Risor

Risor is a fast, embeddable scripting language for Go applications.

Add dynamic expressions, filters, and user-defined logic to your Go programs without embedding a heavy runtime like V8 or Python. Expressions compile to bytecode and run on a lightweight VM. Pure Go, minimal dependencies.

Risor fills the gap between hardcoded logic and a full language runtime. It's for Go developers who need to evaluate user-provided expressions, rules, or small scripts safely at runtime.

// Expression evaluation: access control, validation rules
user.role == "admin" || resource.ownerId == user.id

// String templating: dynamic messages with embedded expressions
`Hello, ${user.name}! Your order ships ${order.shipDate}.`

// Configuration logic: safe navigation with fallbacks
config?.defaults?.theme ?? "light"

// Data transformation: filter, map, reduce
orders.filter(o => o.status == "pending").map(o => o.total).reduce((a, b) => a + b, 0)

Install

go get github.com/deepnoodle-ai/risor/v2

Go API

Embedding is straightforward. By default, the environment is empty (secure by default). Add the standard library with risor.Builtins():

import "github.com/deepnoodle-ai/risor/v2"

env := risor.Builtins()
env["user"] = currentUser
env["resource"] = requestedResource

allowed, err := risor.Eval(ctx,
    `user.role == "admin" || resource.ownerId == user.id`,
    risor.WithEnv(env),
)

Go primitives, slices, and maps convert automatically.

Use Cases

Risor is designed for scenarios where a Go application needs to evaluate user-provided or externally-defined logic at runtime:

• Workflow engines — Evaluate conditions and run small scripts at each step to decide branching, transform data, or trigger actions
• Rules engines — Express business rules like order.total > 100 && customer.tier == "gold" that change frequently without redeployment
• Expression evaluation — Dynamic filters, computed fields, validation rules, access control predicates
• String templating — Interpolated strings with embedded expressions for notifications, reports, emails
• Configuration logic — When static config (YAML, JSON) isn't enough but a full language is too much
• Data transformation — User-defined transforms, enrichment, and filtering in data pipelines
• Plugin & extension systems — Let users or tenants write small scripts that customize application behavior

The common pattern: a compiled Go host handles performance-critical work and exposes an API surface to Risor for flexible, safe, easy-to-change logic.

What Risor Isn't

Risor is not a general-purpose programming language. It's not trying to replace Python or TypeScript for writing applications. There is no package manager, no module imports, and no third-party ecosystem — by design.

Extension happens through Go code: you add builtin functions, pass data into the script context, and read results back out. This keeps the core small and lets each application tailor Risor to its needs.

Documentation

• Language Semantics — Type coercion, equality, and iteration
• Exception Handling — Try/catch/finally and error types
• v1 to v2 Migration — Upgrading from v1

Risor v2

This is Risor v2, a major evolution focused entirely on the embedded scripting use case. v1 also served DevOps scripting, cloud tooling, and CLI usage. v2 narrows the focus to doing one thing well: giving Go developers a safe, fast way to evaluate user-provided expressions and scripts at runtime.

Implementations for TypeScript and Rust host programs are being prototyped, with good initial results.

Risor v1 remains available at tag v1.8.1.

Contributing

• Questions and ideas: GitHub Discussions
• Bugs and PRs: GitHub Issues
• Chat: #risor on Gophers Slack

License

Apache License 2.0