Build ambitious Axum applications with one coordinated Rust toolchain—while keeping authorization, data, deployment, and provider boundaries explicit.

Start building · Explore Rullst · Contribute · Why Rullst?

🛡️ Open the full v12 verification dashboard (37 workflows)

🛡️ v12 Main Verification Dashboard

Rullst applies layered compile, test, architecture, portability, and security checks.
Badges are pinned to the main branch; they report the latest matching run, not a certification or deployment guarantee.

Continuous or change-aware gate	v12 main status	Actual scope
Rust CI		Format, all-target/all-feature Clippy, tests on Linux/macOS/Windows, Cargo-aware doctests sourced from all 52 public tutorials, strict DB boundaries, feature boundaries, generated-code checks, and MSRV 1.96.0.
Declared MSRV		Every publishable v12 manifest declares Rust 1.96.0 and CI runs an explicit workspace all-feature check with that toolchain.
GitHub Actions lint		Validates workflow syntax, expressions, embedded shell, and full-SHA third-party Action pins.
Documentation		Builds the mdBook and rejects broken local links and anchors; scheduled/manual runs also preserve an informational external-link report.
End-to-end smoke		Boots the release blog example and verifies HTTP, security headers, form flow, and SQLite persistence.
Codecov / LLVM coverage		The badge reports the framework_libraries component enforced at ≥90%. The public whole-repository aggregate and the separately visible CLI/proc-macro components remain available in Codecov; Coverage CI uploads their real LCOV evidence with OIDC.
Cargo Audit		RustSec advisory scan with only governed, expiring exceptions.
Security exception governance		Cross-checks scanner allowlists against the owner/expiry ledger, then independently reruns Cargo Audit.
Cargo Deny		Advisory, license, ban, and source policy.
CodeQL SAST		Rust semantic analysis after an all-target/all-feature build.
OpenSSF Scorecard		The badge renders the score from the official public Scorecard JSON report; the pinned Scorecard workflow publishes OIDC-authenticated results on each main push and weekly. A score is evidence, not a security certification.
Cargo Machete		Unused direct dependency detection.
SemVer checks		Supported library APIs are compared with exact latest non-yanked registry baselines; never-published packages and unsupported proc-macro/binary surfaces are reported explicitly.
Zero-panics policy		Denies panic-family operations in published production targets and generated runtime templates.
Unsafe boundary		Denies new production unsafe code outside the reviewed OS/FFI allowlist.
Secret scanning		Verified-secret scan across the configured Git history range.
Spellcheck		Repository-wide typo detection.
Crate architecture policy		Compares the real publishable-crate dependency graph with a versioned, reviewed repository policy.
WebAssembly matrix		Compiles Core, the public facade and macros for browser Wasm and WASI Preview 1.
Bare-metal no_std matrix		Builds IoT helpers for Cortex-M and RISC-V targets; this is compile evidence, not hardware testing.
IoT integration		Host tests, signed OTA invariants, and a Cortex-M build.
IoT crypto containment		Path-aware signed OTA, Vault, advisory, and simulator-boundary checks; no PQC/HSM certification claim.
Omni desktop matrix		Generates fresh web shells and checks their Tauri crates on Linux, macOS and Windows; no installer, signing or store claim.
Omni Android compile		Generates a fresh shell and compiles an unsigned Android debug APK; no physical-device, Play testing/signing or store claim.
Omni iOS simulator		Path-aware fresh scaffold generation and compilation on a macOS iOS simulator target; no device, signing or App Store claim.
PR security evidence		Pull-request-only bounded IDOR/RBAC heuristics and CycloneDX SBOM artifact.

Deep or irreversible workflows are intentionally not presented as continuously green main gates:

Deep evidence	Trigger and enforcement
Benchmark regression	Weekly, main push, or manual; eight published groups backed by nine Criterion benchmark binaries emit non-blocking alerts at a 20% regression.
Property testing	Weekly/manual release-mode invariant testing with 10,000 configured cases.
TSan and ASan	Daily/manual nightly-toolchain package matrices.
Fuzzing / corpus minimization	Forty manual libFuzzer jobs; weekly/manual corpus maintenance is informational.
OWASP ZAP	Manual baseline over three release surfaces: generated REST API and complete LMS are blocking with no ignored alerts; the deliberately CDN-backed blog showcase remains an explicitly informational boundary.
Kani, Miri, mutation testing, cargo-udeps	Manual or scheduled research signals with explicitly non-blocking portions.
GitHub Pages	Deploys the unreleased v12 documentation preview from main; it is not a code-quality gate.
Release and provenance	Exact version tags only: full verification, package-all, evidence bundle, checksums, attestations, ordered crates.io publish, and the official generic SLSA3 provenance generator. This does not yet claim project-wide SLSA Level 3 certification; add a level badge only after a successful RC-tag run and an independent requirements review.

