Ferra.rs
One #[model].
Five things derived. Production-ready APIs in Rust — without
writing the same struct five times.
#[model] struct Film { #[id] id: Id, title: String, } let app = Foundry::new() .mount::<Film>(state) .build(); // 5 routes · HAL · OpenAPI · typed SQL — from 8 lines.
_links
→ OpenAPI 3.1
→ typed SQL
The three pillars
of Ferra.
Not features bolted on — gravity. Every design decision in Ferra falls toward a single source of truth: one Rust struct, written once.
What you write once becomes routes, SQL, validation, OpenAPI — all of it, forever, automatically.
Refuse first.
Permit second.
An API should close every door before opening any. In Ferra the defaults aren’t safe — they’re hostile to your future bugs.
- ■SQL parameterized at the type level
- ■#![forbid(unsafe_code)] on every crate
- ■Missing auth = startup panic, not silent gap
Struct to documented API in five minutes.
Write the model once. Routes, SQL, validation, OpenAPI — all generated, all inspectable. Your time is the product.
- ■Errors tell you what / where / how to fix
- ■Generated code readable via cargo expand
- ■ferra-anvil scaffolds, never lectures
Built for the agents that will read it next.
Every response carries its own map. Every endpoint is self-describing. The next generation of software is a consumer, not an afterthought.
- ■HAL _links in every response
- ■OpenAPI 3.1 at /docs/openapi.json
- ■Native MCP tools in v5.0 — Precision Steel
#[model]
struct — everything else follows.
See what it gives you
One model, everything else.
The three forces converge here. You write a Rust struct — one source of truth — and Ferra hands back the routes, the SQL, the schema, the docs, the hypermedia, and the guarantees. Five jobs collapsed into one.
_links in every responseBuilt on Rust’s strengths.
Ferra doesn’t fight the language — it amplifies it. Every design
decision compounds the guarantees you already get from cargo build.
Compile-time over runtime
Mismatched routes, missing IDs, broken schemas — caught by cargo build, not in production at 3am.
Zero-cost abstractions
No reflection, no caching layer, no runtime overhead. p99 latency target: under 1ms.
Security by construction
SQL is always parameterized. CORS is restrictive by default. Auth is a first-class pipeline stage.
#![forbid(unsafe_code)]
On every crate, no exceptions. Ferra inherits Rust’s memory-safety guarantees end-to-end.
Runs wherever Rust runs.
One #[model], every target. Plug Ferra into any
Tower-compatible HTTP runtime, ship it to a long-running server,
a serverless function, or the edge — the API you wrote stays
the API you deploy.
Ferrum.
Latin for iron.
Ferra continues Rust’s metallurgical lineage — from ore to vessel to mascot to the metal itself. The roadmap follows the lifecycle of iron: from raw ore to precision steel.
Rust
Iron oxide
Cargo
The vessel that carries ore
Ferris
The mascot — ferrous, iron-bearing
Ferra
Iron itself
From ore to precision steel.
Five eras, each named for a step in the iron lifecycle. The foundations are shipped; we’re rolling out beta capabilities one version at a time on the way to a stable 1.0.
The Ore
Foundations are in place. You can already write a working CRUD API in under 25 lines.
- Excavation · workspace + IR
- Smelting · #[model] macro
- Casting · typed SQL
- Refining · CRUD + HAL
Cast Iron
APIs usable but not yet stable. Each version adds one major capability.
- Rolling · OpenAPI + Scalar (now)
- Welding · validation + RFC 7807
- Forging · auth + JWT + roles
- Polishing · relations + embeds
Hardened Steel
Security audit, benchmarks, OSS launch prep. crates.io publication. SemVer guaranteed.
- Audit & benchmarks
- Public 1.0 release
- Long-term support track
The Alloy → Arsenal
GraphQL, WebSockets, SSE, JSON-LD. Multi-backend storage. Plugin system, admin UI, observability.
- Alloy · GraphQL + WS + SSE
- Foundry · Mongo, Redis, Scylla
- Arsenal · plugins + admin
Precision Steel
Native MCP tools, LLM schemas, agent SDK — APIs that read themselves to language models.
- Native MCP tools
- LLM-aware schemas
- First-class agent SDK
#[model] written for v1.0 compiles without modification
in v2, v3, v4, and v5. Stability is not a feature — it’s the contract.
The targets we ship 1.0 against.
Numbers we hold ourselves to before tagging Hardened Steel — measured on a baseline Postgres-backed Film CRUD service.