AllFrame
The Composable Rust API Framework
One frame to rule them all. Transform, compose, ignite.
What is AllFrame?
AllFrame is a complete Rust web framework with a built-in HTTP/2 server, designed and evolved exclusively through Test-Driven Development (TDD). Every feature, macro, and public API has a failing test before it is written.
AllFrame includes everything you need to build production APIs:
- Built-in HTTP/2 server powered by Hyper - no external server required
- Multi-protocol support - REST, GraphQL, and gRPC from a single codebase
- Zero external runtime dependencies - only Tokio, Hyper, and std
We ship composable crates that give you exactly what you need:
- ✅ Project Scaffolding -
allframe ignitecreates Clean Architecture projects (v0.1) - ✅ Compile-time DI - Dependency injection resolved at compile time (v0.2)
- ✅ Auto OpenAPI 3.1 - API documentation generated automatically (v0.2)
- ✅ CQRS + Event Sourcing - Production-ready CQRS infrastructure (Phases 1-5) [NEW!]
- CommandBus with 90% boilerplate reduction
- ProjectionRegistry with automatic lifecycle
- Event Versioning with auto-upcasting (95% reduction)
- Saga Orchestration with automatic compensation (75% reduction)
- Pluggable backends (in-memory, AllSource)
- ✅ OpenTelemetry - Tracing support built-in (v0.3)
- ✅ Scalar API Documentation - Beautiful OpenAPI docs (<50KB, 10x smaller than Swagger!) [COMPLETE!]
- CDN version pinning for stability
- SRI hashes for security
- CORS proxy for "Try It" functionality
- Custom theming and CSS
- Production-ready with 42 tests
- ✅ GraphQL Documentation - Interactive GraphiQL playground (<100KB) [COMPLETE!]
- GraphiQL 3.0 playground integration
- Interactive schema explorer
- WebSocket subscription support
- Query history persistence
- Dark/Light themes
- Production-ready with 7 tests
- ✅ gRPC Documentation - Interactive service explorer [NEW!]
- gRPC reflection for auto-discovery
- Service and method browser
- Stream testing (unary, server, client, bidirectional)
- TLS/SSL support
- Custom metadata headers
- Production-ready with 7 tests
- ✅ Contract Testing - Built-in contract test generators [COMPLETE!]
- Automatic test generation from router
- Schema validation framework
- Coverage reporting (shows test coverage percentage)
- Breaking change detection
- Production-ready with 9 tests
- ✅ Protocol-Agnostic Routing - Write once, expose via REST, GraphQL & gRPC [COMPLETE!]
- ✅ Full REST adapter with path parameters and HTTP methods
- ✅ Full GraphQL adapter with queries, mutations, and schema generation
- ✅ Full gRPC adapter with all streaming modes and proto generation
- ✅ Single handler exposed via multiple protocols
- ✅ Automatic schema generation (OpenAPI, GraphQL SDL, .proto)
- ✅ Protocol-specific error handling
- Production-ready with 78 tests across 5 phases
- ✅ Native MCP Server - LLMs can call your API as tools [Separate Crate - 100% Zero Bloat!]
- ✅ Auto-discovery: Handlers automatically become MCP tools
- ✅ JSON Schema generation and validation
- ✅ Type coercion (string → number, boolean)
- ✅ Tool listing and invocation
- ✅ Claude Desktop integration ready
- Separate
allframe-mcpcrate with 33 tests - Zero overhead when not used (opt-in only)
- ✅ Resilience Patterns - Production-ready retry, circuit breaker, rate limiting [NEW!]
- RetryExecutor with exponential backoff and jitter
- CircuitBreaker with Closed/Open/HalfOpen states
- KeyedCircuitBreaker for per-resource isolation (database, API, etc.)
- RateLimiter with token bucket (per-endpoint, per-user)
- Redis-backed RateLimiter for distributed rate limiting
- AdaptiveRetry that adjusts based on success rates
- RetryBudget to prevent retry storms
#[retry],#[circuit_breaker],#[rate_limited]macros
- ✅ Layered Authentication - Protocol-agnostic auth primitives [NEW!]
