Instant SECURE Full Stack Apps and AI Agents
Turn plain English into a working full-stack app — database, secure API, business logic, and frontend — running on your own hardware, with zero lock-in. An open-source alternative to Lovable, Bolt44, and Replit that gives you the whole backend, plus an MCP server that turns every endpoint into a tool for Claude, Cursor, or Codex. Read more about Hyperlambda.
Run it in 60 seconds
curl -fsSL https://hyperlambda.dev/docker-compose.yaml | docker compose -f - up
Then open localhost:5555, point it at localhost:4444, and log in with root / root.
Point the API Wizard at your database, and it generates a complete, secured REST API — then extend it in plain English, without a build or deploy step.
⭐ If this saves you time, star the repo — it's the main way other developers find it.
What you can build
- Full-stack business apps — CRM systems, admin panels, booking systems, internal tools; database, secure API and frontend generated from natural language
- Database-driven AI agents — agents that query and update your database and invoke your endpoints, behind your own role-based access control
- AI chatbots and expert systems — crawl a website, get an embeddable chatbot grounded in your own content
- Secure APIs over legacy databases — point it at an existing MySQL, PostgreSQL, SQL Server or MariaDB schema and get a CRUD API in seconds
- Wrappers around third-party APIs — paste an OpenAPI or Swagger URL and get typed, documented endpoints wrapping Stripe, GitHub, Slack or anything else publishing a spec
- MCP tool servers — expose your endpoints to Claude, Cursor, Codex, Qoder or any MCP client
- Background jobs and automation — scheduled tasks written in Hyperlambda, or generated from a plain English description
- Static sites and SPAs — your cloudlet serves files directly, next to the APIs powering them
How it compares
| Magic Cloud | Lovable / Bolt | n8n / Zapier / Make |
|---|
| License | MIT, fully open source | Proprietary | Mixed |
| Self-hostable | Yes — your hardware, your data | No | Partly |
| Backend included | Database, API, auth, RBAC, jobs | Frontend + third-party BaaS | Workflows only |
| Deploy step before you can test | None — save and run | Deploy to third parties first | Publish step |
| Execution model | Compiled .NET runtime | — | Interprets JSON/YAML workflows |
| MCP server | Built in | No | No |
| Vendor lock-in | None | Yes | Yes |
The LLM that cannot hallucinate functions
Magic runs Hyperlambda, which can be generated by our own proprietary LLM. Because we generate an AST rather than text, the output is analysed and rejected if it contains functions that don't exist. The Hyperlambda Generator cannot return hallucinated function invocations — like any LLM it can still write logically wrong code, but every function it invokes is guaranteed to exist.
Combined with the ability to restrict the vocabulary, this lets you ship AI agents that grow their own tool space on demand, without widening your attack surface.
Unique security model
Hyperlambda runs sandboxed, with no file system access outside its sandbox, and can whitelist individual functions through its RBAC system — so your server can accept code as input and execute it safely without knowing where it came from. Restricting invocations at the execution level makes Hyperlambda, as far as we know, the only language that currently does this.
I'm so confident in the codebase quality, I'll give you $100 if you can find a severe security-related bug in its backend code — and another $100 if you can exploit the natural language API, which has accepted arbitrary public input for 3 months with nobody succeeding.
This is the beginning of the README. Read the rest at the original. Read the full README ↗
