path.
Correctness has sharper evidence than availability. Issue 472 reports automatic matches whose episode IDs later resolved to comments from a different series. Issue 481 reports local ASS imports retaining control tags, losing color and position, and deleting ordinary text inside angle brackets. Both were open on September 14, 2026. Verify matches and imported files visually before relying on unattended playback.
Seven open issues accompany fresh September work
GitHub showed 3,138 stars, 2,998 forks, and 15 open issues and pull requests on September 14, 2026. An issue-only search returned 7 open issues. The last push was September 13, and several pull requests had updates that month. GitHub's latest-release endpoint returned no release, although repository tags include v1.20.10. Health looks active from pushes and issue traffic; it should not be judged from the missing release object alone.
License metadata needs a maintainer answer. The root LICENSE file contains AGPL-3.0, and GitHub detects that license, while package.json declares ISC. Network operators and distributors should not guess which notice controls their use. For a personal Docker deployment, the immediate questions are simpler: can it match your library correctly, can your chosen sources be reached, and can you support its Chinese-only operating guide?