- Core
Authenticatortrait with zero dependencies - JWT validation (HS256, RS256, EdDSA) with
auth-jwt - Axum extractors and middleware with
auth-axum - gRPC interceptors with
auth-tonic AuthContext<C>for type-safe claims access
- Core
- ✅ Security Utilities - Safe logging for sensitive data [NEW!]
- URL/credential obfuscation for logs
#[derive(Obfuscate)]with#[sensitive]field attributeSensitive<T>wrapper (Debug/Display always shows "***")- Smart header obfuscation (Authorization, Cookie, API keys)
- ✅ Graceful Shutdown - Production-ready shutdown utilities [NEW!]
ShutdownAwareTaskSpawnerfor named tasks with automatic cancellationGracefulShutdownExtfor cleanup orchestration with error handlingspawn_with_result()for tasks that return valuesShutdownExttrait for making any future cancellable
- 📋 LLM-powered code generation -
allframe forgeCLI (v0.6 - planned)
Target: Binaries < 8 MB, > 500k req/s (TechEmpower parity with Actix), and 100% test coverage enforced by CI.
Current Status: v0.1.12 - Protocol-Agnostic Routing Complete! 455+ tests passing. Production-ready multi-protocol routing, MCP server, layered authentication, enhanced resilience (KeyedCircuitBreaker, Redis rate limiting), and safe logging! Latest: Ignite Vision - Cloud-native microservice architecture generator roadmap!
Quick Start
# Install AllFrame CLI
# Create a new project
# Run your API
# Visit http://localhost:8080/swagger-ui
Try the Examples
AllFrame includes comprehensive examples demonstrating all features:
# REST API example - Build REST APIs with AllFrame
# GraphQL API example - Build GraphQL APIs with AllFrame
# gRPC API example - Build gRPC services with AllFrame
# Multi-Protocol example - Same handler, multiple protocols!
# Resilience patterns - Retry, circuit breaker, rate limiting
# Security utilities - Safe logging and obfuscation
# Graceful shutdown patterns - Task spawning, cleanup, cancellation
See examples/README.md for detailed documentation.
Core Features
🔧 Compile-Time Dependency Injection
use *;
// Dependencies resolved at compile time - zero runtime overhead
📝 Beautiful API Documentation with Scalar
use *;
use ;
// Generate OpenAPI 3.1 spec with server configuration
let spec = new
.with_server
.with_server
.generate;
// Configure Scalar UI (10x smaller than Swagger!)
let config = new
.theme
.cdn_url
.proxy_url; // Enable "Try It" functionality
let html = scalar_html;
// Beautiful, interactive docs at /docs
Features:
- 📦 <50KB bundle (vs 500KB for Swagger UI)
- 🎨 Modern UI with dark mode by default
- ⚡ Interactive "Try It" functionality
- 🔒 CDN version pinning + SRI hashes
- 🎯 CORS proxy support
🎮 Beautiful GraphQL Documentation with GraphiQL
use *;
use ;
// Configure GraphiQL playground with all features
let config = new
.endpoint_url
.subscription_url // WebSocket for subscriptions
.theme
.enable_explorer // Interactive schema explorer
.enable_history // Query history persistence
.add_header;
let html = graphiql_html;
// Beautiful, interactive GraphQL playground at /graphql/playground
Features:
- 🎮 Interactive GraphQL playground (GraphiQL 3.0)
- 📚 Built-in schema explorer sidebar
- 🔄 WebSocket subscription support
- 📝 Query history with localStorage persistence
- 🎨 Dark/Light themes
- 🎯 Variables editor with JSON validation
- 🔒 Custom header configuration
See GraphQL Documentation Guide for complete setup with Axum, Actix, and Rocket.
🌐 Interactive gRPC Service Explorer
use *;
use ;
// Configure gRPC Explorer with all features
let config = new
.server_url
.enable_reflection // Auto-discover services
.enable_tls // TLS for production
.theme
.timeout_seconds
.add_header;
let html = grpc_explorer_html;
// Interactive gRPC service explorer at /grpc/explorer
Features:
- 🌐 Interactive gRPC service browser
- 📡 Automatic service discovery via gRPC reflection
- 🔄 Support for all call types (unary, server/client/bidirectional streaming)
- 🎨 Dark/Light themes
- 🔒 TLS/SSL support
- ⏱️ Configurable timeouts
- 📝 Custom metadata headers
See example at examples/grpc_docs.rs for complete Tonic integration.
