F*
Free
F*: Proof-oriented programming language and formal verification platform
Core parameters and statistics
| Project | Specifications |
|---|---|
| Project name | F* (F star) |
| Category | Proof-oriented programming languages / Formal verification tools |
| Open Source License | Apache 2.0 |
| GitHub Stars | 3.1K+ |
| Programming languages | OCaml (compiler implementation), F* (bootstrap) |
| Delivery form | Compiler CLI / Docker / Nix / Online editor |
| Target users | Security engineers, formal method researchers, cryptography engineers |
| Core Engine | Z3 SMT Solver |
| Code Extraction Targets | OCaml, F#, C, Rust, ASM (via Vale) |
| Current version | v2026.07.12 (date version number, 1-2 versions per month) |
| Core sponsors | Microsoft Research, Inria, ERC (European Research Council) |
Interpretation of core parameters: The core concept of F is "type checking is verification" - for a program written in a dependent type system, passing the type check means that the program meets its formal specifications. Unlike classic proof assistants such as Coq and Isabelle/HOL, F relies heavily on the Z3 SMT solver to automatically complete proof obligations, greatly reducing the workload of manual proofs. 3.1K GitHub Stars is a respectable number in the world of formal verification - a field where the user base is a highly specialized niche. 138 contributors come from the world's top research institutions. The project maintains an iteration rhythm of 1-2 versions per month. 93+ Releases are high-frequency iterations among academic tools. The Apache 2.0 license ensures freedom for commercial use and redistribution.
User and market recognition
Market recognition for F* comes primarily from academic impact and engineering validation in flagship projects, rather than from broad commercial user numbers.
| Dimensions | Data |
|---|---|
| GitHub Stars | 3,100+ |
| GitHub Forks | 258 |
| Contributors | 138+ |
| Release Quantity | 93+ |
| Academic paper publishing | PLDI, POPL, CCS, IEEE S&P and other top conferences |
| Flagship projects | miTLS (TLS 1.3 authentication), Everest (HTTPS full stack), HACL* (cryptography library) |
| Production deployment | Deploy to Mozilla Firefox, Linux kernel |
| AI-assisted proof | proof-copilot (2026+) |
| Community Channel | Zulip (Response 24-48h) |
Academic influence: Relevant papers were published in top computer science conferences such as PLDI, POPL, CCS, and IEEE S&P. "Dependent Types and Multi-Monadic Effects in F*" (POPL 2016) is a classic document in this field, and the number of citations continues to grow.
Flagship Verification Project: miTLS (an F-formally verified implementation of the TLS 1.3 protocol) demonstrates the engineering feasibility of verifying tens of thousands of lines of industrial code with F. The Everest project verifies the entire HTTPS protocol stack through F - covering TLS, encryption algorithms (AES, ChaCha20, Curve25519), certificate parsing, HTTP headers and other components. HACL (Authenticated Cross-Platform Crypto Library) has been deployed to production environments such as Mozilla Firefox, the Linux kernel, and more, proving that F*-validated code can be safely deployed into billions of users' browsers.
Industry adoption: Microsoft is used internally to verify core security components, some financial technology companies use F* to verify encryption protocol implementation, and the aerospace field performs formal verification of key system modules. While the number of adoption units is limited, each case involves extremely high-value security infrastructure.
Cost advantage
F* is a completely free and open source tool. The core cost is not the software license but the learning curve:
| Cost Dimension | F* | Coq | Isabelle/HOL | Dafny |
|---|---|---|---|---|
| License Fee | $0 (Apache 2.0) | $0 (LGPL) | $0 (BSD) | $0 (MIT) |
| Degree of automation | SMT driven, highly automated | Mainly manual verification | Both automated and manual | SMT driven, highly automated |
| Code Extraction | OCaml/F#/C/Rust/ASM | OCaml/Haskell/Scheme | Limited | C#/Java/Python/JS |
| Learning Curve | Intermediate High | High | Intermediate High | Medium |
| Security Verification Field | TLS/Encryption/Protocol (Mature) | Compiler/Mathematics | OS/Scheduling/Mathematics | Software Engineering |
| AI-assisted proof | ✅ proof-copilot (2026+) | ⚠️ Some tools | ❌ Limited | ❌ Limited |
| Enterprise Support | ❌ No official commercial support | ✅ Consulting/training available | ✅ Consulting/training available | ✅ AWS (Business Edition) |
Cost Analysis: F*'s SMT-driven automatic proof is the most automated among mainstream proof assistants, and the same verification task typically requires less manual proof work. But the prerequisite for this advantage is that users master the dependency type system - the learning curve is a common threshold for formal verification tools. The introduction of proof-copilot (2026) is expected to lower the threshold for new users to get started, but its actual efficiency improvement effect is still in the verification stage.
