Documentation

The corpus

The definitive Mutant corpus, rendered from the repository's own markdown. Filter here, or open advanced search for full-text ranking.

Sections

Overview Big-picture explanations, quick reference material, and definitive orientation docs. Reference Canonical policies, reference sheets, migration matrices, and source-of-truth documentation. Runtime Bytecode, VM, polymorphism, and execution internals. Security Tamper resistance, sandboxing, remote scan policy, and security deep dives. Tooling Editor integration, implementation workflow, and operational runbooks.

Every document

Advanced search ↗

Security · SECURITY.md Security Policy Mutant is a language for security research and digital forensics. Its binaries sign and encrypt bytecode, detect tampering, and read memory, processes and disk images.Overview · README.md The [mutant](https://mudocs.aoiflux.xyz) Programming Language mutant is an open source programming language for security research and digital forensics.Security · docs/CONFIGURATION_POLICY.md Configuration Policy Mutant takes no configuration from environment variables. Using Mutant must never require anyone to set, or even think about, an environment variable.Tooling · CONTRIBUTING.md Contributing to Mutant Thanks for looking. This document covers what the project expects of a change, the two constraints that are not negotiable, and the handful of house rules that are unusual enough to be worth reading…Overview · docs/TUTORIAL_30_MIN.md Mutant in 30 minutes By the end of this you will have written a real triage program, run it against a log file, turned it into an encrypted artifact, and built it into a standalone binary you could hand to someone else.Security · docs/EVIDENCE_HANDLING_POLICY.md Evidence Handling Policy Mutant does not modify evidence. An image, volume, partition table, registry hive, archive or captured artifact opened by a Mutant program is read and never written, and the chain-of-custody manifest…Security · docs/DISCLOSURE_POLICY.md Disclosure Policy A disclosure grants a key, not a copy. The encrypted record a recipient receives is byte-identical to the one under custody, and what distinguishes one recipient from another is the set of segment…Reference · docs/CAPABILITY_REFERENCE.md Mutant Capability Reference This is the canonical, category-grouped catalog of every Mutant builtin. There are currently 694 registered builtins across 41 capability categories.Runtime · docs/BYTECODE_IR.md Mutant IR / ByteCode Reference Mutant compiles to a flat, linear byte stream. There is no intermediate representation between the AST and the bytecode – the compiler walks the AST and emits bytes directly.Tooling · docs/IMPLEMENTATION_GUIDE.md Security Implementation Guide (Current + Next Steps) This guide explains what to implement next without repeating already completed migrations.Security · docs/SECURITY_LLD.md Security Low-Level Design (LLD) This document defines the low-level security design for Mutant's bytecode generation, signing, transport, loading, verification, runtime execution, anti-debugging, integrity monitoring, and telemetry…Overview · docs/WHAT_IS_MUTANT.md What Is Mutant? Mutant is a programming language built for practical security work, forensic automation, and cross-platform analysis tooling.Reference · docs/MUTANT_LANGUAGE_REFERENCE.md Mutant Language Reference This document is the practical reference for Mutant language features, reserved keywords, and builtins.Reference · docs/COOKBOOK.md Mutant Cookbook Recipes organised by the question you are actually asking, not by which builtin category the answer happens to live in.Security · docs/SECURITY_DIAGRAMS.md Security Architecture Diagrams (Code-Synced) Visual reference for how Mutant's runtime security pipeline, policy decisions, and probe gates fit together, kept in sync with current code behavior.Overview · docs/COMPARISON.md Why Mutant, and when not to Every practitioner who finds this project already has a way of doing the work. This page is the honest comparison against the four most likely ones, including the cases where the answer is "keep what…Reference · docs/WASM_REPL_REFERENCE.md Mutant WASM REPL Definitive Guide It maps / to index.html and serves .wasm as application/wasm. It also refreshes wasmexec.js from your Go toolchain, and rebuilds mutantrepl.wasm if the file is missing or is not a real wasm binary.Reference · docs/MODULES.md Modules A Mutant program can be more than one file. import loads another .mut file, binds it to a namespace, and links it into the same program.Tooling · docs/DEBUGGING.md Debugging Mutant programs mutant debug is a Debug Adapter Protocol server. An editor starts