The Rust Frameworkfor Speed, Security & Efficiency
Type-safe APIs for latency-sensitive systems — trading platforms, AI inference services, real-time data pipelines, and backend infrastructure where every millisecond counts.
use ultimo::prelude::*;
#[tokio::main]
async fn main() -> ultimo::Result<()> {
// Initialize app
let mut app = Ultimo::new();
// Define a route
app.get("/hello", |ctx| async move {
ctx.json(json!({ "message": "Hello from Ultimo!" })).await
});
// Start server
app.listen("127.0.0.1:3000").await
}Built For Systems Where Every Millisecond Counts
Ultimo is designed for backend workloads where speed, security, and efficiency are non-negotiable requirements.
Financial Services
Trading systems, risk engines, payment processing — where tail latency directly impacts revenue.
AI & ML Backends
Inference serving, model orchestration, and feature pipelines that need predictable response times.
Bot Execution
Trading bots, automation engines, and webhook processors that react to events in milliseconds.
Real-Time Systems
Live data feeds, notifications, and collaborative tools over WebSocket pub/sub channels.
Backend Infrastructure
API gateways, microservices, and data pipelines deployed as single static binaries.
Everything you need to ship
Ultimo combines the raw performance of Rust with the developer experience of modern full-stack frameworks.
Blazing Fast
Native Rust speed on the Hyper + Tokio core, with a higher-level developer experience.
Type-Safe RPC
Define your API once in Rust, get fully typed TypeScript clients automatically.
Hybrid Design
REST + JSON-RPC 2.0 in one app with batch requests and notifications.
WebSocket Support
Zero-dependency RFC 6455 compliant WebSocket with built-in pub/sub system.
Secure by Default
Authentication, authorization, and hardening ship in the box — in 100% safe Rust.
Built for you and your coding agent
Most software is now written with AI coding agents. Ultimo is designed to be the easiest Rust framework for them to build with — typed contracts, deterministic scaffolds, and docs made to be read by machines.
Typed codegen
Write your API once in Rust; the typed TypeScript client is generated from it. Agents never guess client types — they're derived.
Scaffolds that build
`ultimo new` produces projects that compile out of the box, with dependency pins that track the current release. No stale-version dead ends.
Docs agents can read
Machine-readable llms.txt docs and a Context7-indexed corpus keep agents grounded in the current API. Every scaffold ships an AGENTS.md ruleset.
MCP server (soon)
An `ultimo mcp` server will give your agent live, typed tools — search docs, scaffold, and introspect your project's RPC surface.
Uncompromising
Performance
Ultimo is a thin layer over Hyper and Tokio — the same core that powers the fastest Rust servers — so you get native speed with a higher-level developer experience. We measure what the framework itself costs and guard it in CI.
O(1) routing
Constant-time route lookup — 10 routes or 10,000, the same cost.
Built on Hyper + Tokio
The proven async HTTP core of the Rust ecosystem — no re-implementation.
Regression-guarded
Every framework change is benchmarked in CI — we don't get slower by accident.
Route lookup time
In-process micro-benchmark — constant as the routing table grows.
Security is a
first-class pillar
Built in safe Rust with secure defaults across the stack — authentication, authorization, CSRF, hardened headers, and supply-chain checks ship in the box, not as an afterthought.
Read the security guide →What's built in
- 100% safe Rust — #![forbid(unsafe_code)], zero unsafe in the framework
- Secure-by-default sessions & cookies (HttpOnly/Secure/SameSite, 256-bit ids)
- JWT auth (HS256, algorithm pinned, exp validated)
- API-key auth with a pluggable store (SHA-256 hashed, constant-time)
- Authorization guards — scope checks across JWT & API-key identities
- CSRF protection (double-submit cookie, constant-time compare)
- Security-headers middleware (HSTS, X-Frame-Options, Referrer-Policy, …)
- Request body-size limits (DoS guard)
- Supply-chain CI — cargo-audit + cargo-deny on every change
End-to-End Type Safety
Define your API in Rust. Get TypeScript clients automatically. Catch errors at compile time, not runtime.
struct User {
id: u32,
name: String,
email: String
}
rpc.query(
"getUser",
|id: u32| async move {...}
);export interface User {
id: number;
name: string;
email: string;
}
// Fully typed!
const user = await client.getUser(1);
console.log(user.name);How Ultimo Compares
Axum, Actix, and friends are excellent, minimal HTTP layers. Ultimo builds on the same Rust core and adds the full-stack pieces — typed clients, RPC, auth — so you ship features instead of wiring boilerplate.
| Feature | Ultimo | Axum | Actix Web | Rocket | Warp |
|---|---|---|---|---|---|
| TypeScript Types | Auto | Manual | Manual | Manual | Manual |
| OpenAPI Generation | Auto | Manual | Manual | Manual | Manual |
| JSON-RPC Support | |||||
| REST Support | |||||
| Request Validation | Manual | Manual | Manual | ||
| Authentication | Manual | Manual | Manual | Manual | |
| Client Generation | Auto | Manual | Manual | Manual | Manual |
| CORS | Manual | Manual | Manual | Manual | |
| Rate Limiting | Planned | Manual | Manual | Manual | Manual |
| Dev Server | Planned |
Ultimo
Axum
Actix Web
Rocket
Warp
Built-in Requires manual setup/crates Planned Not available
Latest from the Blog
Tutorials, release notes, and deep dives into the Ultimo framework.
Ultimo is AI-Native: Building Rust Backends with Coding Agents
Most software is now written with AI coding agents. Here's how Ultimo is designed to be the easiest Rust web framework for them to build with — typed codegen, scaffolds that build, and docs made to be read by machines.
Ultimo v0.6.0: What a Security Review Found (and a SemVer Blind Spot We Didn't Expect)
Ultimo v0.6.0 fixes a session logout bug, two memory-exhaustion DoS vectors, an error-message info leak, adds a WebSocket Origin allow-list against Cross-Site WebSocket Hijacking, patches a JWT CVE and a SQLx RUSTSEC advisory — and exposes a real gap in cargo-semver-checks along the way.
Build a Real-Time Chat Application with Rust WebSockets and Ultimo
A complete tutorial for building a production-quality real-time chat server in Rust using Ultimo's WebSocket pub/sub system — from connection handling through rooms, presence, and deployment.
Ready to build your next high-performance backend?
Join the developers building faster, safer, and more reliable applications with Ultimo.