Compiled straight to native code through LLVM, with compile-time memory safety from a borrow-checked ownership model. You get full, explicit control over memory, and what you read is what runs.
Tools for macOS and Linux · LSP for VS Code & Neovim
$ cpc hello.cplus -o hello $ ./hello hello, world
Native windows on macOS today through AppKit, with GTK and Windows backends planned.
Natively compiled services with no GC and predictable memory.
Fast, memory-safe CLI tools, compiled to a single static binary by the cpc compiler.
C+ is designed for every layer of the stack. A borrow-checked ownership model, no null, no exceptions, no hidden allocations: every program stays locally legible. You can read one function and know exactly what it does.
Build with speed and performance.
C+ compiles directly to native code through LLVM. The borrow checker and restrict markers give the optimizer the aliasing guarantees it needs to vectorize hot loops. No annotations to remember, just the ones the type system already proved.
// noalias hot loop, vectorizes cleanly fn axpy(n: usize, a: f32, restrict x: *f32, restrict y: *f32) { let mut i: usize = 0 as usize; while i < n { unsafe { y[i] = a * x[i] + y[i]; } i = i +% 1; } return; }
Concise code, few ways to go wrong.
Structs, methods, generics, and pattern matching, with no overloading, no implicit conversions, and no closures to reason about. Fewer ways to write it wrong, and exact, numbered diagnostics when you do.
struct Point { x: i32, y: i32 } impl Point { fn translate(mut self, dx: i32, dy: i32) { self.x = self.x +% dx; self.y = self.y +% dy; return; } }
Protect memory safety.
No null, no exceptions, no uninitialized reads. The borrow checker enforces aliasing-xor-mutation, so data races don't compile. Drop and defer give deterministic, LIFO cleanup on every scope exit.
struct Buf { ptr: *u8, len: usize } impl Buf { // runs automatically on scope exit fn drop(mut self) { unsafe { free(self.ptr); } } } fn main() -> i32 { let b: Buf = make_buf(); defer println("cleaning up"); return 0; }
Audio callbacks, control loops, and frame hot paths can't afford a hidden allocation or a lock. Mark a function #[realtime] and the compiler proves it across the entire transitive call graph: no heap allocation, no blocking, no unbounded recursion, no unknown calls. Not a lint. A compile error.
#[no_alloc] · rejects any path to malloc#[no_block] · rejects locks, waits, and blocking I/O#[max_stack(N)] · bounded, ABI-accurate frame sizevendor/rt// compiler-checked: a violation won't compile #[realtime] fn process_frame(input: f32x4[], output: f32x4[]) { let n: usize = output.len(); let mut i: usize = 0 as usize; while i < n { output[i] = input[i] * GAIN; // pure SIMD math i = i +% 1; } // Vec::new / lock / sleep here → E0901 / E0907 return; }
C+ calls C, Objective-C, and Metal directly through extern fn, with no binding layer and no glue generator. And because cpc emits standard C-ABI object files, existing C and C++ projects link C+ straight back: drop a .o into a CMake build and replace functions one symbol at a time, until the binary stands on its own.
// ① C+ calls C, no bindings extern fn cblas_sdot(n: i32, x: *f32, ix: i32, y: *f32, iy: i32) -> f32;
// ② C links C+ back, a plain C symbol #[repr(C)] pub extern fn cplus_dot(restrict a: *f32, restrict b: *f32, n: usize) -> f32 { // ... emits `cplus_dot` for clang / CMake to link return 0.0f32; }
No GC, no runtime overhead. A single-threaded raytracer, release build, on Apple Silicon.
Ray Tracing in One Weekend · 800×450 · 32 spp · release build, Apple Silicon.
Install the cpc toolchain and build your first program in seconds.
# macOS (Apple Silicon) $ brew install netdur/cplus/cplus $ cpc --version
Prebuilt binaries, no toolchain to build. Linux and Windows packages are on the way.
Every feature C+ leaves out removes a class of mistake: no closures means no capture semantics to get wrong, no overloading means one name resolves to one signature, no implicit conversions means every width change is visible in the source. Ownership is on every parameter, unsafe is at every operation, and imports name their source.
When something is wrong, the compiler is exact about it: diagnostics are numbered, spanned, and machine-readable, and cpc check --diagnostics=json makes them trivial to act on. The compiler is part of writing the code, not just the gate at the end.
$ cpc check --diagnostics=json // one JSON object per diagnostic, ready to repair { "code": "E0305", "level": "error", "span": { "file": "main.cplus", "line": 4, "col": 5 }, "message": "cannot assign to immutable binding `total`; declare it as `let mut`" }
Built in the open. Contribute and get involved.