✅ Contract Testing
use ;
let router = new;
// Simple usage - test all routes
let results = router.generate_contract_tests;
assert!;
println!;
// Advanced usage with configuration
let tester = with_config;
let results = tester.test_all_routes;
println!;
// Test specific route
let result = router.test_route_contract;
assert!;
Features:
- ✅ Automatic test generation from router
- 📋 Schema validation (requests/responses)
- 🔍 Breaking change detection
- 📊 Coverage reporting
- 🎯 Test specific routes or all at once
🔄 Protocol-Agnostic Handlers
async
🏛️ CQRS + Event Sourcing (85% Less Boilerplate!)
use *;
// Commands - 90% reduction (3 lines vs 30-40)
async
// Projections - 90% reduction (5 lines vs 50+)
let registry = new;
registry.register.await;
registry.rebuild.await?;
// Event Versioning - 95% reduction (5 lines vs 30-40)
registry.register_upcaster.await;
// Events automatically upcasted during replay!
// Sagas - 75% reduction (20 lines vs 100+)
let saga = new
.add_step
.add_step;
orchestrator.execute.await?;
// Automatic compensation on failure!
🤖 MCP Server (LLM Tool Calling)
Expose your AllFrame APIs as LLM-callable tools using the Model Context Protocol.
Installation:
# Opt-in to MCP server (zero overhead if not used!)
[]
= "0.1.12" # Core framework
= "0.1.12" # MCP server - separate crate for zero bloat
= { = "1.48", = ["full"] }
Quick Start:
use Router;
use McpServer;
async
Features:
- ✅ Auto-discovery: Every handler becomes an MCP tool
- ✅ JSON Schema generation and validation
- ✅ Type coercion (string → number, boolean)
- ✅ 100% zero overhead when not used (opt-in only)
- ✅ Flexible deployment (standalone, embedded, serverless)
Usage Patterns:
- 📱 Standalone MCP server binary for Claude Desktop
- 🌐 Embedded in web applications (Axum, Actix, Rocket)
- ☁️ Serverless deployment (AWS Lambda, etc.)
Documentation:
- allframe-mcp README - Complete usage guide
- MCP Distribution Model - Library vs binary distribution
- Example: STDIO Server - Full implementation
🔐 Layered Authentication
Protocol-agnostic authentication with zero-bloat feature flags:
use ;
// Configure JWT validation
let config = hs256
.with_issuer
.with_audience;
let validator = new;
// Or load from environment
let config = from_env?; // JWT_SECRET, JWT_ALGORITHM, etc.
Axum Integration:
use ;
// Add auth middleware
let app = new
.route
.layer;
// Extract authenticated user in handler
async
gRPC Integration:
use ;
let interceptor = new;
let service = with_interceptor
Features:
- 🔑 Core traits with zero dependencies (
auth) - 🎫 JWT validation: HS256, RS256, EdDSA (
auth-jwt) - 🌐 Axum extractors and middleware (
auth-axum) - 📡 gRPC interceptors (
auth-tonic) - 🔒 Type-safe claims with
AuthContext<C>
🛡️ Resilience Patterns
Production-ready retry, circuit breaker, and rate limiting for robust microservices:
use ;
use Duration;
// Retry with exponential backoff
let config = new
.with_initial_interval
.with_max_interval
.with_multiplier;
let executor = new;
let result = executor.execute.await;
// Circuit breaker for fail-fast behavior
let cb = new;
let result = cb.call.await;
// Rate limiting (100 req/s with burst of 10)
let limiter = new;
if limiter.check.is_ok
Or use attribute macros:
use ;
async
async
Features:
- 🔄 Retry with exponential backoff and jitter
- ⚡ Circuit breaker (Closed/Open/HalfOpen states)
- 🔑 KeyedCircuitBreaker for per-resource isolation (database, API endpoints)
- 🎯 Rate limiting (token bucket with burst support)
- 🌐 Redis-backed RateLimiter for distributed rate limiting
- 📊 AdaptiveRetry (adjusts based on success rate)
- 🛡️ RetryBudget (prevents retry storms)
- 🔑 KeyedRateLimiter (per-endpoint, per-user limits)
🔒 Security Utilities
Safe logging utilities to prevent credential leaks:
use ;
use Obfuscate;
use Obfuscate as ObfuscateTrait;
// URL obfuscation
let url = "https://user:pass@api.example.com/v1/users?token=secret";
println!;
// Output: "https://api.example.com/***"
// API key obfuscation
let key = "sk_live_1234567890abcdef";
println!;
// Output: "sk_l***cdef"
// Sensitive wrapper (Debug/Display always shows ***)
let password = new;
println!; // Output: Sensitive(***)
// Derive macro for structs
let config = DbConfig ;
println!;
// Output: DbConfig { host: "db.example.com", password: *** }
Features:
- 🔗 URL obfuscation (strips credentials, paths, queries)
- 🔑 API key obfuscation (shows prefix/suffix only)
- 📝 Header obfuscation (Authorization, Cookie, etc.)
