Hyperlambda
Part of our evidence series — see also Hyperlambda, the Inexpensive Natural “Outsourcing” Destination for Your AI Agent and 174 Attempts, One Breach. Every figure below was read from a live source on 2026-11-04, and the links let you check them yourself.
The label
For years the polite version of the question has been: what happens to Hyperlambda if Thomas gets hit by a bus?
It is a fair question. It is the right question to ask about any open-source project, and for a long time the honest answer was uncomfortable, because one person did most of the work. I am tired of being the answer to it, so here is the evidence instead of a reassurance.
The short version: four of us work on Magic full-time, every day, and all four of us contribute to and maintain it. You can see us on the landing page. The rest of this article is the proof that the project is alive, how big it is, and how many people show up to it every day.
Four full-time people, all maintaining Magic
AINIRO has four full-time employees. All four of us are on Magic: writing it, fixing it, hardening it and shipping it. Nobody on the team is a spectator and nobody works on something else while the platform waits for me.
You can see part of that without taking my word for it. The health page shows the merged pull requests for the repository live, straight from GitHub. On the day I am writing this:
- Three pull requests from the team were merged today, before 15:30 UTC: one that makes the Hyperlambda generator fail clearly when it returns no code, one that adds a scheduled sweep that cleans up public chat uploads, and one that neutralises CSV formula injection.
- In the last seven days, seven pull requests from the team were merged.
- In the three weeks since October 14, fourteen.
Those pull requests are not cosmetic. They are an IDOR fix on permalink creation, entity-expansion hardening in the XML parser, optional RS256 JWT signing with caller-supplied keys, path-resolver hardening against parent segments, and fail-closed behaviour when a reCAPTCHA-protected type has no server keys. That is what maintenance looks like when it is somebody's whole job.
A fair note, because I would rather say it first than have you find it: I still merge every pull request, and historically I have made most of the direct commits. A pull-request view under-counts me and it also only counts merged pull requests, which is one slice of what four people do all day. I label it “merged pull requests”, not “contributors”, for that reason. What changed is that the project no longer depends on my hands alone: there are four people who know this codebase and work on it every working day.
How big it actually is
Hyperlambda is not a weekend project. The numbers, as of 2026-11-04:
- The repository was created on 2019-03-16, more than seven and a half years ago.
- 9,831 commits, 1,223 stars, 178 forks, MIT licence.
- About 66,900 lines of code according to the quality endpoint: roughly 35,800 lines of C#, 26,500 of TypeScript, 3,800 of CSS and the rest YAML, JSON, Python and JavaScript.
- Release v24.4.12, with master zero commits ahead of it.
- The health summary reports master passing, the SonarCloud quality gate OK, the latest CI run a success, and 94.1% test coverage.
The reference documents hundreds of executable functions, which is the vocabulary an agent composes programs from. I wrote about how that vocabulary is published and verified in the outsourcing article, so I will not repeat it here.
Who shows up every day: the repository
GitHub's traffic page keeps 14 days of history. This is the cloner chart for the period up to yesterday.
605 unique cloners in 14 days. For nine days the repository sat at around 20 unique cloners a day. Then it climbed: about 65 on October 30, about 139 on November 1, and 183 on November 3, roughly nine times the baseline in five days. I believe that is an all-time high, but GitHub only shows 14 days, so I cannot prove it from the chart alone.
The visitor chart for the same period tells a different story.
290 unique visitors in 14 days, with two clear human spikes: October 24 and November 2. Both look like a link getting shared. Visitors and cloners rise together on those two days, at roughly one cloner per visitor.
The interesting part is what happens between them. From October 30 to November 1, cloners went from about 20 to about 139 while visitors stayed flat at 10 to 16 a day. On November 3, there were 183 cloners and 57 visitors.
My theory, and it is only a theory: there are two layers. One is human attention, the spikes, which come and go. The other is a growing floor of clones from people and programs that never open the repository page, because git clone does not register as a page view. AI agents told to try Magic, install scripts, CI jobs and crawlers would all look like that. I cannot tell which from these two charts, and GitHub's per-referrer data would be needed to say more.
Who shows up every day: Docker
Docker Hub only publishes lifetime pull counts publicly, not daily ones, so this is a different kind of number. As of today:
| Image | Lifetime pulls |
|---|---|
servergardens/magic-frontend | 121,029 |
servergardens/magic-backend | 33,119 |
servergardens/magic-aio | 26,030 |
The all-in-one image is only a couple of months old, and we have no pipeline of our own that pulls it. Twenty-six thousand pulls in two to three months is roughly 290 to 430 a day, and every one of them comes from somebody else's machine: someone evaluating Magic with the one-line install, a self-hoster, a script, an agent following the documentation.
That does not mean 26,030 users. It means a steady stream of pulls from systems we do not control.
What these numbers do not prove
I would rather say this than have a reader say it for me.
- Clones and pulls are not users. A unique cloner is a distinct client per day. A pull is a pull, and every rebuild, restart on a fresh host and CI run counts again. A few hundred real installations could produce the Docker numbers, and so could a few thousand. I will not convert either figure into a user count.
- Bus factor is about maintainers, not consumers. Popularity does not answer the question; the team section above does. I put the usage numbers here because they show the project is alive, not because they change the maintainer count.
- Spikes revert. The GitHub window is 14 days, and a spike like November 3 usually settles. The honest claim is that the floor is higher than it was three weeks ago, not that it will stay at 183.
- A passing build is not a guarantee. Coverage and a quality gate show an implemented, tested platform. They do not show the absence of bugs; we published our own breach to make that point.
Why it keeps running regardless
Here is the test I used in the Base44 comparison: if the vendor vanished tomorrow, would your application still run?
For Magic, yes, and not because anyone is generous:
- It is MIT licensed, runtime and all, and it ships as a container you can run anywhere.
- It is tested and its health is public JSON, so you do not have to trust me about whether master is passing.
- It is maintained by four full-time people, not by one.
- Anyone can fork it. If you are worried, the worry has a one-click answer.
A project has a low bus factor when it does not depend on any single person’s presence to keep working, and the proof of that is not a promise. It is a repository that was started in 2019, a build that is green today, and a team that merged three pull requests this morning.
Frequently asked questions
What is Hyperlambda’s bus factor?
Four full-time employees work on Magic every day, and the code is MIT licensed, tested, containerised and publicly health-checked. I still merge every pull request and historically made most of the direct commits, so the honest answer is that the project depends on one person far less than it used to, not that it depends on nobody.
How many people maintain Magic?
Four full-time employees, all contributing to and maintaining the project. The landing page introduces them, and the health page shows merged pull requests live.
How many people use Hyperlambda?
I cannot give you a user count, and I will not invent one. What I can measure is 605 unique GitHub cloners in the last 14 days (183 on November 3), 290 unique repository visitors, and 26,030 lifetime pulls of the all-in-one Docker image, which no pipeline of ours pulls.
Can I self-host Magic?
Yes. The platform is MIT licensed and published as Docker images, including an all-in-one image. See Magic Cloud on DigitalOcean in One Copy-Paste.
Related reading
- Hyperlambda, the Inexpensive Natural “Outsourcing” Destination for Your AI Agent
- Magic Cloud Is Now Secure by Default: Here’s What Changed
- 174 Attempts, One Breach: What Happened After We Published Our Own Vulnerability
- We Got Breached: A Whitelisted data.create Minted a Root JWT
- There Is a Discord Called “Base44 Refugees”. There Is No Such Thing for Hyperlambda.
- Magic Cloud on DigitalOcean in One Copy-Paste