Magic Cloud — Open-Source Self-Hosted AI App Builder
Turn plain English into a working full-stack app — database, secure API, business logic, and frontend — running on your hardware with zero lock-in.
Evidence shows: README describes sandboxed execution, RBAC whitelisting, OIDC login, default root/root credentials, and permission restrictions for AI-generated code. However, user confirmation mechanisms, data flow transparency specifics, sensitive data handling details, dependency security audits, explicit control of external effects (e.g., network requests), rollback mechanisms, and source attribution details are lacking. Deductions: these aspects are only asserted or partially described, lacking code-level evidence.
Evidence shows: README and project structure are consistent, build and test commands are provided, and dependencies (.NET 10, Node.js) are clearly stated. However, failure message handling is not documented. Deduction: insufficient evidence for failure messages.
Evidence shows: README identifies target users (developers, non-developers) and multiple use cases (full-stack apps, AI agents, chatbots, etc.), and explains capability boundaries (e.g., need for OpenAI key, some features root-only). However, trigger precision (e.g., natural language input accuracy) is not detailed. Deduction: insufficient evidence for trigger precision.
Evidence shows: README provides clear installation guides, examples, FAQ, license (MIT), maintenance responsibility (AINIRO.IO), and release process (GitHub Actions). However, a clear list of known limitations, naming stability, and detailed changelog are missing. Deductions: insufficient evidence for these aspects.
Evidence shows: README claims rapid full-stack app generation, multiple deployment options, and emphasizes zero lock-in and self-hosting. However, independent verification of performance and cost data is lacking. Deductions: cost-benefit and marginal value are primarily based on assertions, lacking independent evidence.
Evidence shows: Many claims in README (e.g., performance, security) lack traceable tests or third-party verification. Deductions: separation of claims and facts is unclear, and cross-source corroboration is missing.
- Default credentials root/root should be changed immediately to avoid security risks.
- Execution permissions for AI-generated code must be strictly configured to avoid exposing arbitrary code execution endpoints.
- Dependency security is not audited; it is recommended to check dependencies for vulnerabilities yourself.
- Performance and security claims lack independent verification; treat them with caution.
What does this agent do, and when should you use it?
Magic Cloud is an MIT-licensed open-source platform that turns natural language descriptions into runnable full-stack applications, including database, secure REST API, business logic, and frontend, all self-hostable. It is built on .NET 10 and uses Hyperlambda as its core execution language, a dynamic language based on the Active Events pattern that supports sandboxed execution and function-level whitelisting, enabling safe execution of AI-generated code. The platform includes an API generator, SQL Studio, Hyper IDE, background job scheduler, and a built-in MCP server that exposes every endpoint as a tool for AI agents like Claude, Cursor, or Codex. Unlike Lovable or Bolt, Magic Cloud eliminates the deployment step before testing, supports SQLite, MySQL, PostgreSQL, and other databases, and provides a complete backend solution. It also integrates OIDC sign-in, Git version control, a headless browser, and Python/C# extension capabilities.
Magic Cloud converts user prompts in natural language into Hyperlambda code via its built-in Hyperlambda Generator (using OpenAI GPT models), which is then executed directly without a compile or deploy step. It uses the API Wizard to automatically generate CRUD REST endpoints from database schemas, SQL Studio for querying and designing databases, and Hyper IDE for editing and running server-side files. The MCP plugin exposes each HTTP endpoint in the modules folder as an MCP tool for clients like Claude Code and Codex, reportedly cutting token consumption by around 80%. The Chatbot Wizard crawls a website to generate training data and produce an embeddable chatbot. The platform integrates PuppeteerSharp for a headless browser to fill forms and click buttons, and supports generating and executing Python scripts, Bash commands, and C# extensions. Users operate via the Dashboard to configure databases, generate code, manage users and roles, and schedule background tasks.
- Enterprise developers needing to quickly build internal CRMs or admin panels by describing requirements in English, without a dedicated backend team.
- Data teams needing to expose existing MySQL or PostgreSQL schemas as secure CRUD REST APIs for frontend applications or integrations.
- AI application developers wanting to let Claude or Codex interact with their private databases and endpoints via the MCP server.
- Small-to-medium businesses seeking to self-host a customer support chatbot by crawling their website and embedding a grounded bot.
- Ops teams wanting to run full-stack apps on their own hardware (e.g., a Mac Mini) using Docker and expose them via a CloudFlare tunnel.
- Developers wanting a single platform to manage code, databases, scheduled tasks, and AI agents, with Git integration for version control.
What are this agent's strengths and limitations?
- Fully open source (MIT) and self-hostable, giving users full control over data and no vendor lock-in.
- No deployment step required before testing; generated code runs immediately, accelerating iteration.
- Built-in MCP server exposes all API endpoints to agents like Claude and Codex, cutting token usage by about 80%.
- Hyperlambda's sandbox and function-level whitelisting allow safe execution of AI-generated code, and the LLM cannot hallucinate non-existent functions.
- Rich integrations: OIDC login, Git versioning, headless browser, Python/C# extensions, and SQL Studio development tools.
- Relies on OpenAI API for code generation and embeddings; optional Ollama/HuggingFace plugins for inference, but embeddings still require OpenAI.
- Hyperlambda is a proprietary language with a learning curve; while the generator writes it, deep customization requires mastering new syntax.
- The hosted code generator is currently free but expected to cost $49 per 1,000 requests in the future, and the training dataset is not public.
- AI-generated code may be logically wrong despite valid functions, requiring manual review; executing Python/terminal requires root privileges, posing security risks.
- Project stewardship by a single company (AINIRO) poses a continuity risk; although code continues to run, new code generation could stop.
How do you install or deploy this agent?
The fastest install uses Docker: run curl -fsSL https://hyperlambda.dev/docker-compose.yaml | docker compose -f - up, then open localhost:5555 and log in with root/root. For a DigitalOcean droplet, edit the DOMAIN= line in .do/cloud-init.yaml and paste into the User Data field; HTTPS is automatic via Caddy. For source, you need .NET 10 and Node.js: in backend/ run dotnet run; in a separate terminal, in frontend/ run npm install then npm run dev. Open localhost:4201 and use localhost:5000 as the backend URL with root/root. SQLite is used by default, with support for MySQL, PostgreSQL, MariaDB, and SQL Server.
How do you use this agent?
After logging in, use the API Wizard to point at a database (e.g., SQLite) and auto-generate CRUD endpoints. In Hyper IDE, open a file and use the prompt bar at the bottom to describe what you want in English; the built-in generator writes Hyperlambda directly into the file, and you can test it immediately upon saving. For chatbots, use the Chatbot Wizard to enter a website URL, crawl content, and generate training data for an embeddable bot. To use MCP, install the mcp plugin and point Claude Code or Codex at your cloudlet's MCP URL; endpoints become tools. For OIDC sign-in, configure client IDs and secrets for providers like Google or GitHub in the Configuration screen.
How does this agent compare with similar options?
Compared to Lovable or Bolt, Magic Cloud generates a complete backend (database, API, authentication) while Lovable/Bolt only generate frontend and rely on third-party BaaS; Magic Cloud requires no deployment step before testing, whereas Lovable requires deploying to third parties first; Magic Cloud is MIT-licensed and self-hostable, while Lovable is proprietary and not fully self-hostable. Compared to n8n/Zapier/Make, Magic Cloud includes a full backend and compiled runtime, offering higher performance, while n8n are workflow interpreters with proprietary or mixed licenses and limited MCP support.