v2.0 — Available now

The attribute-first PHP framework built for PHP 8.4.

MonkeysLegion is a modular, PSR-compliant framework that leverages PHP 8.4 property hooks, a compiled DI container, and 26 focused packages to deliver the speed of a micro-framework with the batteries of a full-stack one — without runtime magic.

Get started → View on GitHub

Everything changed. Nothing feels heavy.

v2.0 is a full architectural pass across the entire ecosystem. Every package is pinned to v2.0+ for API consistency, the DI container compiles to zero-overhead resolution, and PHP 8.4 property hooks replace magic across the board.

⚙️ ⚡

PHP 8.4 Property Hooks

Native getters/setters as engine hooks — not reflection, not magic methods. Validation and formatting run at C speed.

⚙️ 🎯

Attribute-First Architecture

Routes, validation rules, service providers, and CLI commands are discovered via PHP 8 attributes. No giant route files, no YAML config graveyards.

⚙️ 📦

Compiled DI Container

Production builds compile definitions to a PHP array written atomically to disk. Zero runtime reflection on the hot path.

⚙️ ⚙️

MLC Configuration

A clean, typed config format with environment interpolation, cascading (.env → .env.local → .env.{APP_ENV}), and compiled production caching.

⚙️ 🛡️

PSR-15 Security Pipeline

OWASP security headers, CORS, rate limiting, CSRF, trusted proxies, and request IDs — all as standard middleware, on by default.

⚙️ 🤖

Apex — Built-in AI Orchestration

Not a wrapper. A complete AI infrastructure layer with multi-provider routing, declarative pipelines, guardrails, agent crews, and cost management.

Three promises. Kept by design.

⚡

Fast

Measured in millions of ops per second.

Zero-magic architecture means entities, DTOs, and enums are plain PHP objects. No Doctrine proxies, no Eloquent __get() chains, no framework metaclass layer.

🔐

Secure

Defaults that would take weeks to bolt on elsewhere.

Argon2id password hashing, built-in TOTP 2FA, JWT with rotation and blacklisting, rate limiting per route, OWASP headers middleware, CSRF, trusted-proxy awareness, and maintenance mode with IP/secret bypass.

🧩

Modular

26 packages. Use all of them, or use two.

Every capability lives in its own Composer package with its own semver. The meta-package wires them together, but you can swap any of them for your own implementation via the PSR contract.

Benchmarked, not marketed.

All numbers produced on Apple Silicon with PHP 8.5.3, no opcache preloading, warm JIT, identical test harnesses.

Operation

Ops/sec

vs Laravel

vs Symfony

Entity creation

6M

~140× faster

~114× faster

DTO construction

10.9M

~60× faster

~54× faster

Resource serialization

43.8K

~5.5× faster

~3.6× faster

Enum operations

8.7M

~25× faster

~22× faster

Property hooks (email)

11.1M

N/A

Computed properties

41M

N/A

Peak memory (cold boot)

4MB

≈ 22 MB

≈ 14 MB

Secure by default — not “secure once you install five packages.”

A direct, feature-by-feature comparison of what ships in the box versus what requires additional packages, configuration, or third-party bundles.

Security Feature

ML v2.0

Laravel 11

Symfony 7

Password hashing: Argon2id default

✅

⚠️

bcrypt default

⚠️

Configurable

JWT authentication

✅

❌

Requires Sanctum/Passport

❌

Requires LexikJWT

OAuth2 (Google, GitHub)

✅

❌

Requires Socialite

❌

Requires KnpUOAuth2

TOTP 2FA with QR generation

✅

❌

Requires Fortify + pkg

❌

Requires scheb/2fa

API keys + rotation

✅

⚠️

Partial via Sanctum

❌

Not core

RBAC + Policy system

✅

Policies

✅

Voters

Token blacklisting

✅

❌

3rd party

❌

3rd party

Rate limiting (per route)

✅

⚠️

throttle (opt-in)

⚠️

throttle (opt-in)

OWASP security headers

✅

❌

Requires package

⚠️

NelmioSecurityBundle

CORS

✅

⚠️

Fruitcake/CORS pkg

⚠️

NelmioCorsBundle

CSRF

✅

Trusted proxy handling

✅

Request ID correlation

✅

❌

Maintenance mode w/ bypass

✅

Compiled container (no reflection)

✅

⚠️

Partial cache

✅

Remember-me with rotation

✅

⚠️

Basic

⚠️

Basic

Every ⚠️ or ❌ in Laravel or Symfony is a decision your team has to make...

