Infinite apps.
No URLs.
No web pages.
Mugen is a desktop client that replaces the browser — a custom rendering engine written in Rust, with no HTML, no CSS, and no JavaScript.
Creators host their own servers and build apps in Crystal. You discover apps, join the ones you trust, and Mugen renders them natively. An app's identity is its publisher's key — never a domain you have to spell, guess, or hope hasn't been hijacked.
- Client
- Rust + wgpu
- Apps written in
- Crystal
- Address
- A key, not a URL
- Apps run
- On creators' servers
Try it: switch apps in the sidebar, tick a task, add your own. Every tap below is an Event to the server — every reply is a Patch to the UI tree. The client never runs app code.
The URL was never a good address.
On the web, an address says where to go — then you trust DNS, a domain owner, and a chain of certificate authorities that you actually arrived at the right place. Mugen flips it: identity first, location second.
The web today
Location is identity — and location can be taken.
- ✕
You type the address. One wrong letter is a typosquat, a lookalike, a phishing page.
- ✕
Domains expire and change hands. The app you trusted yesterday can be someone else's server tomorrow.
- ✕
Every page runs foreign code. Scripts, trackers, and third parties execute inside your browser.
- ✕
Moving hosts breaks everything. New domain, new login, lost data, dead links.
With Mugen
Identity is a key. The server address is just a hint.
- ✓
You join apps, you don't visit addresses. Discover, preview the publisher and permissions, join in one tap.
- ✓
The key can't be hijacked. A taken-over domain still can't sign as the app — the client refuses to render it.
- ✓
Apps never run code on your machine. They send a validated UI tree. Mugen lays it out and paints it.
- ✓
Creators can move freely. New server, same signed identity, same storage and login for you.
Creators host. Mugen renders.
The split is the whole design. Crystal apps stay on their creators' servers, owning logic and data. The Rust client owns the window, the layout, and every pixel — and nothing else needs to be trusted.
Build in Crystal
Write components with the Mugen SDK. They describe UI as a tree — not pages, not markup.
sdk/crystalPublish a manifest
Sign your app's name, icon, version, permissions, and server endpoints with your publisher key.
manifest · signedPeople join
Your app appears in the directory. Joining pins your key and approves your permissions — before anything renders.
directory → joined listMugen verifies & renders
The client checks the server proves your key, receives a UI snapshot, and paints it with its own engine.
snapshot → pixelsEvents up, patches down
Taps and typing travel back as events. The server replies with small tree patches — never a full reload.
event ⇄ patchCrystal app — creator's server
Logic, data, routing, and who can do what.
- Components → UI tree
- Diffs tree → patch
- Handles events
The protocol
Binary, versioned, validated hard in Rust.
- Snapshot on connect
- Patch per change
- Event per interaction
Rust client — your machine
Shell, layout, and rendering. No app code ever runs here.
- winit window + input
- Constraint layout, dirty tracking
- wgpu display list + text atlas
Write Crystal. Ship an app, not a website.
No frontend bundle, no browser quirks, no CSS. You write components on your server; every joined client renders them natively and stays in sync through patches.
# apps/tasks/src/tasks.cr component TaskList do column(gap: 8) do text "Today", size: 18, weight: :bold list(tasks) do |task| row do checkbox(task.done?, on_toggle: ->toggle(task)) text task.title end end input(placeholder: "Add a task…", on_submit: ->add_task) end end
The SDK compiles this to typed nodes, diffs against the last tree, and sends only what changed. Style is typed too — enums and tokens, never strings of CSS.
You host it, you own the data
Apps run where you put them — a VPS, a home server, anywhere. Change hosts anytime; your signed manifest points clients to the new endpoint and your identity doesn't change.
Client, protocol, and SDK grow together — planned layout
mugen/ crates/shell/ # window, joined list, lifecycle crates/renderer/ # wgpu display list, atlas crates/layout/ # constraints, dirty tracking crates/protocol/ # snapshot / patch / event sdk/crystal/ # components → tree → patch apps/demo-tasks/ # the first demo app
Ten node types are enough
Box, Text, Image, Scroll, Stack, Input, Button, List, Canvas, Video. Everything else is composed from those — so apps look and behave consistently, stay accessible, and can't draw outside the lines.
You verify before you render.
On the web you click a link and you're already on someone's page. In Mugen, joining starts with a preview: who made this, what it wants, and the fingerprint of the key that proves it.
Tasks
The address behind this card can change. This key can't be faked.
- ✓
Lookalikes get caught
A new app with a familiar name but a different key is flagged as a lookalike — and its key-derived mark won't match the one you know.
- ✓
Nothing leaks between apps
No cookies, no third-party scripts, no referrer. Storage and sign-in are isolated per app ID, brokered by the shell.
- ✓
Updates can't be smuggled in
Updates are signed manifests with rising version numbers. Unsigned updates and downgrades are refused.
- ✓
The directory can't impersonate
The directory is for discovery — search, categories, plain-language permissions. Even a compromised directory can't fake an app without its private key. You can always join directly by invite.
- ✓
Bad apps can't hurt the client
Every tree is validated: max depth, max nodes, max text, no duplicate IDs. Unknown nodes are ignored — never a crash, never a frozen window.
Small steps, in the right order.
The milestone that matters is one boring, working loop: a Crystal task app, rendered by Rust, responding to a click. Everything else is an improvement on a system that already runs.
Protocol before pixels
Typed nodes, Snapshot / Patch / Event, and hard validation — with round-trip tests.
The smallest renderer
winit + wgpu, Row / Column + Box / Text, crisp text via cosmic-text. Clicks hit the right node.
The smallest Crystal SDK
A tiny DSL for Column / Text / Button / Input that emits and diffs a tree over WebSocket.
End-to-end v0
Connect, snapshot, render, click, patch, re-render only what's dirty. Tag it v0.
The shell, then identity
Joined list, fast switching with suspend / resume, per-app storage — then keys, signed manifests, and the preview card.
The published directory
Signed index, search, categories, and key rotation — old key signs the new key, with a delay and a warning.
Clone it on macOS. Open it in VS Code.
Mugen is developed on macOS — where wgpu targets Metal — with VS Code as the editor. The repo is public; the layout in the For Creators section is the planned structure, and the build starts with the protocol crate and an empty shell window.
$ git clone git@github.com:davidsth/mugen.git
$ cd mugen
# check your toolchains
$ rustc --version && cargo --version
$ crystal --version
# goal for the first milestone, once the
# shell crate lands: an empty window that
# opens and closes cleanly
$ cargo run -p shell
- Rust (stable)For the shell, renderer, layout, and protocol crates.install via rustup · pin with rust-toolchain.toml
- CrystalFor the SDK and demo apps — fast native code, fibers for many live users.brew install crystal
- VS Code + rust-analyzerPlus the Crystal language extension for the SDK side of the repo.one workspace · both languages
- An Apple Silicon or Intel Macwgpu renders through Metal on macOS; Vulkan and DX12 keep Linux and Windows open later.macOS first · cross-platform by design
Mugen means infinite.
Help build the limitless client.
The web gave every app an address you have to trust. Mugen gives every app an identity you can verify — and gives you back a simple list of the apps you've chosen. It's early, it's open source, and the first window hasn't rendered yet. That's the fun part.