Architecture and core capabilities
The system architecture of F* is built around the concept of "proof is programming":
F* source code (dependency type + effect system)
↓
F* type checker/validation condition generator
↓
┌─── Z3 SMT solver (automatically proves the obligation to prove)───┐
↓ ↓
Automatic certification passed, certification obligation unresolved
↓ ↓
Code Extractor User Provided Auxiliary Proof
↓ ↓
OCaml / F# / C / Rust / ASM (Vale) type checking completed- Dependent Type System (Core Engine): The type system is based on value-dependent types (dependent types), allowing the expression of preconditions, postconditions and invariants in types. For example
val sqrt: x:float{x >= 0.0} -> y:float{y >= 0.0 && y*y == x}declares the square root function - the input is non-negative, the output is guaranteed to be non-negative and the square is equal to the input. - SMT Automated Verification: Leverage the Z3 solver to automatically verify most proof obligations. Users write specifications, and the F* compiler automatically generates verification conditions (VCs) for Z3 to solve.
- Multi-object code extraction: Verified F* programs can be extracted as OCaml, F#, C or Rust code. Extract C/Rust via the KaRaMeL toolchain (suitable for embedded and high-performance scenarios) and verifiable assembly code via Vale.
- Pulse Extension: Embedded DSL provides imperative language programming experience (
whileloops, mutable references,parparallel composition), validating shared memory concurrent programs based on concurrency separation logic. - Vale Verifiable ASM: F-embedded DSL for writing and verifying low-level assembly code, deployed to HACL production environments (AES-NI instruction optimization).
- AI-assisted proof (proof-copilot): Launched in 2026, it supports automatic generation of proof fragments, assists in debugging type errors, and provides verification strategy suggestions. Officially positioned as an "auxiliary rather than a replacement" - AI-generated certificates require manual review.
- MCP Server: Released in 2026, allowing AI Coding tools to interact directly with F* via the MCP protocol.
Model and version evolution
| Version | Release Date | Key Changes |
|---|---|---|
| v2026.07.12 | 2026-07 | Float32/Float64 support, proof-copilot AI agent integration, editor interaction improvements |
| v2026.06.01 | 2026-06 | Pulse enhancement, Z3 integration optimization, KaRaMeL/Vale upgrade |
| v2026.04.15 | 2026-04 | MCP server publishing, Copilot CLI integration, editor collaboration capabilities |
| v2025.10.01 | 2025-10 | Pulse DSL introduction, code extraction performance optimization, Nix support |
| v2025.01.15 | 2025-01 | .NET 8 migration, SMT interface reconstruction, incremental verification improvement |
| v2024.06.01 | 2024-06 | KaRaMeL sub-modularization, optimized verification performance |
| v2023.12.01 | 2023-12 | New version of OCaml extraction, large-scale library support improvements |
| v2023.06.01 | 2023-06 | Dependency type system enhancement, error message improvement |
Version evolution characteristics: 2023-2024 will focus on compiler infrastructure (.NET 8 migration, SMT interface reconstruction) and code extraction optimization. Introducing Pulse DSL in 2025, marking support for imperative/concurrent verification. The main line in 2026 is AI integration-the successive releases of MCP server and proof-copilot will bring F* into a new stage of "AI-assisted verification". Version records are subject to GitHub Releases.