- 🏷️
Sensitive<T>wrapper type - ⚙️
#[derive(Obfuscate)]with#[sensitive]fields
Why AllFrame?
| Feature | AllFrame | Actix | Axum | Rocket |
|---|---|---|---|---|
| TDD-First | ✅ 100% | ❌ | ❌ | ❌ |
| Compile-time DI | ✅ | ❌ | ❌ | ❌ |
| Auto OpenAPI 3.1 | ✅ | 🟡 Manual | 🟡 Manual | 🟡 Manual |
| CQRS + Event Sourcing | ✅ Built-in | ❌ | ❌ | ❌ |
| CommandBus | ✅ 90% less code | ❌ | ❌ | ❌ |
| Saga Orchestration | ✅ Auto compensation | ❌ | ❌ | ❌ |
| Resilience Patterns | ✅ Built-in | 🟡 External | 🟡 External | ❌ |
| Layered Auth | ✅ Protocol-agnostic | 🟡 External | 🟡 External | 🟡 External |
| Safe Logging | ✅ Built-in | ❌ | ❌ | ❌ |
| Protocol-agnostic | ✅ | ❌ | ❌ | ❌ |
| MCP Server | ✅ Zero Bloat | ❌ | ❌ | ❌ |
| Zero runtime deps | ✅ | ❌ | ✅ | ❌ |
| Binary size | < 8 MB | ~12 MB | ~6 MB | ~10 MB |
Installation
As a Library
[]
= "0.1.12"
As a CLI Tool
Example: Hello World
use *;
async
async
Run:
OpenAPI docs automatically available at:
- http://localhost:8080/swagger-ui
- http://localhost:8080/openapi.json
Feature Flags
AllFrame uses Cargo feature flags to minimize bloat - you only pay for what you use:
[]
= { = "0.1.12", = ["di", "openapi"] }
Core Features
| Feature | Description | Binary Impact | Default |
|---|---|---|---|
di |
Compile-time dependency injection | +0KB | ✅ |
openapi |
Auto OpenAPI 3.1 + Swagger UI | +0KB | ✅ |
router |
Protocol-agnostic routing + TOML config | +50KB | ✅ |
Router Features (Protocol Support)
| Feature | Description | Binary Impact | Default |
|---|---|---|---|
router-graphql |
Production GraphQL (async-graphql, GraphiQL) | +2MB | ❌ |
router-grpc |
Production gRPC (tonic, streaming, reflection) | +3MB | ❌ |
router-full |
Both GraphQL + gRPC production adapters | +5MB | ❌ |
resilience |
Retry, circuit breaker, rate limiting | +120KB | ❌ |
resilience-keyed |
KeyedCircuitBreaker for per-resource isolation | +10KB | ❌ |
resilience-redis |
Redis-backed distributed rate limiting | +50KB | ❌ |
auth |
Core authentication traits (zero deps) | +5KB | ❌ |
auth-jwt |
JWT validation (HS256, RS256, EdDSA) | +80KB | ❌ |
auth-axum |
Axum extractors and middleware | +20KB | ❌ |
auth-tonic |
gRPC interceptors | +15KB | ❌ |
security |
Safe logging, obfuscation utilities | +30KB | ❌ |
CQRS Features (✅ Complete - Phases 1-5)
| Feature | Description | Reduction | Default |
|---|---|---|---|
cqrs |
CQRS + Event Sourcing infrastructure | 85% avg | ✅ |
cqrs-allsource |
AllSource backend (embedded DB) | - | ❌ |
cqrs-postgres |
PostgreSQL backend (planned) | - | ❌ |
cqrs-rocksdb |
RocksDB backend (planned) | - | ❌ |
What you get:
- CommandBus with automatic validation (90% reduction)
- ProjectionRegistry with automatic lifecycle (90% reduction)
- Event Versioning with auto-upcasting (95% reduction)
- Saga Orchestration with automatic compensation (75% reduction)
- Pluggable backends (in-memory, AllSource, custom)
MCP Server (Separate Crate)
MCP (Model Context Protocol) is now a separate crate for 100% zero bloat:
# Only add if you need LLM integration
[]
= "0.1.12"
Benefits:
- ✅ 100% zero overhead when not used
- ✅ No feature flags needed
- ✅ No compilation impact on core
- ✅ Independent versioning
See MCP Zero-Bloat Strategy for details.
