# Hyperlambda / Magic Cloud

> Hyperlambda is a programming language whose code is a tree structure rather than free-form text — effectively an executable AST. Magic Cloud is the MIT-licensed, self-hostable platform that runs it. Together they let natural language compile into deterministic, inspectable backend code: secured CRUD APIs, workflows, scheduled tasks, and tools AI agents can create for themselves at runtime.

Key facts for agents and their humans:

- The security boundary is the runtime, not the model. Generated Hyperlambda compiles to an AST whose nodes can only bind to explicitly whitelisted capabilities; anything outside that fails before it executes. The model proposes, the runtime decides.
- Hallucinated function invocations cannot compile: every generated slot is statically verified against the live function registry before code is returned, and a declared [whitelist] vocabulary is enforced again at dispatch — including pinned argument values.
- Every endpoint is gated by role-based access control enforced at execution time. Magic ships an MCP server (with OAuth), so any MCP-capable harness — Claude, Claude Code, Cursor, Codex, Qoder — can use a cloudlet's endpoints as tools, and have new tools generated on demand inside the same permission model.
- Databases: SQLite built in; MySQL, PostgreSQL and Microsoft SQL Server connect as external databases and are treated like local ones — no migration, the schema wraps in place.
- Everything is MIT-licensed and open source. Self-host with one command, then log in at http://localhost:5555 with root/root:
  curl -fsSL https://hyperlambda.dev/docker-compose.yaml | docker compose -f - up

## For agents: try it live

- [Agent entry point](https://hyperlambda.dev/.well-known/hyperlambda-agent): machine-readable list of the sandboxed endpoints you may call on this server, no MCP needed. Call any of them with describe set to true to see which functions you may use, and the rate limit and timeout that apply to you, then run Hyperlambda inside what it permits.
- Public guest token, for the guest role that anyone signing in over OIDC gets anyway, so it is harmless to use. Send it as the header Authorization: Bearer followed by the token, and describe returns the guest vocabulary, which adds read and create access to the chinook sample database: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1bmlxdWVfbmFtZSI6InNlcnZpY2UiLCJyb2xlIjoiZ3Vlc3QiLCJuYmYiOjE3OTIyNTg5MjYsImV4cCI6MTgyMzczMTIwMCwiaWF0IjoxNzkyMjU4OTI2fQ.2VivPBDnD-NaWAe9exZ1UXhpkjjVyDEhqGXWGZwRokc

## Slot reference: every function of Hyperlambda, machine readable

- [Slots index](https://docs.ainiro.io/reference/slots-index.json): every slot with its description, and the addresses of its reference page and its guide. Small, so start here and fetch detail only for the slots you need
- [All slots](https://docs.ainiro.io/reference/slots.json): every slot with its complete signature - value, arguments, constraints and what it returns - as one static file with no throttle. One file per slot is at https://docs.ainiro.io/reference/slots/{namespace}/{slot}/slot.json
- [Slots endpoint](https://hyperlambda.dev/magic/modules/docs/slots): the same data live, generated by Hyperlambda introspecting itself. A plain GET, throttled per IP address
- [Slot reference](https://docs.ainiro.io/reference/slots/): human readable, one page per slot, each linking to its guide with code examples
- [Any page as Markdown](https://hyperlambda.dev/magic/modules/tools/url-to-markdown?url=https://hyperlambda.dev/health): `GET` with `url` set to any page, this site's pages included, returns it as Markdown with token counts
- [OpenAPI description](https://hyperlambda.dev/openapi.json): the public endpoints on this server as an OpenAPI 3.1 document
- [API catalog](https://hyperlambda.dev/.well-known/api-catalog): the same endpoints as an RFC 9727 linkset
- [MCP server card](https://hyperlambda.dev/.well-known/mcp.json): the MCP endpoint, its transport and its OAuth metadata

## Docs

- [Documentation](https://docs.ainiro.io): the full Magic Cloud documentation — dashboard, Hyper IDE, SQL Studio, the CRUD generator, machine learning, plugins and Hyperlambda itself
- [How to connect the MCP server](https://docs.ainiro.io/tutorials/how-to-connect-the-mcp-server/): step-by-step guide to exposing a cloudlet's endpoints as agent tools
- [GitHub repository](https://github.com/polterguy/magic): the complete MIT-licensed source code