Scheduled events use the repository's default branch, so scheduled and continuous v12 evidence now refer to main. The recommended required-check profile and the exact scope of all 37 workflow definitions are documented in WORKFLOWS.md.

📖 Read the detailed breakdown of all CI/CD and security workflows.

🧭 Capability Status & Vision Decisions preserves ambitious features that are partial or not implemented, with an explicit recommendation and rationale for each one.

📋 Simple Capability Status and the per-commit quality scorecard keep feature progress separate from SHA-bound engineering evidence.

Rullst coordinates routing, auth, ORM, bounded background jobs, and developer tooling behind explicit APIs. Compile-time generation reduces setup while keeping deployed security and operational decisions visible for review by humans and coding agents. Read the complete design philosophy.

New to Rust or Rullst? The complete walkthrough covers Rust installation, a v12 preview dependency, the first typed route, error handling, and running the server on Linux, macOS, and Windows:

📖 Build your first Rullst application with the Zero-to-Hero tutorial

🌐 Create and verify your first JSON REST API includes a complete main.rs, secure-header middleware, the run command, and a curl request.

Already have Rust? Start the unreleased v12 preview and continue with the documented src/main.rs:

cargo new my_app
cd my_app
cargo add rullst --git https://github.com/Rullst/Rullst.git --branch main
cargo add tokio --features full

The Git dependency tracks active development and is for evaluation only. Keep the generated Cargo.lock, do not deploy from mutable main, and use a versioned crate release or immutable tag in production.

SaaS Blueprint	LMS Blueprint

Rullst Omni follows a web-first, platform-enhanced architecture: the Rullst web application and server remain canonical, while a generated Tauri shell packages the same experience for desktop, Android and iOS behind an exact-origin navigation boundary and no privileged remote IPC. The portable rullst.client v1 contract gives web and platform code the same bounded typed JSON envelopes without trusting client-supplied roles or ownership. The opt-in native offline-sync foundation adds account-bound encrypted snapshots, idempotent FIFO proposals, explicit conflict/resync/recovery state and a bounded push/pull coordinator over application-owned authenticated transports; platform secure-key/storage, concrete HTTP/background integration and device evidence remain application work, so the shell itself is not advertised as offline-first. See the Omni tutorial and offline-sync tutorial.

The v12 CLI can plan and apply a backed-up framework upgrade from the application root:

cargo rullst upgrade --dry-run
cargo rullst upgrade

It updates the coordinated Rullst dependency train, scans known source risks, applies compiler fixes, runs a Cargo check gate, and restores controlled files after a failure. It does not migrate production data or invent application security policy. See the assisted upgrade tutorial and the v5 → v12 guide.

The documentation separates released behavior, v12 preview capabilities, migration guidance, and roadmap boundaries. Explore the guides and evaluate the features your application intends to enable:

👉 Explore the Official Website & Docs

🔑 Maintainer GitHub CLI installation & safe login

💬 Join the Community on Discord

Found a bug? Report an Issue

Documentation, tests, reproductions, accessibility reviews, provider contracts, and benchmark methodology are first-class contributions—not secondary work.

Rullst does not claim to be universally faster than every alternative. Runtime results depend on enabled features, handlers, databases, deployment settings, hardware, and workload. The implementation choices that can be inspected today are:

• html! rendering: expands into escaped Rust String construction without a runtime Virtual DOM; dynamic values are escaped by the generated code.
• routes! registration: expands at compile time into ordinary, typed Axum route registrations. Request matching and middleware still execute at runtime.
• Bounded local primitives: Ammonia allowlist sanitization, RBAC ownership checks, AI heuristics, and the tenant-partitioned in-memory RAG retriever have explicit limits; they are not described as zero-cost.
• Development build tuning: generated configuration may select an installed mold or lld. Explicit --hot-reload projects use an authenticated, generation-bounded development-library swap plus an offline same-origin browser refresh path; failed builds retain the serving router. The CLI reports observed rebuild/swap time because results vary by host and project.

Eight published Criterion benchmark groups, backed by nine benchmark binaries because the ORM group combines two, track selected microbenchmarks. Their shared-runner history is regression evidence for those inputs, not a production throughput promise. The ORM group also runs five equivalent typed-SQLite operations through pinned Rullst, Diesel and SeaORM dependencies; it preserves unfavorable results and does not claim universal superiority. The separate cross-framework harness currently measures a historical Rullst 4.x application and must not be used as v12 performance evidence until its versions and runs are refreshed.

Open the public benchmark hub for the per-crate dashboards, or read the benchmarking methodology before interpreting a number.