Technical advantages
- Dependent Types + SMT Automation: Combines the high expressiveness of dependency type theory with the high automation of the Z3 SMT solver. Users can describe complex specifications at the type level, and the SMT solver automatically handles most arithmetic, logical, and set constraints. F* generally requires less user interaction than Coq.
- Layered verification strategy: Supports flexible switching from fully automated (SMT has full authority to process) to fully manual (user writes complete certification items). Simple properties rely on SMT, and complex properties gradually add auxiliary lemmas.
- End-to-end verification pipeline: F* source code → type checking → code extraction → compiled into executable files, maintaining the transitivity of formal guarantees throughout the process. The C code style extracted by KaRaMeL is close to handwritten C and has been deployed to production systems such as Firefox.
- Imperative + Concurrency Verification: Pulse DSL bridges the gap between formal verification and real-world system programming, supporting concurrency patterns such as fine-grained locking, messaging, and work-stealing.
- Validated cryptography primitives library: HACL* and other libraries provide 50+ validated encryption algorithms (AES, ChaCha20, Curve25519), which can be directly reused in new projects.
Deployment pitfall guide
1. .NET runtime dependencies: F* is based on .NET 8 (migration completed in 2025). macOS users need to be aware of arm64 version compatibility of .NET - some older versions may have JIT issues on M-series chips. Solution: dotnet --info confirm SDK ≥ 8.0, use brew install dotnet.
2. Z3 solver version compatibility: F has an exact dependency on the Z3 version - incompatible versions will cause inconsistent verification results. Solution: Compile according to the specified version of the z3 submodule of the F warehouse, or use the official pre-built release package (Z3 is built in). Using pip install z3-solver is deprecated.
3. Build environment configuration: Compiling from source code requires OCaml (4.14+), .NET 8 SDK, and Python 3. Solution: Recommend Docker (docker pull fstar/fstar) or Nix (nix build github:FStarLang/FStar), both of which handle dependency version constraints.
4. Editor integration configuration: The VS Code plug-in needs to configure fstar.executablePath to point to the local fstar.exe. If the configuration is incorrect, it will fail silently. Solution: Verify that fstar.executablePath points to the output path of which fstar.exe.
5. Large-scale project incremental verification performance: For tens of thousands of row-level projects (such as miTLS), incremental verification and rechecking may take a long time. Solution: Use --cache_checked_modules to enable module-level caching and --lazy mode to lazily check extraneous definitions.
How to use
| How to use | Description | Applicable scenarios |
|---|---|---|
| Local installation | opam install fstar or Docker/Nix |
Full development and verification |
| Online editor | fstar-lang.org/run.php | Quick experiment and learning |
| VS Code plug-in | fstar-vscode-assistant | Interactive verification development |
| Emacs plug-in | fstar-mode.el (MELPA) | Interactive verification development |
| AI assistance | proof-copilot + MCP server | AI driver verification assistance |
# Installation (Docker recommended)
docker pull fstar/fstar
alias fstar='docker run --rm -it -v $(pwd):/code fstar/fstar fstar'
# Verify hello.fst
fstar hello.fst
# Extract to OCaml
fstar hello.fst --codegen OCamlProduct Pricing
| Tiers | Price | What's Included |
|---|---|---|
| Open Source Core | $0 (Apache 2.0) | Full compiler/validator, Z3 integration, full DSL |
| Docker image | $0 | Pre-configured complete development environment |
| Online editor | $0 | Browser use, no installation required |
| proof-copilot | $0 (open source) | AI-assisted proof plug-in |
| VS Code Plugin | $0 | Interactive Verification |
| Enterprise Support | No official commercial support | Community Zulip + GitHub Issues |
F* is a completely free open source project with no paid versions or feature lock-ins. The Apache 2.0 license permits commercial use and redistribution. Zulip community response is typically within 24-48 hours.
Application scenarios
- Security protocol verification (most mature): Security engineers use F* to write formal specifications of network protocols and verify the confidentiality and integrity of the protocol by relying on the type system. miTLS verification discovered multiple security issues in the draft phase of TLS 1.3. Verification: After passing the verification, extract the C code and do integration testing with TLS-Attacker.
