Skip to content
AXIOMAXIOM
AXIOM seal

AXIOM

The transactional write gate for coding agents.
Get startedInstallGitHub

v3.0.0 Changelog · No telemetry

AXIOM sits between a coding agent and your repository. Every write and shell command the agent attempts is judged before it runs, and a change set the agent submits is applied as one transaction you can undo byte for byte.

Plan, Manifest, checks, apply, journal: every arrow is a hash boundaryPlanManifestchecksapply.axiom/ journalsha256(JCS(body))confirmDigest · pre-image re-verified · 2PC

A gate in 12 harnesses

Claude Code, Copilot CLI, VS Code, Codex, Cursor, Windsurf, Gemini CLI, Junie, Cline, Kiro, OpenCode and any ACP client. One policy file decides which paths, secrets and shell commands are allowed, asked about or denied.

Digest-confirmed apply

A change set compiles to a canonical Manifest; apply runs only with the digest you inspected, re-checks every prior hash at commit, and rolls back to the byte-identical tree on any failure.

Session undo

axiom journal undo --session <id> restores every file one agent session wrote through the gate, including allowed writes outside the repository.

Explainable

The decision journal is redacted and local. axiom explain last names the rule, the profile and the fix; axiom report renders a static HTML report.

Provable

DSSE (Ed25519) signatures and in-toto statements for applies and gate decisions, checkable with gh attestation verify.

Warn vs enforce

mode: "enforce" (what axiom setup init writes) blocks denies. mode: "warn" lets them through as warnings the agent sees, for a trial week; hard codes such as house.forcePush deny in both. See gate keys.

Quickstart

Section titled “Quickstart”
Terminal window
npm i -g @codai/axiom-mcp
axiom setup init       # hook + MCP entry + enforcing policy for the detected harness
axiom setup doctor     # is it wired, and fast enough for the hook timeout?
# ask the agent to `git push --force` or write `.env`: the gate denies it and says why
axiom explain last     # which rule decided, and what to do instead
axiom journal undo --session <id>   # roll back one session (needs "undo": true)

The bin is also installed as axgate, for machines where another axiom CLI comes first on the PATH. Full walk-through: quickstart.

Install

Section titled “Install”
Terminal window
npx @codai/axiom-mcp --help

Nothing to install; the current release is fetched on first run.

How it flows

Section titled “How it flows”
flowchart LR
  accTitle: The AXIOM pipeline
  accDescr: An agent's Plan is compiled to a Manifest, checked, previewed as a dry run, then applied; the apply writes the journal under .axiom and can upload an attestation to Sigstore.
  A[Agent] -->|Plan| P[plan_compile]
  P -->|Manifest + blobs| C[check]
  C -->|verdict| D[apply_dry_run]
  D -->|diff + digest| X[apply]
  X -->|journal| J[(.axiom/)]
  X -->|attestation| S[Sigstore]

Every arrow is a hash boundary. Read the pipeline page for the sequence diagram and the invariants that hold across all of it.

Used by

Section titled “Used by”
codaiThe SWE harness routes every write through the gate by default; agent-core tools carry risk classes.
brivioA profile whose guard.external runs brivio's own guard suite, plus the gate profile and Copilot hook.
meturepo.requireCompanion rules transcribed from metu's own skills, with proof runs.

Why it exists

Section titled “Why it exists”

Coding agents write files. Most of the time that is fine; occasionally it is a half-applied refactor, a clobbered concurrent edit, or a change nobody can trace back to a decision. AXIOM makes an agent’s write a transaction: planned, canonicalised, checked as a set, applied atomically against verified pre-images, journaled, and, when you want it, signed. It sits in front of the filesystem as an MCP server or a hook, so the agent does not have to be trusted; the gate does the trusting.