• 🎨 Studio & Nexus: a loopback-first developer dashboard at :5555 and a fail-closed /nexus model CRUD panel with explicit metadata, opt-in trusted tenant scoping and transaction-coupled mutation audit.
• 🛡️ Security helpers: bounded request heuristics for selected XSS, SQLi, traversal, and command-injection indicators plus explicit role/ownership guards. These controls do not replace application authorization or testing.
• 🔑 Passkeys/WebAuthn: one-time challenge handling and ES256 registration and assertion verification within the documented none-attestation scope; deployments own RP/origin policy and atomic counter persistence.
• 🌐 Guarded AI client: supported Gemini, Claude, OpenAI, DeepSeek, Ollama, and capability-declared OpenAI-compatible transports with bounded injection heuristics and PII masking on the high-level client path. Passing a heuristic is not authorization or model certification.
• 💳 Capital adapters: Stripe and LemonSqueezy checkout/webhook adapters use cryptographic HMAC verification; Axum and opt-in Actix middleware share one bounded verifier. The included process-local metrics/event buffer is a preview helper, not an accounting ledger or authoritative MRR.
• 🔐 Encryption & memory hygiene: #[orm(encrypted)] transparently protects string fields on generated ORM writes/reads using versioned AES-256-GCM, authenticated table/column context, key identifiers, and keyrings. Randomized fields are intentionally not queryable without a separate blind index; key custody and OS/allocator memory exposure remain external.
• 🔄 Transactions: Orm::transaction scopes generated queries through CURRENT_TX, commits on success, and rolls back on failure; its current closure API returns a boxed future.
• 📬 Durable outbox: relational domain changes can enqueue an explicit, idempotent event in the same transaction. Lease/token claims, bounded retry and dead-letter are covered on SQLite, PostgreSQL, MySQL and MariaDB; delivery is at least once and consumers remain responsible for idempotency.
• 🔎 Scout search: an opt-in feature provides bounded Meilisearch, Elasticsearch and Algolia projections with deterministic offline fallbacks; only Meilisearch currently has a live pinned service contract in CI.
• 🧠 Typed pgvector search: orm-pgvector plus strict-postgres provides SQLx-compatible vectors and parameterized L2/cosine/inner-product queries, exercised against a digest-pinned PostgreSQL + pgvector service. The AI crate separately composes bounded tenant-aware retrieval, guarded context/generation, sources and audit; datastore authorization and index tuning remain application work.
• 🧭 Specialized vector and key-value stores: orm-qdrant provides bounded dense-cosine collection/upsert/delete/query operations, while orm-redis provides namespaced Hash, Set and Sorted Set operations. Deterministic fallbacks and digest-pinned live lifecycles cover both; hosted availability, cluster/failover and application authorization remain explicit.
• 🔄 Database introspection: cargo rullst make:models-from-db generates starter model files through parameterized SQLite/PostgreSQL/MySQL metadata queries and fail-closed identifier validation. Table module names are normalized, while columns that would require unsupported ORM remapping are rejected before files are written; bounded type mappings, keys, relations, schemas, and generated code still require review.
• 🔍 Static project inspection: cargo rullst inspect scans conventional routes! entries and model declarations or prints the generated JSON schema; it is not a runtime route inventory.
• 🛡️ Zero-panic policy: published production targets are gated against panic!, unwrap, and expect. This is an engineering policy, not a promise that applications or dependencies can never terminate unexpectedly.
• ⚡ Scaffolding and deployment helpers: generators cover application starting points and deployment manifests; provider CLIs, generated output, infrastructure, and production rollout remain operator-reviewed boundaries.

Rullst scaffolds several presentation strategies. They are alternatives, not a claim that every mode has identical maturity, bundle size, or migration cost.

Rullst is built on Axum, Tokio, Tower, and SQLx, and exposes standard routers and pools at important integration points. Some framework helpers and generated structures still require an explicit migration when ejecting:

• Incremental Adoption: Mount existing axum::Router instances directly into rullst::server::Server.
• Typed Server Functions: One concrete async Rust signature generates an explicit Axum route and matching Wasm caller over a bounded, versioned protocol—without runtime reflection or silent default values. See the server-functions tutorial.
• Standard SQLx: Run raw sqlx::Pool queries alongside rullst-orm without wrappers.
• Escape Hatch: Use the CLI eject output as a migration starting point and review the generated code before deployment.
• 📖 Read the full Axum & SQLx Migration & Escape Hatch Guide.

Rullst is a good fit when an Axum-based application benefits from a coordinated CLI, ORM, authentication helpers, bounded background workers, provider adapters, and local developer tooling in one versioned workspace. A smaller HTTP library may be preferable when the application needs only routing and middleware; a frontend-first framework may be preferable when client component composition is the primary architecture.

For a concise, evidence-bounded explanation of the framework's strongest technical differentiators, read Why Rullst?.

This is a positioning guide, not a feature-score leaderboard. The projects solve different problems and can sometimes be used together.