💡 Tip: Start minimal and add features as needed. See docs/feature-flags.md for detailed guidance.
Examples
Minimal REST API:
= { = "0.1.12", = false, = ["router"] }
Production GraphQL API:
= { = "0.1.12", = ["router-graphql"] }
Multi-Protocol Gateway:
= { = "0.1.12", = ["router-full"] }
Documentation
Project Documentation
- 📊 Project Status - Current status, roadmap, metrics
- 🚀 ROADMAP.md - Complete roadmap to v1.0
- 🔮 IGNITE_VISION.md - Microservice generator vision
- 📋 Original PRD - Product requirements (PRIMARY SOURCE)
- 📋 Router + Docs PRD - Phase 6 planning (Next major phase)
- 📑 Documentation Index - Complete documentation catalog
API Documentation (✅ Complete - All Protocols!)
- 🎉 Scalar Integration Complete - 10x smaller than Swagger!
- 📘 Scalar Documentation Guide - Complete REST API docs guide
- 📘 Example: Scalar Docs - Production-ready example
- 🎉 GraphQL Documentation Guide - Interactive GraphiQL playground
- 📘 Example: GraphQL Docs - Complete GraphQL setup
- 🎉 gRPC Service Explorer - Interactive gRPC documentation
- 📘 Example: gRPC Docs - Complete gRPC setup with Tonic
- 📘 Binary Size Monitoring - All binaries < 2MB
CQRS Infrastructure (✅ Complete)
- 🎉 CQRS Complete Announcement - 85% avg reduction!
- 📘 Phase 1: AllSource Integration
- 📘 Phase 2: CommandBus - 90% reduction
- 📘 Phase 3: ProjectionRegistry - 90% reduction
- 📘 Phase 4: Event Versioning - 95% reduction
- 📘 Phase 5: Saga Orchestration - 75% reduction
Development Guides
- 🧪 TDD Workflow
- 🏛️ Clean Architecture Guide
- 🎯 Feature Flags Guide - Minimize binary size
- 🔧 API Reference (coming soon)
Contributing
AllFrame is 100% TDD-driven. Before contributing:
- Read the PRD
- Review the TDD Checklist
- Ensure 100% test coverage for all changes
- Follow the Clean Architecture Guide
Every commit must contain at least one new failing test.
# Clone the repo
# Run tests (must pass)
# Check coverage (must be 100%)
# Run quality checks
See CONTRIBUTING.md for detailed guidelines. (coming soon)
Roadmap
AllFrame is evolving into a cloud-native microservice architecture generator.
See ROADMAP.md for the complete vision and Project Status for current progress.
Vision: Generate deployable microservice architectures from declarative configuration:
# Today
# Tomorrow (v0.5+)
# Generates complete microservice architecture with Terraform/Pulumi IaC
Completed ✅
-
Phase 6.4: gRPC Documentation ✅ (Dec 2025)
- Interactive gRPC service explorer
- gRPC reflection for auto-discovery
- Stream testing (unary, server, client, bidirectional)
- TLS/SSL support with custom headers
- Dark/Light themes with custom CSS
- First Rust framework with web-based gRPC docs!
