mudocs
Repo ↗

A language that mutates its own bytecode

Built for practical security work

Mutant is a programming language built for practical security work, forensic automation, and cross-platform analysis tooling.

Get Mutant Workshop Repo ↗

from docs/WHAT_IS_MUTANT.md ↗

Workshop · DFRWS APAC 2026

Learn Mutant on a real case

An interactive path from your first program to a full investigation: the language, then artefacts, timestomping, malicious ads and registry persistence, ending on the QUILLDROP case.

Start the workshop → Intro to the language
  1. Introduction
  2. Intro to the language
  3. Artefact modelling
  4. Timestomping
  5. Malware in ads
  6. Registry persistence
  7. Triage toolkit
  8. Capstone: QUILLDROP

What is Mutant

It is not just a scripting language with a few security helpers bolted on. The language, compiler, virtual machine, runtime security layer, and example corpus are designed together so you can write small programs that do real investigations, produce reusable artifacts, and run under a security model that includes encryption, signing, anti-tamper checks, anti-debugging, anti-sandbox checks, and bytecode polymorphism.

  • It automates security and forensic workflows.
  • It can compile .mut source into encrypted bytecode and standalone binaries.
  • It has a large standard library (694 builtins across 41 categories): strings, math, hashing,…
from docs/WHAT_IS_MUTANT.md ↗

Pipeline

The parser builds an AST and the compiler walks it, emitting a flat byte stream directly — nothing sits in between. The VM then runs those bytes on an expression stack, with the polymorphic engine free to mutate them on the way through.

Bytecode IR reference ↗

Why Mutant · four value props

What you can do with it Mutant is useful when you want to turn an investigation idea into a repeatable script, a report, or a portable standalone tool. Why Mutant exists How do you make small programs that are useful for security work, easy to ship, and harder to inspect or tamper with? The security model Mutant’s security features are part of the story, not an afterthought. Practical use cases Here is the “why would I use this?” answer in plain language.

Tool carousel · drag to scroll

All docs ↗
Overview Big-picture explanations, quick reference material, and definitive orientation docs.
  • The [mutant](https://mudocs.aoiflux.xyz) Programming Language
  • Mutant in 30 minutes
  • What Is Mutant?
Open section Reference Canonical policies, reference sheets, migration matrices, and source-of-truth documentation.
  • Mutant Capability Reference
  • Mutant Language Reference
  • Mutant Cookbook
Open section Runtime Bytecode, VM, polymorphism, and execution internals.
  • Mutant IR / ByteCode Reference
  • Polymorphic Bytecode LLD (Current + Roadmap)
  • Binary Artifact Security Deep Dive
Open section Security Tamper resistance, sandboxing, remote scan policy, and security deep dives.
  • Security Policy
  • Configuration Policy
  • Evidence Handling Policy
Open section Tooling Editor integration, implementation workflow, and operational runbooks.
  • Contributing to Mutant
  • Security Implementation Guide (Current + Next Steps)
  • Debugging Mutant programs
Open section

VSCode extension

Mutant for VSCode

Diagnostics, hover, completion, rename, formatting and semantic tokens for .mut files, served over LSP by the mlsp process.

Install Onboarding guide

from docs/LSP_EXTENSION_LLD.md

Repo

aoiflux/mutant

Browse repo ↗