Anthropic Releases Buffa, a Rust-Native Protobuf with Zero-Copy Views and ConnectRPC

Cut allocator pressure from 9.6 percent of server CPU to 3.6 percent, and decode throughput climbs from 4.2 million to 5.6 million records per second. Those are the numbers Anthropic engineer Iain McGinniss published when he open-sourced two crates under the anthropics GitHub organization in March 2026: buffa, a pure-Rust Protocol Buffers implementation with zero-copy message views and first-class editions support, and connect-rust, a Tower-based ConnectRPC client and server.

The benchmark workload is concrete: 50 structured log records per request in approximately 22 KB batches, carrying varints, string fields, nested messages, and map entries, measured at 256 concurrent connections against tonic+prost. The mechanism behind the gap is how each library handles string fields on decode. Prost's owned types heap-allocate a new String for every string field. Buffa's FooView<'a> types borrow directly from the wire buffer, sidestepping those allocations entirely for read-only access. The 33 percent throughput advantage and the more than halved allocator CPU share are the direct consequence.

For services with trusted-source input where UTF-8 validation is unnecessary, buffa goes further. Setting utf8_validation = NONE in editions and enabling the strict_utf8_mapping codegen option causes the generator to emit &[u8] instead of &str for string fields. Profiling shows this eliminates another 11.8 percent of server CPU by reducing str::from_utf8 calls to zero.

For teams not processing string-heavy payloads at high concurrency, the calculus shifts. Buffa's owned decode path, which does allocate and is closer to how prost operates, lands within plus or minus 10 percent of prost on throughput. The difference is what you get for that near-parity: unknown-field preservation by default, typed EnumValue<E> wrappers instead of raw i32, and native JSON serialization without reaching for pbjson as a separate dependency.

The ecosystem context explains why McGinniss built rather than extended. Prost remains the de facto standard and decodes binary proto3 capably, but it has entered passive maintenance and treats JSON and editions as afterthoughts. Google's official Rust protobuf v4 crate does support editions natively, but it is built on the upb C library, requiring a C compiler at build time, and it ships no RPC layer. Buffa treats editions as its primary abstraction and pairs with connect-rust to cover the full stack without a C toolchain dependency.

Connect-rust passed all 3,600 ConnectRPC server conformance tests across the Connect, gRPC, and gRPC-Web protocols, plus 1,514 TLS conformance tests and 1,444 client conformance tests. Code generation uses buf or the standalone protoc-gen-connect-rust plugin, producing message types and service stubs together in a single file per proto, with no plugin binaries required at build time. The extern_path format matches what the Buf Schema Registry uses for Cargo SDK generation, which should ease adoption for teams already on the buf toolchain.

Both crates are pre-1.0 and currently at v0.2.0, released March 17, 2026, under Apache-2.0. Buffa carries 564 GitHub stars; connect-rust has 208.

The practical decision boundary is tight but real. If your service decodes many string or bytes fields under sustained concurrency, buffa's zero-copy views justify the migration effort from prost. If your hot path is mostly encoding outbound messages, or your payloads are integer-heavy and string-light, prost's throughput is comparable and the switching cost will not pay off. For those who do want to try it, the entry point is a single build.rs call to connectrpc_build::Config::new(), pointed at your .proto files; the code generator handles the rest.