CeeSafeMemory-safe systems programming, compiled to C

Ownership and borrowing with C#-style syntax, deterministic destruction, explicit allocation, and readable C11 that runs anywhere C runs, including inside an operating system kernel. Its compiler is written in CeeSafe.

Get started

What CeeSafe is

Specification

Safe by construction

Values have one owner. Borrows follow the one-writer-or-many-readers rule, checked at compile time with almost no annotations. Overflow, bounds and allocation failure are checked in every build.

Explicit, pluggable allocation

Boxes, arenas, pools, scratch frames and your own allocators. Allocation failure is a Result. A box that cannot escape lives on the stack.

C you can read

Structured, warning-clean C11 for clang, gcc and MSVC, with source maps back to CeeSafe lines and a reference interpreter that checks the same programs.

Ready for kernels

A freestanding profile, context effects that reject sleeping under a spin lock, imported C structs, lock guards and kernel objects.

Self-hosted

ceesafec is written in CeeSafe and rebuilds itself to the same bytes, generation after generation, on macOS, Linux and Windows.

Tools included

A formatter, a documentation generator, a language server with a VS Code extension, debugger commands, packages, and an MCP server for AI agents.