Instant SECURE Full Stack Apps and AI Agents

Turn plain English into a working full-stack app — database, secure API, business logic, and frontend — running on your own hardware, with zero lock-in. An open-source alternative to Lovable, Bolt44, and Replit that gives you the whole backend, plus an MCP server that turns every endpoint into a tool for Claude, Cursor, or Codex. Read more about Hyperlambda.

Run it in 60 seconds

curl -fsSL https://hyperlambda.dev/docker-compose.yaml | docker compose -f - up

Then open localhost:5555, point it at localhost:4444, and log in with root / root.

Point the API Wizard at your database, and it generates a complete, secured REST API — then extend it in plain English, without a build or deploy step.

⭐ If this saves you time, star the repo — it's the main way other developers find it.

What you can build

• Full-stack business apps — CRM systems, admin panels, booking systems, internal tools; database, secure API and frontend generated from natural language
• Database-driven AI agents — agents that query and update your database and invoke your endpoints, behind your own role-based access control
• AI chatbots and expert systems — crawl a website, get an embeddable chatbot grounded in your own content
• Secure APIs over legacy databases — point it at an existing MySQL, PostgreSQL, SQL Server or MariaDB schema and get a CRUD API in seconds
• Wrappers around third-party APIs — paste an OpenAPI or Swagger URL and get typed, documented endpoints wrapping Stripe, GitHub, Slack or anything else publishing a spec
• MCP tool servers — expose your endpoints to Claude, Cursor, Codex, Qoder or any MCP client
• Background jobs and automation — scheduled tasks written in Hyperlambda, or generated from a plain English description
• Static sites and SPAs — your cloudlet serves files directly, next to the APIs powering them

How it compares

	Magic Cloud	Lovable / Bolt	n8n / Zapier / Make
License	MIT, fully open source	Proprietary	Mixed
Self-hostable	Yes — your hardware, your data	No	Partly
Backend included	Database, API, auth, RBAC, jobs	Frontend + third-party BaaS	Workflows only
Deploy step before you can test	None — save and run	Deploy to third parties first	Publish step
Execution model	Compiled .NET runtime	—	Interprets JSON/YAML workflows
MCP server	Built in	No	No
Vendor lock-in	None	Yes	Yes

The LLM that cannot hallucinate functions

Magic runs Hyperlambda, which can be generated by our own proprietary LLM. Because we generate an AST rather than text, the output is analysed and rejected if it contains functions that don't exist. The Hyperlambda Generator cannot return hallucinated function invocations — like any LLM it can still write logically wrong code, but every function it invokes is guaranteed to exist.

Combined with the ability to restrict the vocabulary, this lets you ship AI agents that grow their own tool space on demand, without widening your attack surface.

Unique security model

Hyperlambda runs sandboxed, with no file system access outside its sandbox, and can whitelist individual functions through its RBAC system — so your server can accept code as input and execute it safely without knowing where it came from. Restricting invocations at the execution level makes Hyperlambda, as far as we know, the only language that currently does this.

I'm so confident in the codebase quality, I'll give you $100 if you can find a severe security-related bug in its backend code — and another $100 if you can exploit the natural language API, which has accepted arbitrary public input for 3 months with nobody succeeding.

以上为 README 的开头部分。其余内容请阅读原文。 查看完整 README ↗