Open Source
The Jo Programming Language
Jo is a statically typed multi-paradigm language with a capability type system. It makes AI-generated code safe by construction — capability violations are compile errors, not runtime incidents.
Multi-Paradigm
Immutable-by-default, pattern matching, first-class functions, classes, objects, and first-class type-safe dependency injection.
Capability Type System
Authority is explicit, typed, and tracked by the compiler. No global variables. No ambient access to the environment.
Designed for AI and Human
Jo is designed for LLMs to generate programs. Its natural syntax and ergonomic design make secure programming a joy.
Multi-backend
Compiles to Python and Ruby. Adopt Jo at agent boundaries — your existing stack stays in place.
Capability-oriented Programming
Jo models authority as explicit, typed parameters. The compiler tracks every access point to enforce explicit capability policies — capabilities flow through programs automatically between check gates.
Two-World Architecture
Confined Programs
- Standard library
- Capability interfaces (api.jo)
- LLM-generated program
No FFI. No ambient authority. Cannot access the network, filesystem, or any resource — unless a capability is explicitly passed in.
Trusted Programs
- Framework (framework.jo)
- Trusted capability implementations
- Platform runtime
FFI permitted. Can access databases, network, and system resources. Contagious — any module using FFI lives here. Requires security review.
Trusted may depend on Confined for type checking — not the reverse.
Example
param getOrders
Declares the only capability AI code can use. The compiler tracks every use through the entire call graph — nothing else is reachable.
defer def aiMain() receives getOrders
The contract the LLM must implement — function signature and capabilities declared upfront. Checked by the compiler before execution.
Key Language Features
Jo's most distinctive features — composable named patterns, structural duck types, flow typing, and compiler-tracked context parameters — let you express intent precisely without ceremony.
param / receives / with
Context parameters are declared with param and flow implicitly into functions. Override at the call site with with.
allow none in
Proves that a function uses no context parameters at all — the compiler verifies the entire call graph. This is the mechanism behind capability confinement for AI-generated code.