it, speaks the protocol to it, and shows breakpoints, stepping, the call stack and variables in its own windows.Overview · docs/DETAILED_EXPLANATIONS.md Detailed Security Explanations (Current Behavior) This document explains the main security building blocks in simple language.Reference · docs/QUICK_REFERENCE.md Mutant Security Quick Reference Mutant now ships with layered anti-tamper and hardening controls for the signed artifact, runtime, and risky builtins.Runtime · docs/POLYMORPHIC_BYTECODE_LLD.md Polymorphic Bytecode LLD (Current + Roadmap) This LLD explains the real status of Mutant polymorphic bytecode support and the safe path to expand it.Security · docs/SECURITY_RUNBOOK.md Security Runbook This runbook explains how to triage and respond to Mutant runtime security events using current code behavior.Reference · docs/EXECUTION_MODES.md Execution Modes Mutant has three execution modes and one modifier. This document is the definitive statement of what each one changes; every row below is traced to the code that implements it.Reference · docs/LIMITS_REFERENCE.md Mutant limits reference This document is generated by go run ./cmd/gendocs from the source tree. Do not edit it by hand; edit the constant's doc comment and regenerate.Security · docs/SECURITY_ANSWERS.md Security Answers (Current Code) This FAQ is the student-friendly, code-accurate version of Mutant security behavior.Tooling · docs/TESTING.md Testing Mutant programs mutant test runs every test.mut file it finds. A test file is an ordinary Mutant program — it is compiled and run the way any program is, so it can import the module it is testing — and what it…Tooling · mutant-vscode-extension/README.md Mutant Language Tools The security family. These report a program that compiles and runs, which is what makes them worth having: nothing else in the toolchain objects.Security · docs/SECURITY_ENHANCEMENTS.md Security Enhancements Roadmap (Code-Synced) This document tracks enhancement work from current implementation to future hardening.Runtime · docs/BINARY_ARTIFACT_SECURITY_DEEP_DIVE.md Binary Artifact Security Deep Dive The flag carries a path, never key material. Key material in an environment variable is invisible in the command an analyst records and is inherited by every child process; a path is safe to write…Tooling · docs/LSP_EXTENSION_ONBOARDING_60_MIN.md Mutant LSP + VS Code Extension Onboarding in 60 Minutes This guide is a practical first-hour path for a junior engineer to understand, run, debug, and safely modify Mutant language tooling.Security · docs/SANDBOX_DETECTION.md Sandbox Detection Feature The sandbox detection module identifies containerized and virtualized runtimes and feeds that signal into the runtime tamper-response pipeline.Security · docs/ANTITAMPER_PROBE.md Anti-Tamper Probe Integration This document explains how anti-tamper probes work today in Mutant, including the exact enablement gates and how runner enforcement differs from builtin diagnostic calls.Tooling · docs/LSP_EXTENSION_LLD.md Mutant LSP + VS Code Extension Low-Level Design (LLD) This is the implementation-level developer guide for the Mutant language tooling stack.Security · docs/ANTITAMPER_PROBE_ENABLEMENT_LLD.md Anti-Tamper Probe Enablement LLD This LLD defines how anti-tamper probe execution is enabled, how runner enforcement is gated, and how diagnostics differ from enforcement.Security · docs/PROCESS_INJECTION_DETECTION_LLD.md Process Injection Detection LLD This Low Level Design (LLD) explains how Mutant currently detects process injection-related tampering and how to expand this into a richer, multi-process detector in the future.Security · docs/REMOTE_PROCESS_SCAN_DEEP_DIVE.md Remote Process Scan Deep Dive This document describes the current remote process scan architecture and integration points.Security · docs/SECURITY_LLD_TRACEABILITY.md Security LLD Traceability Matrix This document provides end-to-end traceability from security design intent to concrete implementation and validation.Reference · docs/GRAPH_DATABASE.md Graph Database The db builtins embed a property graph database in the mutant runtime for modeling entities and the relationships between them: people and documents in a knowledge graph, or processes, files, and…Reference · docs/SECURE_NETWORKING.md Secure Networking & Traffic Interception Mutant ships a networking toolkit in its standard library so that tools such as TLS clients/servers and mitmproxy-style interception proxies can be written entirely in Mutant source.Reference · docs/STRUCTURED_DATA.md Structured Data: The Formats Evidence Arrives In Every fallible builtin here follows the language convention of returning (result, err); destructure