Apex Spotlight: The first PHP framework with an AI orchestration engine built in.

Main Tiles Slot

⚙️ 🔀

Multi-provider routing

Anthropic · OpenAI · Google (AI Studio + Vertex) · Ollama — same API, zero code change.

⚙️ 🧩

Declarative pipelines

pipe() · when() · loop() · parallel() · transform() — composable workflows with trace and timing.

⚙️ 👥

Multi-agent crews

Sequential, Parallel, Hierarchical, Conversational — with lifecycle hooks and handoff tracking.

⚙️ 🛡️

Guardrails engine

PII detection, prompt-injection defense, toxicity, regex, word count — with Block / Redact / Warn actions.

⚙️ 📐

Structured output

Schema-based extraction to type-safe PHP classes with retries and JSON Schema generation.

⚙️ 🎯

Smart model router

CostOptimized · QualityFirst · LatencyFirst · RoundRobin strategies for tiered routing.

⚙️ 💰

Cost management

Per-request tracking, pricing registry for 20+ models, budget enforcement, scoped reports.

⚙️ 🔌

MCP server + client

First-class Model Context Protocol support — serve tools and resources, or consume them.

⚙️ 🔁

Fallback chains

Ordered provider failover for high availability.

⚙️ 🌊

Streaming (SSE)

Token streaming, pipe-to-stream, SSE endpoints.

⚙️ 🧠

Six memory strategies

Conversation · Sliding · Summary · Vector · Persistent · Per-agent.

⚙️ 🔧

Tool calling

#[Tool] + #[ToolParam] attributes, multi-step autonomous loops.

Secondary Tiles Slot

Comparison Rows Slot

Cap: Multi-provider LLM routing | Apex: ✅ Core

Cap: Declarative pipelines | Apex: ✅ Core

Cap: Structured output | Apex: ✅ Core

Cap: Guardrails (PII, injection) | Apex: ✅ Core (6 validators)

Cap: Multi-agent orchestration | Apex: ✅ Core (4 modes)

Cap: Cost tracking + budgets | Apex: ✅ Core

Cap: MCP server + client | Apex: ✅ Core

Cap: Packages required | Apex: 1

Nineteen capabilities. One composer install.

Items Slot

⚙️ 🎯

PSR Compliant

PSR-7, 11, 14, 15, 16, 17

⚙️ 🔐

Auth Suite

JWT, OAuth2, 2FA, RBAC, API keys, remember-me

⚙️ 🗄️

Database Layer

QueryBuilder, migrations, entity scanner

⚙️ 🎨

Template Engine

Custom engine with caching and layouts

⚙️ 🌐

Attribute Routing

Auto-discovered, grouped, middleware-aware

⚙️ ⚡

Compiled DI

PSR-11 container with zero-overhead builds

⚙️ 📝

Validation

Attribute-based with automatic DTO binding

⚙️ 🌍

I18n

File + database loaders, pluralization

⚙️ 📧

Mail

SMTP and API delivery with DKIM

⚙️ 📊

Telemetry

OpenTelemetry metrics, tracing, structured logs

⚙️ 🎪

Events

PSR-14 dispatcher with auto-discovery

⚙️ 💾

Cache

Redis, file, in-memory (PSR-16)

⚙️ 📨

Queue System

Background workers with retry and timeout

⚙️ 📁

File Management

Unified storage, image processing, GC

⚙️ 📚

OpenAPI v3

Auto-generated from route attributes

⚙️ 🤖

Apex AI

4 providers, pipelines, guardrails, crews

⚙️ 🔄

CLI Kernel

17+ make:* scaffolders

⚙️ 🛡️

Security Middleware

OWASP, CORS, rate limit, CSRF, maintenance

Code Showcase: Show, don't tell.

Code Tabs Slot

Tab: Routing [php]

Tab: Validation [php]

Tab: Auth [php]

Tab: Apex AI [php]

Seventeen scaffolders. One CLI.

Every major framework object has a make:* command.

