The contract-first serverless runtime.
One application model. Three runtimes. AppTheory keeps Go, TypeScript, and Python in lock-step on the shared Lambda contract — routing, middleware, error envelope, AppSync, WebSockets, and event workloads — verified on every commit by the full fixture corpus. The runtimes also execute the MCP fixtures for the Streamable HTTP surface and the OAuth fixtures for protected-resource flows used by Remote MCP deployments.
Where AppTheory shows up
Three real Lambda surfaces — one runtime, one contract, one entrypoint behind all of them.
One unified HandleLambda for Lambda Function URL, API Gateway v2, and ALB — with the same routing, middleware, and error envelope across all three runtimes.
Streamable HTTP transport, sessions, resumable SSE, and OAuth-protected remote MCP — packaged as Lambda-native AppTheory constructs.
SQS, EventBridge, DynamoDB Streams, Kinesis, AppSync, and WebSockets — registered through the same app, dispatched through the same entrypoint.
One app. Three runtimes.
Pick a language and ship the same Lambda contract.
go get github.com/theory-cloud/apptheory@v1.14.0
```go package main import ( "context" "encoding/json" "github.com/aws/aws-lambda-go/lambda" apptheory "github.com/theory-cloud/apptheory/runtime" ) func main() { app := apptheory.New() app.Get("/ping", func(ctx *apptheory.Context) (*apptheory.Response, error) { return apptheory.Text(200, "pong"), nil }) // One entrypoint handles HTTP, AppSync, SQS, EventBridge, // DynamoDB Streams, Kinesis, and WebSockets. lambda.Start(func(ctx context.Context, event json.RawMessage) (any, error) { return app.HandleLambda(ctx, event) }) } ```gh release download v1.14.0 --repo theory-cloud/AppTheory --pattern theory-cloud-apptheory-1.14.0.tgz --pattern SHA256SUMS.txt --clobber && grep ' theory-cloud-apptheory-1.14.0.tgz$' SHA256SUMS.txt | sha256sum -c - && npm install ./theory-cloud-apptheory-1.14.0.tgz
```typescript import { createApp, text } from "@theory-cloud/apptheory"; const app = createApp(); app.get("/ping", () => text(200, "pong")); // One entrypoint handles HTTP, AppSync, SQS, EventBridge, // DynamoDB Streams, Kinesis, and WebSockets. export const handler = async (event: unknown, ctx: unknown) => app.handleLambda(event, ctx); ```gh release download v1.14.0 --repo theory-cloud/AppTheory --pattern apptheory-1.14.0-py3-none-any.whl --pattern SHA256SUMS.txt --clobber && grep ' apptheory-1.14.0-py3-none-any.whl$' SHA256SUMS.txt | sha256sum -c - && python -m pip install ./apptheory-1.14.0-py3-none-any.whl
```python from apptheory import create_app, text app = create_app() @app.get("/ping") def ping(ctx): return text(200, "pong") # One entrypoint handles HTTP, AppSync, SQS, EventBridge, # DynamoDB Streams, Kinesis, and WebSockets. def handler(event, ctx): return app.handle_lambda(event, ctx) ```Quick starts
The deepest-value sections, ranked by how often new consumers reach for them.
Set up a deterministic local workspace for Go, TS, or Python.
P0 → P1 → P2: choose your middleware surface area.
One HandleLambda for HTTP, AppSync, SQS, and EventBridge.
Go Streamable HTTP runtime, sessions, and resumable SSE.
Safe HTTP source IP from provider context — never client headers.
223 fixtures: Go, TypeScript, and Python execute all MCP, OAuth, and objectstore fixtures.