Alpha
Metalogos
A programming language for AI apps with security built into the language itself
2 of 6 done · In progress: Language core, interpreter and bytecode
Screenshots and mockups
Metalogos (mlog) is an open-source programming language written in Rust. LLM calls, memory, learning and self-adaptation are language constructs rather than libraries. It targets people who build websites, web services, bots and AI agents and want SQL injection, HTML injection (XSS) and secret leaks to be impossible or caught before the program runs. Dangerous operations are off by default, secrets and database queries have dedicated types, and a built-in static audit checks programs for common vulnerabilities. The project is run by a single owner together with AI coding agents, and this is openly disclosed in the repository.
What exists
- A tree-walking interpreter and a faster bytecode VM, with results cross-checked between them
- Dedicated types for secrets, database queries and HTML; unsafe string concatenation fails the check
- A static security audit (mlog audit) with named rules
- A built-in web server with routes, templates, sessions, CSRF protection and security headers
- AI constructs — sandboxed model calls, memory with decay, learnable patterns
- Local neural contours Reflex and Vision (image generation with provenance marking)
- A package manager, language server, editor grammar and documentation
- Signed release builds with an SBOM and verifiable checksums
Highlights
- Security is a property of the language, not of a library — whole classes of vulnerabilities cannot be expressed
- Loud degradation: when something is unsupported, the program says so instead of silently substituting a result
- A transparent process — hundreds of architecture decision records, including rejected ones, and open disclosure of AI use
Not there yet
- An independent external security audit
- Full parity between the VM and the interpreter
- A package registry server
- Image generation verified on real model weights
- The voice contour — only a stub so far
- A fully self-hosted compiler
Progress
- Language core, interpreter and bytecodeIn progress
- Static security auditIn progress
- Web server, package manager, language serverDone
- Signed releases with SBOMDone
- Package registryPlanned
- Compiler self-hostingPlanned
Next step: Bring the VM to parity with the interpreter.
Stack
- Rust
- Metalogos
- Pest
- Axum
- Tokio
- rusqlite
- Candle
- Cranelift
- GitHub Actions
- Docker
- SQLite
- Signed releases with SBOM
- Configurable LLM providers (external and local)
- Reflex small local models
- Vision image generation