AXIMUR Guard

AXIMUR is a zero-setup MCP server / CLI that acts as a hard gate at the tool boundary, stopping autonomous coding agents from installing hallucinated or slopsquatted npm and PyPI packages. It cross-checks npm/PyPI, flags typosquatting via edit-distance, and returns a risk score before any install runs.

AXIMUR Guard is the free local hook for that workflow. It can run standalone against npm/PyPI, or call an AXIMUR package-validation API endpoint when one is configured.

Local install

From npm:

npm install -D @aximur/guard-hook

For local source-checkout development:

cd free-tool
python -m pip install -e .

No account, token, or secret is required for standalone mode.

What it catches

AXIMUR Guard prevents AI coding agents from installing hallucinated, nonexistent, typo-close, or slopsquatted package names by checking registry existence and similarity to popular packages.

Examples

• requests (pypi) → safe – legitimate package allowed.
• reqeusts (pypi) → suspicious – one‑letter typo of requests; often used in typosquatting.
• react (npm) → safe – legitimate npm package allowed.
• loadash (npm) → suspicious – one‑letter substitution of lodash; classic typosquat.
• definitely-not-a-real-package-name (npm or pypi) → danger – does not exist in registry.

Accurate CLI examples (illustrative expected behavior)

• aximur-guard requests --ecosystem pypi --standalone
• aximur-guard reqeusts --ecosystem pypi --standalone --json --fail-on suspicious
• aximur-guard react --ecosystem npm --standalone
• node hooks/npm-preinstall.js react --standalone --json
• python hooks/pip-preinstall.py requirements.txt

Note: Outputs above illustrate expected behavior; actual results may vary based on registry state and baseline.

CLI examples

Standalone mode:

aximur-guard requests --ecosystem pypi --standalone
aximur-guard reqeusts --ecosystem pypi --standalone --json --fail-on suspicious
aximur-guard react --ecosystem npm --standalone

Hosted API mode:

$env:AXIMUR_API_URL="https://YOUR-AXIMUR-HOSTED-PACKAGE-VALIDATION-ENDPOINT"
aximur-guard react --ecosystem npm

Use the hosted endpoint supplied with AXIMUR Guard Team Starter when you want workspace-wide package validation. Optional API bearer tokens are read from an environment variable named AXIMUR_API_TOKEN by default. The value is never printed.

AXIMUR Action Gate

AXIMUR Action Gate is an experimental local policy gate for proposed AI-agent actions. It classifies actions as ALLOW, ESCALATE, or BLOCK before an agent touches live systems.

Package Guard checks package names before install. Action Gate checks proposed actions before irreversible, public, or live-account execution.

Action Gate does not execute actions, log into accounts, deploy, publish, upload, post, send email, or modify live services. It is a local safety and policy layer.

Examples:

aximur-action-gate examples/action-gate/stripe_product_update.json --json
aximur-action-gate examples/action-gate/npm_publish.json --json
aximur-action-gate examples/action-gate/local_file_write.json --json

npm preinstall hook

Copy hooks/npm-preinstall.js into your repo, then add:

{
  "scripts": {
    "preinstall": "node hooks/npm-preinstall.js --standalone --fail-on danger"
  }
}

That scans dependencies, devDependencies, optionalDependencies, and peerDependencies in package.json before install continues.

Strict mode blocks both suspicious and danger findings:

{
  "scripts": {
    "preinstall": "node hooks/npm-preinstall.js --standalone --fail-on suspicious"
  }
}

Direct npm package check:

node hooks/npm-preinstall.js react --standalone --json

pip preinstall hook

Copy hooks/pip-preinstall.py into your repo, then run it before pip install:

python hooks/pip-preinstall.py requirements.txt
python hooks/pip-preinstall.py --fail-on suspicious requirements.txt

Terminal Hook-to-Upgrade

The free local guard stays free, and standalone mode still requires no account, token, or secret.

When Package Guard blocks a suspicious or dangerous install, it prints [AXIMUR PACKAGE GUARD] ACTION BLOCKED with the package, ecosystem, verdict, and reason. The warning also points teams toward Team Starter for hosted checks/API keys and Agent Security Setup for one-time implementation help.

Safe package checks do not print the paid upgrade prompt.

Team Starter

Need team‑wide hosted checks, API keys, and higher‑volume validation? AXIMUR Guard Team Starter is $49/mo per workspace for 25,000 hosted package‑validation checks/month.

https://buy.stripe.com/eVq3cxd9m0Ws5X70IwfIs04

Paid setup

Need help wiring this into a real repo, CI workflow, Claude Code, Cursor, Copilot, or MCP-compatible agent setup?

AXIMUR Agent Security Setup is a one-time $499 setup service for npm/pip guard configuration, fail-on-danger policy, optional fail-on-suspicious mode, and setup help.

Buy setup