- Cryptography implementation verification: Use F to write cryptography algorithms and verify the correctness and constant time implementation of the algorithm. The HACL library already provides 50+ proven cryptographic primitives. Verification: Run standard KAT vector verification.
- System software key module verification: Use Pulse DSL to perform formal verification of the OS scheduler, file system concurrent access, and database transaction isolation. Verification: Pulse verified modules are run in parallel with the original modules for comparison.
- AI Security and Alignment Research (Emerging Directions): Use F* to perform formal verification of security-critical components in AI systems - reasoning scheduler fairness, data access control policies, model output constraint execution logic. Verification: The formal specification that passes the verification is used as the basic document for AI system audit.
Applicable people
| Crowd | Adaptation value | Prerequisites |
|---|---|---|
| Security Engineer | Verify the correctness of protocols and cryptography implementations | Familiar with cryptography and security protocols |
| Formal method researcher | Verification technology research and practice | Functional programming + type theory basics |
| System software developer | Guarantee the reliability of key system modules | Have a basic understanding of formal verification |
| Cryptozoology Engineer | Write and verify cryptography implementation | Cryptography + functional programming basics |
| Computer Science Students | Learning Program Verification and Type Theory | Fundamentals of Programming Language Theory |
Not suitable for the crowd: Full-stack developers who need to deliver business code quickly (the verification overhead is much greater than writing code directly); those who have no foundation in functional programming and type theory (the learning curve is not suitable for zero foundation); general application development in non-security-critical areas.
Comparison of competing products
| Contrast Dimensions | F* | Coq | Isabelle/HOL | Dafny | Lean 4 |
|---|---|---|---|---|---|
| Open Source/Closed Source | Open Source (Apache 2.0) | Open Source (LGPL) | Open Source (BSD) | Open Source (MIT) | Open Source (Apache 2.0) |
| Degree of automation | ★★★★ (SMT driver) | ★★ (mainly manual) | ★★★ | ★★★★ (SMT driver) | ★★★ (tactic) |
| Code Extraction | OCaml/F#/C/Rust/ASM | OCaml/Haskell/Scheme | Limited | C#/Java/Python/JS | C/JavaScript |
| Security Verification Reputation | TLS/Encryption (miTLS/Everest) | Compiler (CompCert) | OS Kernel (seL4) | Software Engineering | Mathematical Reasoning |
| Concurrency Verification | ✅ Pulse DSL | ❌ Limited | ❌ Limited | ❌ | ❌ |
| AI-assisted proof | ✅ proof-copilot | ⚠️ Tactician | ❌ limited | ❌ limited | ✅ GPT-f |
| Learning Curve | Intermediate High | High | Intermediate High | Intermediate | Intermediate High |
| Enterprise Support | ❌ No official support | ✅ Consulting/Training | ✅ Consulting/Training | ✅ AWS Paid | ❌ Community-based |
| GitHub Stars | 3.1K | 4.8K | 2.5K | 4.7K | 7.5K |
Decision Suggestion: Verify industrial-grade encryption protocols or cryptography implementations → F is the most mature (miTLS/HACL/Everest). Compiler verification→Coq (CompCert ecology). Formalization of mathematical theorems→Lean 4. Simple program correctness verification and mainly based on .NET→Dafny.
Summary and Outlook
F's core competitiveness in the field of formal verification lies in the technical combination of "dependency type + SMT automation + multi-object code extraction + concurrent verification". It has the most mature engineering cases in security protocol and cryptography verification scenarios (miTLS/Everest/HACL have all been verified in the production environment). The Apache 2.0 license and active academic community ensure the long-term sustainability of the project.
Core Advantages: SMT-driven high automation reduces proof workload; multi-objective code extraction (OCaml/C/Rust/ASM) covers the complete link from prototype to production deployment; Pulse DSL is the only mainstream proof assistant that supports imperative + concurrent verification; verification code has been deployed to billions of user-level systems such as Firefox and Linux kernel.