Rullst is not presented as universally better. Its distinctive bet is that a single, explicit CLI and release train can coordinate a broad backend stack without hiding the underlying Axum, Tokio, Tower, and SQLx integration points.

Evaluate only the features you intend to enable. In particular:

• security middleware is defense-in-depth and does not replace authorization, validation, proxy configuration, or penetration testing;
• generated OpenAPI, TypeScript, deployment, and ejection output requires review and compilation in the target application;
• Studio is a local developer tool and Nexus requires an explicit authenticated access policy;
• live NFS-e, Alipay RSA2, MQTT/CoAP transports, HSM/PQC, S3/R2, and Connect message brokers are not stable capabilities in version 12. IoT packet encoders do not imply those network or hardware integrations.
• persistence support is capability-specific: SQLx Active Record targets SQLite/PostgreSQL/MySQL/MariaDB; the bounded blank/API profile can use Turso/libSQL as a typed primary; MongoDB, DuckDB, SurrealDB, Qdrant and Redis retain explicit capability APIs rather than a fictional universal ORM.

Rullst is a unified monorepo. Core, ORM, Connect, and the domain crates are versioned and tested together so compatibility regressions can be caught in one workspace; consumers should still follow SemVer notes and the release matrix for the exact version they use.

Explore the Monorepo Ecosystem:

• 🦀 rullst-core: Runtime-only-by-default HTTP server, routing engine, and telemetry kernel; ORM and SQLite queues are explicit features.
• 💾 rullst-orm: Active Record, durable opt-in outbox, Scout, pgvector, bounded Qdrant and namespaced Redis structures for SQLite/PostgreSQL/MySQL/MariaDB, a bounded Turso-primary blank/API profile, and capability APIs for MongoDB, DuckDB and SurrealDB; applications still own tenant predicates and database policy. See Polyglot Persistence, Transactional Outbox, Scout Search and RAG/Vector Search.
• 🛡️ rullst-auth: Passkeys/WebAuthn, Argon2id, encrypted cookie sessions, opt-in application JWT policy, and RBAC authorization.
• 🔒 rullst-security: Bounded RASP request heuristics, honeypot traps, HTML/CSP helpers, and an HMAC-chained audit log.
• 🤖 rullst-ai: Guarded provider-agnostic clients (Gemini, OpenAI, Claude, DeepSeek, Ollama), a capability-declared OpenAI-compatible local/cloud adapter, bounded tenant-aware audited RAG, structured output, and authorized local-tool foundations. See Tenant-Bound RAG.
• 💰 rullst-capital: SaaS MRR/ARR analytics, payment-provider adapters, bounded provider-specific coupons/trial extensions, shared idempotent Team/Workspace quotas with opt-in four-dialect SQL accounting, and bounded checksum-pinned NFS-e DPS/XSD/XMLDSig/mTLS preparation; live Alipay RSA2 and official NFS-e authorization remain fail-closed roadmap/external-evidence work.
• 🔌 rullst-connect: OAuth2/OIDC social login with strict discovery, rotating JWKS caches, bounded process-local automatic token refresh, provider/account-bound encrypted refresh snapshots, offline provider fallbacks, an explicitly mounted signed loopback IdP fixture, and an opt-in one-active-challenge tower-sessions state/PKCE/nonce transaction. Queue transports currently live in Core.
• 📨 rullst-messaging: Versioned bounded envelopes, topic-scoped idempotent publication, consumer-group fan-out, expiring ACK leases, retry/DLQ, a canonical envelope codec, allowlisted W3C trace context, a deterministic process-local broker and durable local SQLite with an explicit AES-256-GCM header/payload profile. Metadata remains visible and the codec is not a transport; remote Kafka/RabbitMQ/Redis Streams/NATS/cloud adapters remain roadmap work. See Bounded Brokered Messaging.
• 📡 rullst-iot: no_std telemetry/frame helpers, Ed25519-signed OTA manifest verification, and a durable rollback-counter CAS boundary; concrete device storage, flashing/bootloader integration, MQTT transport, HSM, and PQC remain roadmap work.
• ✉️ rullst-mail: Transactional email drivers with mandatory validation, background delivery, opt-in bounded attachment inspection, shared-local suppression and secret-minimized observations, plus safe fiscal-receipt and dunning scaffolds.
• 📊 rullst-studio: Developer Control Room (:5555) with live telemetry and data browser.
• ⚙️ rullst-nexus: Fail-closed registered-model Admin CMS (/nexus) with opt-in trusted tenant scope, transaction-coupled mutation audit, and a local security-event view.
• 🛠️ cargo-rullst: CLI scaffolding, bounded AST IDOR checks, and deployment helpers.

Rullst is an opinionated, Axum-based full-stack framework for teams that want coordinated Rust tooling without hiding application security boundaries.