with let value, err = ... and check err before touching value.Reference · docs/RUNTIME_INTEGRATION.md Runtime Integration: Embedding Lua Mutant can embed and run Lua scripts from a string, a file, or a remote HTTP endpoint.Reference · docs/DETECTION_RULES.md Detection rules — Sigma Sigma is the portable format for log detections: a rule is a YAML file naming the fields to look at and the condition that has to hold, and a backend compiles it into whatever the SIEM of the day…Reference · docs/INTERCHANGE_SCHEMAS.md Interchange schemas Mutant parses fourteen kinds of artifact and each parser hands back its own shape, because each artifact is its own shape: an $MFT record carries eight timestamps, a Prefetch file carries a list of…Overview · CHANGELOG.md Changelog All notable changes to Mutant are recorded here.Security · docs/advisories/README.md Mutant advisories MVF-2026-0001 — Mutant Vulnerabilities & Fixtures, the year it was assigned, and a four-digit serial.Security · docs/advisories/MVF-2026-0001.md MVF-2026-0001: compiling a program ran whatever builtins its macros called A macro is expanded while the compiler is running, and expansion resolved the names in a macro body against the whole builtin registry.Security · docs/advisories/MVF-2026-0002.md MVF-2026-0002 — the disclosure ledger's own records could be redacted The four ledgerredact builtins checked the handle, the id, the reason and whether the reason leaked what it redacted — and nothing about what the node or edge was.Security · docs/advisories/MVF-2026-0003.md MVF-2026-0003 — an audit log with its first entries deleted verified as intact auditverify could be handed a written audit log with a run of entries deleted from the front and report it as intact, anchored and complete.Security · docs/advisories/MVF-2026-0004.md MVF-2026-0004 — an audit entry with no sequence number ended the walk as though intact The audit walk carried "did the chain break" and "where did it break" in a single number, where zero meant no break.Security · docs/advisories/MVF-2026-0005.md MVF-2026-0005 — two strings sharing one 64-bit digest were one hash entry A hash key was a type and a 64-bit FNV-1a digest, and nothing else. Two different strings whose digests collide were therefore the same key: the second write replaced the first, the table's length…Security · docs/advisories/MVF-2026-0006.md MVF-2026-0006 — a relabelled disclosure package verified against the genuine root discloseverify ran ten named checks, and nine of them only compared one part of a disclosure package with another part of the same package's manifest.Security · docs/advisories/MVF-2026-0007.md MVF-2026-0007: a SQL query the documentation called read-only could modify evidence The affected range is the range checked by source at each tag, not inferred from a changelog: sqlitequery first appears at v2.3.0 and the confinement below is absent through v2.5.0.Security · docs/advisories/MVF-2026-0008.md MVF-2026-0008 — a classified buffer put in a report table was rendered to hex and written out Evidence plaintext read out of a record comes back as a buffer carrying a classified mark, and a fixed list of sinks refuses any argument holding one.Security · docs/advisories/MVF-2026-0009.md MVF-2026-0009 — an inherited environment variable chose the signing key and the trust anchor The local keystore directory was built from the process's idea of the home directory, which on Unix is $HOME and on Windows is %USERPROFILE% — a variable inherited from whatever launched Mutant and…Security · docs/advisories/MVF-2026-0010.md MVF-2026-0010 — the editor extension's release task passed the password in the argument list The VS Code extension's task generator put a task's password property on the command line of the Mutant process it spawned, as --password <value>, where any process running as the same user could…Security · docs/advisories/MVF-2026-0011.md MVF-2026-0011 — a ledger redacted by an older build could have lost a withdrawal silently This is the follow-up to MVF-2026-0002, and it concerns the damage that defect could already have done.Security · docs/advisories/MVF-2026-0012.md MVF-2026-0012: a header count sized an allocation before the bytes were there Five places in the artifact parsers pre-sized a slice from a count read straight out of the file being parsed.Security · docs/advisories/MVF-2026-0013.md MVF-2026-0013: a binary plist that shares its containers expanded exponentially A binary plist stores its values once and refers to them by index, so the same object can be referenced from many places.Tooling · mutant-vscode-extension/CHANGELOG.md Changelog Released with mutant 2.6.1. Nothing the extension does has changed.