Scaffolding

  php ml make:controller User

  php ml make:entity User

  php ml make:middleware Auth

  php ml make:dto CreateUserRequest

  php ml make:event UserRegistered

  php ml make:listener SendWelcomeEmail

  php ml make:policy UserPolicy

  php ml make:job SendEmailJob

  php ml make:service PaymentService

  php ml make:command SyncData

  php ml make:test UserServiceTest

  php ml make:factory UserFactory

  php ml make:seeder UserSeeder

  php ml make:enum UserRole

  php ml make:observer UserObserver

  php ml make:resource UserResource

  php ml make:mail WelcomeMail

Database

  php ml make:migration

  php ml migrate

  php ml rollback

  php ml db:create

  php ml db:seed

Operations

  php ml config:cache

  php ml config:clear

  php ml cache:clear

  php ml route:list

  php ml queue:work

  php ml schedule:run

  php ml openapi:export

  php ml tinker

  php ml down / php ml up

  php ml about

  php ml ai:chat

  php ml ai:costs

How a request flows.

Request Pipeline

(Static data rendered by frontend)

Boot Sequence

(Static data rendered by frontend)

From zero to serving traffic in 90 seconds.

Install, configure, and serve — three commands is all it takes.

Steps Drag Quick Start Step components here

01

Install

composer create-project monkeyscloud/monkeyslegion-skeleton my-app cd my-app

02

Configure

cp .env.example .env php ml key:generate

03

Serve

composer serve # → http://127.0.0.1:8000

Requirements Drag Requirement Row components here

⚙ PHP

8.4+ (property hooks required)

⚙ Composer

2.x

⚙ Database

MySQL / MariaDB / PostgreSQL / SQLite

⚙ Redis (optional)

6.x+ for caching, queues, rate limiting

Tested. Compiled. Ready.

Test Suite

Every package ships with its own PHPUnit 11 suite. The framework meta-test suite covers 182 tests across 440 assertions:

✓ Compiled container cache (14 tests)

✓ Attribute discovery and provider scanning (11 tests)

✓ Maintenance mode middleware (7 tests)

✓ MLC config loading and provider definitions (94+ tests)

✓ Application boot lifecycle (13 tests)

✓ Exception handling (10 tests)

✓ Database user provider (15 tests)

✓ PHPStan Level 9 static analysis across all source files

Production

php.ini + deploy

# Compile DI container
php ml config:cache

# Recommended php.ini
opcache.enable=1
opcache.validate_timestamps=0
opcache.jit=1255
opcache.jit_buffer_size=128M

Built forfive kinds of teams.

Audience Cards Drag Feature Card components here

⚙️ 🤖

AI-native products

Apex gives you multi-provider routing, pipelines, guardrails, agent crews, and cost management as one Composer package.

⚙️ 🚀

API-first startups

Attribute routing + DTO validation + OpenAPI auto-gen + JWT = full REST API in a day.

⚙️ ⚡

High-throughput services

6× the HTTP req/s of Laravel at 18% the boot memory — measurable infrastructure savings at scale.

⚙️ 🔒

Enterprise / compliance

Argon2id, OWASP headers, token blacklisting, PII redaction guardrails, trusted-proxy middleware — all first-party.

⚙️ 💎

Modern PHP shops

PHP 8.4 property hooks, strict types across all 26 packages, attribute-first everything — no more legacy __get() magic.

Where we're going.

✅ Shipped in v2.0

PHP 8.4 property hooks & attribute-first architecture

26-package ecosystem pinned to v2.0+

MLC configuration with env cascading and production compilation

Compiled DI container with atomic cache writes

PSR-15 middleware pipeline with OWASP security headers

Auth suite: JWT, OAuth2, 2FA, RBAC, remember-me, blacklisting

WebSocket server with real-time broadcasting

Apex AI orchestration: multi-provider, pipelines, guardrails, crews, MCP

OpenAPI v3 auto-generation

17 make:* scaffolders

182 tests / 440 assertions

🔜 Coming in v2.1

Notifications package (email, SMS, Slack, push)

Per-route rate limiting via attributes

API resource transformers and pagination helpers

Model factories for testing

🔮 v3.0 Vision

GraphQL support with attribute-based schema

Admin panel generator (CRUD scaffolding)

Fibers-based async HTTP client

Native Swoole / FrankenPHP runtime support

Plugin marketplace

Join the build.

MonkeysLegion is MIT-licensed and actively developed in the open.

Links Drag Community Link here

🧱 Skeleton 📦 Framework GitHub 🤖 Apex (AI Orchestration) 📚 Documentation 💬 Slack

Ready to ship?

      $ composer create-project monkeyscloud/monkeyslegion-skeleton my-app
    

Buttons Drag CTA Button here

Star on GitHub ⭐ Read the docs → Open an issue Discussions