Make security holes a build error -- not a 2AM incident.
The Kovo compiler catches the most common security vulnerabilities -- SQL injection, XSS, CSRF, IDOR -- as soon as your coding agent writes them.
npx create-kovoSign up · name
users3 rows3 rows✗ droppedcaught at build✓ intact
Secure by construction
Pick a vulnerability class. The compiler traces untrusted input to the dangerous sink and answers before the code runs: the exact line, the rule, and the fix.
No stale UI
Add to cart, and every view of the cart agrees by construction. Kovo owns the path from the database to the DOM, so a view that could drift out of date is a compile error, not a bug your users find later.
And nothing is wired by hand: declare what a view reads, and the compiler invalidates exactly the views a mutation touches -- no cache tags, no invalidateQueries, no useEffect.
Your cart
async function addToCart(item) { await db.cart.add(item) // remember every view that reads cart: invalidate('cart') invalidate('cart-badge') invalidate('free-shipping') // miss one and it silently goes stale. }
// a view reads what it needs: const total = cart.total // the mutation only writes: mutation('cart/add', (item) => db.cart.add(item)) // every view that reads cart refreshes. // nothing to invalidate. checked at build.
Instant load
No hydration means no window where the page looks ready but ignores your clicks. The JavaScript you do use loads on first interaction, not on load. Turn JavaScript off and every page still renders, every form still posts.
Time-to-interactive equals first paint.
Every page renders, every form posts.
Typical SPA3.2s
⚠ looks ready, ignores clicks until 3.2s
SSR + hydration1.6s
⚠ frozen until the bundle hydrates
Kovofirst paint
✓ every click works at 0ms, handlers load on demand
Batteries included
Kovo owns the whole path: a Drizzle row becomes a DOM node, and the types follow it the entire way. It does not reinvent the foundations. It stands on libraries you already trust and type-checks the seams between them.
Who builds this
Kovo comes from the team behind Dyad, the open-source, local AI app builder with 20k+ stars on GitHub. We built Kovo because we wanted a target our own agents could generate and verify without guessing.
Because the stale-UI bug class and the hydration gap are still unsolved at the framework level. Kovo turns “this view drifted out of sync” into a compile error and makes first paint interactive. If your stack already proves those two things, you do not need Kovo.
That is the whole design goal. Generated apps fail tsc when wiring is wrong, and kovo check returns the exact line, the reason, and candidate fixes. The agent loops on edit, check, fixed -- not edit, deploy, bug report. Skills, an MCP server, and LLM-readable docs ship with it. That is not a claim of prompt-injection immunity: the framework narrows blast radius with default-deny guards, structured sinks, and the egress floor, but an app that lets a model read hostile content or call tools still needs its own LLM01 posture.
You keep the model you know: composable components, props, TypeScript. You give up the client router, hydration, and the runtime store. Kovo compiles your components to real HTML and wires interactivity on demand.
Not yet. Kovo is pre-v1 and under active implementation; nothing is published to npm. The spec, the conformance suite, and this site are open -- follow along and kick the tires.
If this resonates, star it.
Stars tell us the problem is worth solving and help other builders find Kovo early.