{"id":51490125,"url":"https://github.com/aoiflux/mutant","last_synced_at":"2026-07-26T07:00:44.669Z","repository":{"id":40555014,"uuid":"239243218","full_name":"aoiflux/mutant","owner":"aoiflux","description":"Mutant is an open-source, garbage-collected programming language that tries to enable security by default.","archived":false,"fork":false,"pushed_at":"2026-07-14T09:03:24.000Z","size":132053,"stargazers_count":60,"open_issues_count":0,"forks_count":10,"subscribers_count":3,"default_branch":"main","last_synced_at":"2026-07-14T11:07:04.000Z","etag":null,"topics":["encryption","go","golang","hacktoberfest","metamorphism","programming-language","security"],"latest_commit_sha":null,"homepage":"https://mudocs.aoiflux.xyz","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/aoiflux.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"docs/SECURITY_ANSWERS.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2020-02-09T03:57:16.000Z","updated_at":"2026-07-13T05:52:41.000Z","dependencies_parsed_at":"2023-12-04T07:32:11.148Z","dependency_job_id":"edc0b751-fa9c-44f3-b623-787d1a3950c3","html_url":"https://github.com/aoiflux/mutant","commit_stats":null,"previous_names":["aoiflux/mutant"],"tags_count":5,"template":false,"template_full_name":null,"purl":"pkg:github/aoiflux/mutant","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/aoiflux%2Fmutant","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/aoiflux%2Fmutant/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/aoiflux%2Fmutant/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/aoiflux%2Fmutant/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/aoiflux","download_url":"https://codeload.github.com/aoiflux/mutant/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/aoiflux%2Fmutant/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35904303,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-07-20T02:08:10.276Z","status":"online","status_checked_at":"2026-07-26T02:00:06.503Z","response_time":89,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["encryption","go","golang","hacktoberfest","metamorphism","programming-language","security"],"created_at":"2026-07-07T11:00:27.926Z","updated_at":"2026-07-26T07:00:44.662Z","avatar_url":"https://github.com/aoiflux.png","language":"Go","funding_links":[],"categories":["Go"],"sub_categories":[],"readme":"\u003cp align='center'\u003e\n  \u003cimg src='./logo.png' /\u003e\n\u003c/p\u003e\n\n# The [mutant](https://mudocs.aoiflux.xyz) Programming Language\n\nmutant is an open source programming language whose aim is to provide an\naccessible, secure system for programming \u0026 security research.\n\n# Key features of mutant\n\n1. KISS: The language is simple enough to be learnt in under an hour\n2. Compile time \u0026 Runtime Security: Encrypted byte code ensures security on disk\n   and in memory\n3. Cross Platform: MVM (Mutant Virtual Machine) makes sure that the language\n   works on **YOUR** machine\n4. Cross Compilation: mutant supports compiling standalone, independent binary\n   executables for multiple platforms.\n\n## Download \u0026 Install\n\n### Binary Distributions\n\nOfficial binaries are available in this repository's release section\n\n### Installing mutant from source\n\nPre-Installation: Download \u0026 Install [GoLang](https://golang.org/)\n\n```bash\ngit clone https://github.com/gaurav-gogia/mutant\ncd mutant\ngo install\n```\n\n### Build scripts\n\nMutant release packaging now uses Go-only build scripts (no external Rust/cgo\ntoolchain required).\n\nLinux/macOS/WSL:\n\n```bash\n./scripts/build.sh --host-only\n```\n\nWindows PowerShell:\n\n```powershell\n./scripts/build.ps1 -HostOnly\n```\n\nCommon options:\n\n- `--output-dir \u003cdir\u003e` / `-OutputDir \u003cdir\u003e`\n- `--assets-out \u003cdir\u003e` / `-AssetsOut \u003cdir\u003e`\n- `--final-name \u003cname\u003e` / `-FinalName \u003cname\u003e`\n- `--host-only` / `-HostOnly`\n- `--wasm-repl` / `-WasmRepl`\n- `--wasm-out-dir \u003cdir\u003e` / `-WasmOutDir \u003cdir\u003e`\n\nWasm build via scripts (optional):\n\n```bash\n./scripts/build.sh --host-only --wasm-repl\n```\n\n```powershell\n./scripts/build.ps1 -HostOnly -WasmRepl\n```\n\n## CLI Quick Start\n\nMutant now exposes a more structured CLI with explicit subcommands for\ngeneration, release packaging, and help.