Rulemorph — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Rulemorph (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<p align="center"> <img src="assets/ogp.png" alt="Rulemorph" width="600"> </p>
<p align="center"> <a href="https://crates.io/crates/rulemorph"><img src="https://img.shields.io/crates/v/rulemorph.svg" alt="Crates.io"></a> <a href="https://docs.rs/rulemorph"><img src="https://docs.rs/rulemorph/badge.svg" alt="docs.rs"></a> <a href="LICENSE"><img src="https://img.shields.io/badge/License-MIT-yellow.svg" alt="License: MIT"></a> </p>
Rulemorph transforms data from external APIs, CSV, JSON, YAML, TOML, XML, HTML, Markdown, and Excel into predictable JSON using declarative YAML/JSON rules.
Instead of adding another custom script for every input source, you can keep transformation behavior in rule files. The same rules can be reused from the CLI, embedded in Rust, served through a local UI/API server, or exposed to AI assistants through MCP.
Try it in your browser: playground.rulemorph.com
Rulemorph moves growing transformation code into reviewable, versioned rules.
It is not meant to replace application code for arbitrary execution, complex domain logic, or long-running workflow orchestration. For those cases, normal application code or a workflow engine is usually a better fit.
Transform a users array from an external API response into the JSON shape your application expects.
rules.yaml
version: 2
input:
format: json
json:
records_path: "users"
mappings:
- target: "id"
source: "user_id"
- target: "name"
expr: ["@input.full_name", trim]
- target: "email"
expr: ["@input.username", concat: ["lit:@example.com"]]input.json
{ "users": [{ "user_id": 1, "full_name": " Alice ", "username": "alice" }] }Run
rulemorph transform -r rules.yaml -i input.jsonYou can also pipe input to transform:
cat input.json | rulemorph transform -r rules.yaml
cat input.json | rulemorph transform -r rules.yaml -i -Output
<details> <summary>Show output</summary>
[{ "id": 1, "name": "Alice", "email": "[email protected]" }]</details>
For quick one-off transformations without a rule file, use direct mode.
Evaluate a single expression against JSON or ad-hoc CSV:
echo '{ "test": 1 }' | rulemorph -rule '@input.test'
echo '{ "a": 1, "b": 2 }' | rulemorph --rule '["@input.a", {"+": ["@input.b"]}]'
echo 'a,test,1' | rulemorph -rule '@input.0'
echo 'a,test,1' | rulemorph -H 'id,name,age' -rule '@input.id'<details> <summary>Show output</summary>
1
3
"a"
"a"</details>
Use -F/--field when you want a small output object and field order matters:
echo 'u1,Alice,42' | rulemorph -H 'id,name,age' \
-F id='@input.id' \
-F name='["@input.name","trim","uppercase"]' \
-F age='["@input.age","int"]'<details> <summary>Show output</summary>
{ "id": "u1", "name": "ALICE", "age": 42 }</details>
Use --output-map when a compact nested target map is easier to read:
echo 'u1,Alice,42' | rulemorph -H 'id,name,age' \
--output-map '{"user.id":"@input.id","user.name":["@input.name","trim"],"age":["@input.age","int"]}'<details> <summary>Show output</summary>
{ "user": { "id": "u1", "name": "Alice" }, "age": 42 }</details>
For multi-record direct input, add --ndjson to emit one JSON value per line:
printf 'u1,Alice,42\nu2,Bob,7\n' | rulemorph --ndjson -H 'id,name,age' \
--output-map '{"id":"@input.id","age":["@input.age","int"]}'<details> <summary>Show output</summary>
{"age":42,"id":"u1"}
{"age":7,"id":"u2"}</details>
Direct mode can also read CSV or Excel files. CSV headers are inferred from .csv files; use -H/--headers for headerless CSV. For Excel, select the header row and data range explicitly:
rulemorph --rule '@input.id' -i users.csv
rulemorph -H 'id,name,age' --rule '@input.id' -i headerless-users.csv
rulemorph --rule '@input.id' -i users.xlsx --excel-header-row 1 --excel-data-range A2:D20<details> <summary>Show output</summary>
"u1"
"u1"
["u1","u2"]</details>
<p align="center"> <img src="assets/transform-scene.gif" alt="Rulemorph Demo" width="800"> </p>
| Goal | Use |
|---|---|
| Try rules without installing anything | Rulemorph Playground |
| File transforms, DTO generation, CI validation | rulemorph CLI |
| Embed transformations in a Rust application | rulemorph crate |
| Run the local UI or YAML-defined APIs | rulemorph-server |
| Use transforms, validation, and DTO generation from an AI assistant | rulemorph-mcp |
Prebuilt binaries for the CLI, server, and MCP server are available from GitHub Releases.
brew install vinhphatfsg/tap/rulemorphBuild from source for development:
cargo build -p rulemorph_cli --release
./target/release/rulemorph --helpbrew install vinhphatfsg/tap/rulemorph-server
rulemorph-server --rules-dir ./api_rules --api-mode rulesFor full startup steps, see the UI Server Guide.
rulemorph-mcp exposes Rulemorph capabilities to AI assistants through the Model Context Protocol.
transform: transform datavalidate_rules: validate rulesgenerate_dto: generate DTOsanalyze_input: summarize input structureClaude Code setup:
claude mcp add rulemorph -- rulemorph-mcp.xlsx Excel into JSON recordsmappingsdefs to reuse typed v2 pipes or mapping bodiessqrt, mod, pow, clamp, and range for bounded generated sequencesrecord_when, when, and assertssteps, branch, and finalize for ordered execution and output-array processingtype wins; dynamic or unsafe shapes fall back to JSON-friendly types.Input parsers are designed to be conservative. HTML parsing does not execute JavaScript or fetch URLs, Markdown raw HTML is preserved only as source text, and Excel parsing does not execute macros or evaluate formulas. XML DTD/entities and JSON/YAML duplicate keys are rejected to avoid ambiguous or side-effectful input behavior.
version: 2
input:
format: json # csv | json | yaml | toml | xml | html | markdown | excel
json:
records_path: "items"
mappings:
- target: "output.field"
source: "input.field"
type: string
when:
eq: ["@input.status", "active"]New rule files should use version: 2. version: 1 rule files are still accepted during migration, but validation and runtime entry points emit a deprecation warning. A later release will move version: 1 rule files behind an explicit legacy opt-in before removing that syntax.
For the full rule specification, see Transformation Rules Spec. The Japanese version is also available in Japanese.
rulemorph generate -r rules.yaml -l typescriptexport interface Record {
id: number;
name: string;
email: string;
}Supported languages: rust, typescript, python, go, java, kotlin, swift
DTO generation uses explicit mapping types first, then infers simple scalar, array, map, and nested object shapes from literals and v2 pipe expressions. If a shape is dynamic or too broad to infer safely, the generated DTO uses each language's JSON fallback type.
[dependencies]
rulemorph = "0.3.4"The html, excel, and markdown input parsers are enabled by default. Library users that only need core CSV, JSON, YAML, TOML, and XML support can disable them to reduce optional parser dependencies:
[dependencies]
rulemorph = { version = "0.3.4", default-features = false }Re-enable parsers explicitly with features such as ["html"], ["excel"], or ["markdown"]. If a disabled parser is selected by a rule, transformation fails with invalid_input (for Markdown: input format markdown is not enabled in this build).
use rulemorph::{parse_rule_file, transform};
let rule = parse_rule_file(&std::fs::read_to_string("rules.yaml")?)?;
let input = std::fs::read_to_string("input.json")?;
let output = transform(&rule, &input, None)?;~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.