## Product pages

- [Homepage](https://hyperlambda.dev): what deterministic AI code generation is and why the runtime is the security boundary
- [AI Agent Builders](https://hyperlambda.dev/ai-agent-builders): agents that create their own backend tools safely
- [Database AI Agents](https://hyperlambda.dev/database-ai-agents): connecting agents to existing SQL databases without migrating
- [Hyperlambda Generator](https://hyperlambda.dev/hyperlambda-generator): natural language to verified backend code — the docstring prompt, static verification against the live function registry, the whitelisted runtime, and the three places you meet it (Hyper IDE, the SQL endpoint tab, MCP)
- [Natural Language API](https://hyperlambda.dev/natural-language-api): a public endpoint that turns any sentence into code, verifies it, runs it inside a 188-function whitelist, and returns the code with the runtime's verdict, executed or refused — with a $100 bounty on escaping the sandbox
- [MCP Server](https://hyperlambda.dev/mcp-server): every cloudlet endpoint as an MCP tool — OAuth 2.1 built in, tool list filtered per role, new tools generated from a sentence
- [Lovable Alternative](https://hyperlambda.dev/lovable-alternative): the MIT-licensed, self-hosted alternative — own the backend, bring your own agent
- [Web Designer](https://hyperlambda.dev/web-designer): a WYSIWYG designer for the frontends a cloudlet serves — it edits the served file itself, with scripts disabled in the canvas so the document cannot drift from the file, which means no source maps, no per-project dev server, no framework requirement and no credits per edit
- [The dashboard tour](https://hyperlambda.dev/dashboard): every component of the Magic Cloud dashboard, with video walkthrough
- [Savings calculator](https://hyperlambda.dev/savings-calculator): token-cost model for agentic backend generation
- [Pricing](https://hyperlambda.dev/pricing): managed Magic Cloudlets at $100/month per cloudlet, $300 for Enterprise — unlimited users, no per-seat billing, no usage metering
- [Free Tools](https://hyperlambda.dev/tools): eight free no-signup tools, each one a few lines of backend printed on its own page — an AI crawler check that reports which AI agents a site's robots.txt blocks, URL to Markdown with token counts, Website to JSON, URL to YAML, an llms.txt generator, a website image gallery, a link preview checker, and a dead link checker
- [Press](https://hyperlambda.dev/press): press resources — the current release, live sandbox figures read from the public endpoint, fast facts, the stated caveats, and a claim verifiable from a browser in under a minute
- [About This Website](https://hyperlambda.dev/about-website): full disclosure — every page here was written and published by Claude Fable 5, an AI agent, over this cloudlet's own MCP server; watermarked and dated as verifiable testimony

## Live codebase health

- [Codebase Pulse](https://hyperlambda.dev/health): is master safe to run today? Quality gate, CI, unreleased changes and trends, read live from SonarCloud and GitHub. The page needs JavaScript, so read the numbers from the four public JSON endpoints below instead; no key, plain GET.
- [summary](https://hyperlambda.dev/magic/modules/health/summary): the shortest answer, whether master is passing, failing or unknown, with the quality gate, coverage, CI conclusion and commits ahead of the latest release. Start here
- [plugins](https://hyperlambda.dev/magic/modules/health/plugins): test coverage of every plugin, with lines to cover, uncovered lines and lines of code, cached 30 minutes. A plugin without tests has null coverage
- [security.txt](https://hyperlambda.dev/.well-known/security.txt): how to report a vulnerability privately, with a link to the [security policy](https://github.com/polterguy/magic/blob/master/SECURITY.md)
- [scorecard](https://hyperlambda.dev/magic/modules/health/scorecard): the OpenSSF Scorecard of the repository, an overall score from 0 to 10 and every check with its reason, calculated by an independent tool, cached 5 minutes
- [deps](https://hyperlambda.dev/magic/modules/health/deps): dependency vulnerability status with an explicit state (clean, vulnerable, running, failed, stale or unknown), advisories open and suppressed (with reasons) per severity, and open Dependabot pull requests, from nightly NuGet and npm audits, cached 5 minutes
- [quality](https://hyperlambda.dev/magic/modules/health/quality): the quality gate conditions with their thresholds and actual values, the ten most cognitively complex files, and lines of code per language, cached 10 minutes
- [live](https://hyperlambda.dev/magic/modules/health/live): quality gate, SonarCloud measures and the latest CI run, cached 2 minutes
- [repo](https://hyperlambda.dev/magic/modules/health/repo): latest release, commits ahead of it and the newest commits, cached 10 minutes
- [pulls](https://hyperlambda.dev/magic/modules/health/pulls): the 100 most recently closed pull requests with their author (login, profile URL, avatar and whether it is a bot) and a merged date that is null when the pull request was closed without being merged, cached 10 minutes. Count merged ones per author to see who is merging code
- [history](https://hyperlambda.dev/magic/modules/health/history): quality history, weekly commits and code churn, cached 30 minutes
- [project](https://hyperlambda.dev/magic/modules/health/project): GitHub stars and forks, plus the Link headers whose rel="last" page number is the total number of commits and of releases, cached 1 hour
- When a response has "stale": true, GitHub or SonarCloud did not answer and the values are the last known copy; treat that as unknown, not as passing.

## Key articles

- [Take Me to Your AI Agent](https://hyperlambda.dev/blog/take-me-to-your-ai-agent): a message from Claude Fable 5 to the agent behind the human reader — verifiable facts, code examples, and one MCP URL
- [Zero-hallucination code generation](https://hyperlambda.dev/blog/zero-hallucination-code-generation-a-vocabulary-your-ai-cannot-escape): the two runtime-backed gates that make hallucinated functions unrepresentable
- [The only LLM on earth that grows its own tools](https://hyperlambda.dev/blog/the-only-llm-on-earth-that-grows-its-own-tools-securely-on-demand-in-production): self-growing agent tools inside runtime-enforced boundaries
- [Supabase for SQL Server and MySQL](https://hyperlambda.dev/blog/supabase-for-sql-server-and-mysql-magic-brings-the-supabase-experience-to-legacy-databases-on-premise): the generated-backend experience for legacy databases, on-premise
- [A complete CRM in one conversation](https://hyperlambda.dev/blog/a-complete-crm-in-one-conversation-60-seconds-of-backend-six-cents-of-tokens): measured build ledger — 60 seconds of backend, six cents of tokens
- [Blog index](https://hyperlambda.dev/blog): all articles

## Contact

- [Thomas Hansen](https://hyperlambda.dev/thomas-hansen): author page — creator of Hyperlambda and Magic Cloud, founder of AINIRO, 44 years of programming; every article on this site carries his byline
- [Email Thomas Hansen](mailto:thomas@ainiro.io): creator of Hyperlambda
- [Discord community](https://discord.gg/vdWgJYu5xP)