\n\n### Core usage\n\n```bash\nmutant\nmutant hello.mut\nmutant hello.mu --secure --signer-auth\nmutant help\nmutant help gen\nmutant help release\n```\n\n- `mutant` starts the REPL\n- `mutant hello.mut` compiles source into encrypted bytecode\n- `mutant hello.mu` runs compiled bytecode in the Mutant VM\n\n### Bytecode generation\n\n```bash\nmutant gen --src hello.mut\nmutant gen hello.mut --password \"My$tr0ngPass!\"\nmutant gen hello.mut --mutation 5 --seed 42\n```\n\n### Release asset generation\n\n```bash\nmutant gen assets\nmutant gen assets --out ./releaseassets\n```\n\nLegacy form is still supported:\n\n```bash\nmutant gen --release-assets --out ./releaseassets\n```\n\n### Standalone release builds\n\n```bash\nmutant release --src hello.mut\nmutant release hello.mut --os windows --arch amd64\nmutant release hello.mut --password \"My$tr0ngPass!\" --mutation 5\n```\n\nSupported release targets:\n\n- OS: `darwin`, `linux`, `windows`\n- ARCH: `amd64`, `arm64`, `arm`, `386`, `x86`\n\n### Runtime security options\n\nWhen running `.mu` files or embedded standalone payloads, these flags are\navailable:\n\n- `--secure` to enforce secure mode\n- `--compat` to allow weaker compatibility-mode checks\n- `--dev` for developer mode and local password fallback\n- `--signer-auth` to require trusted signer verification\n- `--security-log-level \u003cnone|error|info|debug|trace\u003e`\n- `--log-level \u003cnone|error|info|debug|trace\u003e` as an alias\n\n## Browser REPL (WASM, experimental)\n\nMutant includes an experimental browser REPL build target.\n\nBuild the wasm bundle into the default output folder:\n\n```bash\n./scripts/build.sh --host-only --wasm-repl\n```\n\n```powershell\n./scripts/build.ps1 -HostOnly -WasmRepl\n```\n\nBy default that produces a browser bundle in `dist/wasm-repl/`.\n\nThere is now a checked-in example page at `examples/wasm-repl/index.html`. Build\ninto that folder if you want the HTML page and wasm artifacts side by side:\n\n```bash\n./scripts/build.sh --host-only --wasm-repl --wasm-out-dir examples/wasm-repl\n```\n\n```powershell\n./scripts/build.ps1 -HostOnly -WasmRepl -WasmOutDir examples/wasm-repl\n```\n\nThen serve `examples/wasm-repl/` with any static server. The page expects these\nfiles to exist side-by-side:\n\n- `examples/wasm-repl/index.html`\n- `examples/wasm-repl/mutant_repl.wasm`\n- `examples/wasm-repl/wasm_exec.js`\n\nThere is also a dedicated local server command in this repository, so you do not\nneed a separate static server:\n\n```bash\ngo run ./cmd/wasmreplserve\n```\n\n```powershell\ngo run ./cmd/wasmreplserve\n```\n\nOptional flags:\n\n- `-addr 127.0.0.1:8123`\n- `-dir examples/wasm-repl`\n\nThe server maps `/` to `index.html` and serves `.wasm` with `application/wasm`.\nIt also refreshes `examples/wasm-repl/wasm_exec.js` from your current Go\ntoolchain and rebuilds `mutant_repl.wasm` automatically if the artifact is\nmissing or is not a real wasm binary.\n\nThe browser bridge currently exposes:\n\n- `mutantReplReady` (boolean)\n- `mutantReplEval(input)` -\u003e `{ ok, output?, error?, supported, builtins }`\n- `mutantReplComplete(prefix, mode)` -\u003e `{ ok, candidates }`\n- `mutantReplCompleteLine(line, mode)` -\u003e `{ ok, candidates }`\n\nMinimal JavaScript usage:\n\n```html\n\u003cscript src=\"./wasm_exec.js\"\u003e\u003c/script\u003e\n\u003cscript\u003e\n  const go = new Go();\n\n  async function start() {\n    const response = await fetch(\"./mutant_repl.wasm\");\n    const { instance } = await WebAssembly.instantiateStreaming(\n      response,\n      go.importObject,\n    );\n    go.run(instance);\n\n    const result = window.mutantReplEval(\"len([1, 2, 3])\");\n    console.log(result.output);\n\n    const completions = window.mutantReplCompleteLine(\"text_\", \"supported\");\n    console.log(completions.candidates);\n  }\n\n  start();\n\u003c/script\u003e\n```\n\nCurrent wasm REPL support intentionally focuses on a lightweight subset:\n\n- integers, booleans, strings\n- float literals and numeric expressions\n- arrays, hashes, indexing\n- `let` bindings and identifiers\n- function literals and user-defined function calls\n- struct/enum declarations, struct literals, and field access\n- browser-safe collection/print builtins: `len`, `first`, `last`, `rest`,\n  `push`, `pop`, `putf`, `putln`\n- browser-safe bytes builtins: `bytes_len`, `bytes_get`, `bytes_slice`,\n  `bytes_read_u16_le`, `bytes_read_u16_be`, `bytes_read_u32_le`,\n  `bytes_read_u32_be`, `bytes_read_u64_le`, `bytes_read_u64_be`,\n  `bytes_write_u16_le`, `bytes_write_u16_be`, `bytes_write_u32_le`,\n  `bytes_write_u32_be`, `bytes_write_u64_le`, `bytes_write_u64_be`,\n  `bytes_cstr_at`, `bytes_hex`, `bytes_char_from_int`, `bytes_int_from_char`,\n  `bytes_cursor_new`, `bytes_cursor_tell`, `bytes_cursor_seek`,\n  `bytes_cursor_eof`, `bytes_cursor_read_u8`, `bytes_cursor_read_u16_le`,\n  `bytes_cursor_read_u16_be`, `bytes_cursor_read_u32_le`,\n  `bytes_cursor_read_u32_be`, `bytes_cursor_read_u64_le`,\n  `bytes_cursor_read_u64_be`\n- browser-safe text builtins: `text_contains`, `text_index`, `text_count`,\n  `text_split`, `text_replace`, `text_levenshtein`, `text_similarity`,\n  `text_fuzzy_find`, `text_jaro_winkler`\n- browser-safe JSON builtins: `json_parse`, `json_stringify`\n- browser-safe regex builtins: `regex_match`, `regex_find`, `regex_find_all`,\n  `regex_replace`, `regex_capture_groups`\n- browser-safe policy builtins: `policy_load`, `policy_eval`, `policy_allow`,\n  `policy_rules`, `policy_trace`\n- browser-safe cache builtins: `cache_open`, `cache_put`, `cache_get`,\n  `cache_delete`, `cache_keys`, `cache_stats`, `cache_clear`, `cache_close`\n- browser-safe in-memory graph builtins: `db_open`, `db_close`, `db_add_node`,\n  `db_add_edge`, `db_add_artifact`, `db_add_relation`, `db_index_prop`,\n  `db_query_nodes`, `db_query`, `db_bfs`, `db_shortest_path`, `db_timeline`,\n  `db_stats`\n- assignment expressions (for example `i = i + 1`)\n- `for` loops with init/condition/post\n- `break` and `continue` inside loops\n- `return` statements with function short-circuit behavior\n- `if/else`\n- prefix `!` and unary `-`\n- infix `+ - * / \u003c \u003e == !=`\n\nFor the definitive WASM REPL support matrix and usage guide, see:\n\n- [docs/WASM_REPL_REFERENCE.md](docs/WASM_REPL_REFERENCE.md)\n\n## Practical Security and Forensics Examples\n\nThe `examples/` directory now includes practical scripts that can be used for\nreal security and forensics workflows:\n\n- `security_environment_report.mut`: Collects debugger/sandbox diagnostics,\n  computes a risk score, and writes a JSON report.\n- `network_service_recon_graph.mut`: Performs DNS + TCP reconnaissance, persists\n  a graph model, and writes a machine-readable findings report.\n- `ioc_event_triage.mut`: Seeds/parses IOC events from JSON, scores suspicious\n  activity, and emits triage findings.\n- `persistence_triage_commands.mut`: Captures startup and scheduled task\n  snapshots using command execution builtins and writes a forensic artifact.\n\nSuggested run sequence:\n\n```bash\nmutant examples/security_environment_report.mut\nmutant examples/network_service_recon_graph.mut\nmutant examples/ioc_event_triage.mut\nmutant examples/persistence_triage_commands.mut\n```\n\nArtifacts are written under `example_output/`.\n\n### Command execution requirements\n\n`persistence_triage_commands.mut` uses `cmd_builder`, `cmd_add`, and `cmd_run`.\nThose are policy controlled.\n\nOptional policy tuning:\n\n- `MUTANT_COMMAND_EXEC_TIMEOUT_MS`\n- `MUTANT_COMMAND_EXEC_MAX_OUTPUT_BYTES`\n\n## Featured In\n\n- [Gopherlabs Conference 2021 by CloudNativeFolks](https://youtu.be/rhSwwGSt90c?t=2223)\n- [Nullcon Goa Sep 2022](https://archive.nullcon.net/website/goa-2022/speakers/pushing-security-left-by-mutating-byte-code.php)\n- [Nullcon Goa Sep 2022 YouTube Video](https://youtu.be/ivrM8rytaKY)\n- [DEFCON AppSec Village 1st Place Winning Entry](https://eval.blog/research/breaking-the-mutant-languages-encryption/)\n- [Hackaday - This Week in Security](https://hackaday.com/2023/08/18/this-week-in-security-tunnelcrack-mutant-and-not-discord/)\n\n## Documentaiton\n\nFor all things mutant, please visit the\n[official website](https://mudocs.aoiflux.xyz) ^.^\n\nFor VS Code language tooling specifics (teaching hovers, signature help, and\nsnippet completions), see:\n\n- [docs/WHAT_IS_MUTANT.md](docs/WHAT_IS_MUTANT.md)\n- [docs/VSCODE_LSP_TEACHING_REFERENCE.md](docs/VSCODE_LSP_TEACHING_REFERENCE.md)\n- [docs/LSP_EXTENSION_LLD.md](docs/LSP_EXTENSION_LLD.md)\n- [docs/LSP_EXTENSION_ONBOARDING_60_MIN.md](docs/LSP_EXTENSION_ONBOARDING_60_MIN.md)\n\n## License\n\nMutant (including the programming language implementation and LSP in this\nrepository) is licensed under GNU AGPL v3.0 only.\n\nSee [LICENSE](LICENSE).\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Faoiflux%2Fmutant","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Faoiflux%2Fmutant","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Faoiflux%2Fmutant/lists"}