Skip to content
xript

xript

Every game is more fun with mods, every app more powerful with plugins, every website comfortable with extensions, and every device more capable with addons; every runtime needs extensibility. xript is a platform specification for how software exposes functionality to its users: safely, consistently, and with documentation that writes itself.
Get Started Read the Vision GitHub

Loading sandbox...

One manifest. Users write mods against the bindings you declare.

{
  "xript": "0.1",
  "name": "my-game",
  "bindings": {
    "player": {
      "description": "The player character.",
      "members": {
        "getHealth": {
          "description": "Current health points.",
          "returns": "number"
        },
        "setHealth": {
          "description": "Set the player's health.",
          "params": [{ "name": "value", "type": "number" }],
          "capability": "modify-player"
        }
      }
    }
  }
}
Write inJavaScriptTypeScript
Integrate withRustC# / .NETNode.js
Run onBrowserNode.jsDenoBunWorkersUnityGodot

Familiar Language

Users write JavaScript — the most widely known programming language on the planet. No proprietary syntax to learn, no specialized tools to install, no compilation step. If a user has ever opened a browser console, they already know enough to write their first mod.

Safe by Default

Scripts execute inside a sandboxed QuickJS WASM engine with no access to the host filesystem, network, or process. Capabilities are opt-in and default-deny — a mod can only call what you explicitly allow. eval() and new Function() are blocked at the engine level. Running someone else’s mod should never be a question of trust.

The Manifest Is the Product

A single JSON manifest declares every binding, capability, type, and example your application exposes. From it, the toolchain generates TypeScript definitions, markdown documentation, and validation — automatically. Change the manifest, and everything downstream updates. No hand-written docs to forget, no types to keep in sync.

Incremental Adoption

Start with safe expression evaluation in five minutes — no bindings, no capabilities, just math and string processing. Add simple host bindings in an afternoon for read-only data access. Graduate to full scripting with namespaces, capabilities, hooks, and persistent storage when you’re ready. Each tier stands on its own; you never need the next one.

Universal Portability

The JS/WASM runtime compiles QuickJS to WebAssembly, giving you one sandbox that runs identically in browsers, Node.js, Deno, Bun, and Cloudflare Workers. For native performance, drop in the Rust runtime (QuickJS via rquickjs) or the C# runtime (Jint) for Unity and Godot. Same manifest, same scripts, every platform.

LLM-Friendly

JavaScript is the most-represented language in LLM training data. Your users can ask an AI to write their mods, and the manifest gives the AI everything it needs: every binding, parameter, type, and capability documented in one machine-readable file. No guessing, no hallucinated APIs.