Overview Installation Documentation Getting in touch Status License History

master Documentation Spicy Manual Changelog CHANGES Build status

Spicy is a C++ parser generator that makes it easy to create robust parsers for network protocols, file formats, and more. Spicy is a bit like a "yacc for protocols", but it's much more than that: It's an all-in-one system enabling developers to write attributed grammars that define both syntax and semantics of an input format using a single, unified language. Think of Spicy as a domain-specific scripting language for all your parsing needs.

The Spicy toolchain turns such grammars into efficient C++ parsing code that exposes an API to host applications for instantiating parsers, feeding them input, and retrieving their results. At runtime, parsing proceeds fully incrementally—and potentially highly concurrently—on input streams of arbitrary size. Compilation of Spicy parsers takes place either just-in-time at startup (through Clang/LLVM), or ahead-of-time either by creating pre-compiled shared libraries or simply by giving you C++ code that you can link into your application.

Spicy comes with a Zeek plugin that enables adding new protocols to Zeek without having to write any C++ code. You define the grammar, specify which Zeek events to generate, and Spicy takes care of the rest.

While there are no dedicated releases yet, we provide pre-built Spicy binaries for some Linux platforms as well as a Homebrew formula for installation on macOS. You can also use one of the included Docker files, or just build Spicy from source directly. See the installation instructions for more information on any of these options.

Please read the Spicy Manual, which provides the following sections:

• Installation
• Getting Started
• FAQ
• Tutorial: A Real Analyzer (Missing)
• Programming in Spicy
• Toolchain
• Zeek Integration
• Release Notes
• Developer's Manual

Having trouble using Spicy? Have ideas how to make Spicy better? We'd like to hear from you!

• Report issues on GitHub.

• Ask the #spicy channel on Zeek's Slack.

• Subscribe to the Spicy mailing list

• To follow development, subscribe to the commits mailing list (it can be noisy).

Spicy is currently in a very early beta phase, it's not yet ready for production usage. You'll find plenty rough edges still, including unstable code, missing features, and confusing error messages if you do something unexpected. Specifics of the language and the toolchain may still change as well—there's no release yet, just a git master branch that keeps moving. We don't recommend Spicy and its parsers for anything critical yet, but we're very interested in feedback as we're working to stabilize all this.

Spicy is open source and released under a BSD license, which allows for pretty much unrestricted use as long as you leave the license header in place. You fully own any parsers that Spicy generates from your grammars.

Spicy was originally developed as a research prototype at the International Computer Science Institute with funding from the U.S. National Science Foundation. Since then, Spicy has been rebuilt from the ground up by Corelight, which has contributed the new implementation to the Zeek Project.