Known limitations: The learning curve (dependency type + effect system) is still the main threshold, and new users with non-functional programming backgrounds need 2-4 weeks to get started; commercial support only relies on community channels (Zulip) and lacks enterprise-level SLA; proof-copilot is still in its early stages, and the reliability of AI-generated proofs needs to be verified.
Risk Disclosure: (1) The project is led by academic institutions, commercialization support is limited, and enterprise-level SLA is not available; (2) The compiler runs based on .NET 8, and there is a gap between the ecosystem and the OCaml/Haskell tradition; (3) The correctness of formal verification depends on the accuracy of the specification - bugs in the specification itself are not covered by the verification; (4) The proof fragments generated by proof-copilot require manual review, and "AI-assisted +" should be established Manual review" quality process.
Follow-up observation directions: proof-copilot's maturity improvement path, community size and contributor growth trends, and whether there are commercial support solutions provided by Microsoft or third parties.
Summary and Outlook
F occupies an important and unique position in the field of formal verification with its unique technical route of "dependency type + SMT automated verification". Flagship projects such as miTLS, Everest, HACL, and others have proven their engineering viability in validating security-critical systems—not just as academic experiments, but as production code that has been deployed into billions of users’ browsers.
Core Advantages: (1) SMT-driven automated verification significantly reduces the proof workload; (2) Multi-objective code extraction (OCaml/C/Rust/ASM) ensures verification transitivity; (3) Pulse supports imperative/concurrent verification, bridging the gap between functional verification and system programming; (4) proof-copilot introduces AI assistance to lower the threshold for novices; (5) Rich verified cryptography libraries (HACL*) are available for reuse; (6) Apache 2.0 license, no compliance concerns for commercial use.
Current limitations: (1) The learning curve still requires a certain foundation in functional programming and type theory - a common pain point for formal verification tools; (2) The community size and ecosystem are far smaller than mainstream languages, and there are limited Stack Overflow posts to refer to when encountering problems; (3) The coverage of documentation and examples still needs to be improved, especially introductory tutorials for new users; (4) Application cases in non-security fields are relatively limited - F* in Verification in the TLS/encryption field is sufficient, but the versatility in other fields needs to be expanded; (5) There is no official commercial support channel, and enterprise adoption requires internal formal verification experts.
Procurement/Adoption Risk Assessment: For security-critical systems (cryptographic implementations, protocol implementations, security-critical modules), F has low adoption risk - there is no risk of vendor lock-in with Apache 2.0 licensing, and proven flagship projects provide a reference case for engineering feasibility. The main risk is finding people with F skills - the hiring market for formal verification engineers is fiercely competitive. The recommended strategy is: start with the integration of verified libraries such as HACL (benefits from zero F development costs), cultivate the F capabilities of the internal team, and then expand to self-developed verification projects. For routine development in non-safety-critical areas, the verification costs of F often exceed the benefits and is not recommended.
Follow-up observation directions: (1) The actual improvement effect of proof-copilot on verification efficiency - if AI can significantly reduce the proof writing time, the adoption threshold of F may drop significantly; (2) The maturity and adoption rate of Pulse - imperative/concurrent verification is F's core differentiating capability compared to competing products; (3) The role of formal verification in AI security is expanded - AI security alignment is an emerging field, and F*'s methodology may find new application scenarios; (4) The establishment of commercial support and training ecosystem - this is a key step from research tools to industrial standards.
Related tools: github-copilot, 
Cursor
Version Info
- F* v2026.07.12 ：Added Float32/Float64 support, proof-copilot AI agent integration, and editor interaction improvements.
- F* v2026.06.01 ：Pulse concurrency verification enhancements, Z3 integration optimization, KaRaMeL and Vale tool chain upgrades.
- F* v2026.04.15 ：MCP server is released, supporting Copilot CLI integration; adding editor collaboration capabilities.
- F* v2025.10.01 ：Introducing Pulse DSL, improving code extraction performance, and adding Nix build support.
- F* v2025.01.15 ：.NET 8 migration completed, SMT solver interface refactoring, and incremental verification performance improved.
User Reviews