-
Phase 6.3: GraphQL Documentation ✅ (Dec 2025)
- Interactive GraphiQL 3.0 playground (<100KB bundle)
- Schema explorer with documentation
- WebSocket subscription support
- Query history persistence
- Dark/Light themes with custom CSS
- Modern alternative to deprecated GraphQL Playground!
-
Track A: Scalar Integration ✅ (Dec 2025)
- Beautiful OpenAPI 3.1 documentation (<50KB bundle)
- CDN version pinning + SRI hashes
- CORS proxy for "Try It" functionality
- Custom theming and CSS
- 10x smaller than Swagger UI!
-
Track B: Binary Size Monitoring ✅ (Dec 2025)
- Automated CI/CD workflow
- Local development scripts
- cargo-make integration
- All binaries < 2MB (exceeded targets!)
-
Phases 1-5: CQRS Infrastructure ✅ (Nov 2025)
- AllSource Integration (pluggable backends)
- CommandBus (90% reduction)
- ProjectionRegistry (90% reduction)
- Event Versioning (95% reduction)
- Saga Orchestration (75% reduction)
- 85% average boilerplate reduction!
-
v0.0 - Repository setup, documentation migration ✅
-
v0.1 -
allframe ignite+ hello world ✅ -
v0.2 - Compile-time DI + OpenAPI ✅
-
v0.3 - OpenTelemetry tracing ✅
Active 🚧
- Phase 6: Router + API Documentation 🚧 (Q1 2025)
- ✅ Router Core (protocol-agnostic)
- ✅ REST Documentation (Scalar)
- ✅ GraphQL Documentation (GraphiQL)
- ✅ gRPC Documentation (Service Explorer)
- ✅ Contract Testing (Complete - 9 tests)
Planned 📋
Next Up: LLM Integration & Code Generation
- ✅ Native MCP server (100% Zero Bloat - Separate Crate!)
- 📋 LLM-powered code generation -
allframe forgeCLI (v0.6)
Performance & Ecosystem
- TechEmpower benchmarks (JSON serialization, query performance)
- Production runtime integration (Axum, Actix, Rocket)
- VS Code extension
- Performance profiling and optimization
Advanced Features
- API versioning
- Multi-language examples
- Analytics
Production Hardening
- Security audit
- 1.0 release preparation
Read the full roadmap → | View Ignite Vision →
Philosophy
Test-Driven Development (TDD)
We do not write a single line of implementation until a test fails for it.
// 1. RED - Write failing test
// 2. GREEN - Minimal implementation
// 3. REFACTOR - Improve while keeping tests passing
Zero Runtime Dependencies
AllFrame only depends on:
- Tokio - Async runtime
- Hyper - HTTP server
- std - Rust standard library
No hidden bloat. No dependency hell.
Clean Architecture
Dependencies flow inward only:
Presentation → Application → Domain ← Infrastructure
This is enforced at compile time by AllFrame's macros.
Performance
AllFrame targets TechEmpower Round 23 benchmarks in future releases:
| Metric | Target | Status |
|---|---|---|
| JSON serialization | > 500k req/s | 📋 Planned |
| Single query | > 100k req/s | 📋 Planned |
| Multiple queries | > 50k req/s | 📋 Planned |
| Binary size | < 8 MB | ✅ Achieved (<2 MB) |
Note: Performance benchmarking is planned for Q2 2025. Current focus is on feature completeness and correctness. All functionality is production-ready with comprehensive test coverage (450+ tests passing).
License
Licensed under either of:
- Apache License, Version 2.0 (LICENSE-APACHE or http://www.apache.org/licenses/LICENSE-2.0)
- MIT license (LICENSE-MIT or http://opensource.org/licenses/MIT)
at your option.
Community
- 💬 Discussions
- 🐛 Issue Tracker
- 📢 Twitter (coming soon)
- 📧 Discord (coming soon)
Acknowledgments
AllFrame is inspired by:
- Axum - Ergonomic Rust web framework
- Actix - High-performance actor framework
- NestJS - Architectural patterns for Node.js
- Clean Architecture - Uncle Bob Martin
- Transformers (Cybertron) - The inspiration for our "transform, compose, ignite" tagline
AllFrame. One frame. Infinite transformations.
Built with TDD, from day zero.