{"slug": "axiom-blocks-ai-agents-from-inventing-limits-your-code-never-defined", "title": "Axiom – blocks AI agents from inventing limits your code never defined", "summary": "Axiom, a new local guardrail tool from the axiom-csc project, released at version v1.2.2, runs as a pre-write hook in Claude Code and Cursor and as a stdin/stdout filter for any agent that can pipe tool calls through a subprocess, blocking writes before they happen with zero dependencies and no API keys. The tool's three passes — Noema for regex-based constraint extraction, Lemma for deterministic Python evaluation against project invariants, and Manam for tri-state TRUE/FALSE/UNKNOWN logic — halt the agent on UNKNOWN and emit an AxiomConstraintViolation on FALSE, though the project states its detection is regex and AST-pattern based rather than semantic and that a motivated agent or attacker can bypass the checks with minor obfuscation. The installer downloads 6 Python files, registers the hook in .claude/settings.json, and generates .axiom/invariants.yaml from the codebase; VS Code with Copilot is supported only as a file-save task that flags violations after the write rather than blocking them.", "body_md": "Axiom is a local guardrail for AI coding agents. It runs as a pre-write hook in Claude Code and Cursor, and as a stdin/stdout filter for any agent that can pipe tool calls through a subprocess. Zero dependencies. No API keys. No tokens. Blocks before the write.\n\nDetection is regex and AST-pattern based, not semantic. A motivated agent or attacker can bypass these checks with minor obfuscation. This tool catches the most common accidental violations, not adversarial ones. For adversarial resistance, pair it with container isolation and branch protection.\n\n```\n       [ Claude Code / AI Agent Pipeline ]\n                        |\n                ( PreToolUse Hook )\n                        |\n+───────────────────────────────────────────────────+\n|                 Axiom Core Engine                  |\n| +─────────────────────────────────────────────+   |\n| |   Noema: Scope-Aware AST Lowering Pipeline  |   |\n| +─────────────────────+───────────────────────+   |\n|                       |                           |\n| +─────────────────────+───────────────────────+   |\n| |   Lemma: Relational Logic Solver (Python)   |   |\n| +─────────────────────+───────────────────────+   |\n|                       |                           |\n| +─────────────────────+───────────────────────+   |\n| |   Manam: Tri-State Epistemic Controller     |   |\n| +─────────────────────+───────────────────────+   |\n+───────────────────────────────────────────────────+\n                        |\n        +───────────────+───────────────+\n        v                               v\n  [TRUE / FALSE]                   [UNKNOWN]\n  (Permit Tool Run)             (Fail-Closed Halt)\n# Project-level (recommended)\ncurl -fsSL https://raw.githubusercontent.com/axiom-csc/axiom-claude-skill/v1.2.2/install.sh | bash\n\n# Global — all projects on this machine\ncurl -fsSL https://raw.githubusercontent.com/axiom-csc/axiom-claude-skill/v1.2.2/install.sh | bash -s -- --global\n```\n\nThat's it. The installer downloads the hook, registers it in `.claude/settings.json`, and generates `.axiom/invariants.yaml` from your codebase — all in one step. Axiom runs automatically in every Claude Code and Cursor session from this point on.\n\n**Why `curl | bash` is safe here:** The installer is a bash script that downloads 6 Python files and registers a hook in `.claude/settings.json`. It makes no network calls after install, never runs as root, and writes only to your project directory (or `~/.claude/` with `--global`). Read it: [https://github.com/axiom-csc/axiom-claude-skill/blob/v1.2.2/install.sh](https://github.com/axiom-csc/axiom-claude-skill/blob/v1.2.2/install.sh)\n\nFor additional agents:\n\n```\ncurl -fsSL .../install.sh | bash -s -- --agents=cursor          # Claude Code + Cursor\ncurl -fsSL .../install.sh | bash -s -- --agents=cursor,vscode   # + VS Code file-save task\nbash install.sh uninstall\n```\n\n| Pass | Component | What it does | \n|---|---|---|\n| 1 | **Noema** | Extracts typed constraints from task context via regex patterns | \n| 2 | **Lemma** | Evaluates them against your invariants (deterministic Python logic) | \n| 3 | **Manam** | Enforces 3-state logic: TRUE / FALSE / UNKNOWN | \n\n**On UNKNOWN** — Claude halts and asks the exact right question.\n**On FALSE** — Claude outputs an `AxiomConstraintViolation` and stops.\n\n| Agent | Mode | Blocking? | \n|---|---|---|\n| Claude Code | PreToolUse hook via `.claude/settings.json` | Yes — blocks before write | \n| Cursor | `.cursor/hooks.json` (same format) | Yes — blocks before write | \n| Aider / Continue / generic | `--stdin` mode (pipe JSON tool call) | Yes — if wired manually | \n| VS Code + Copilot | File-save task ( `.vscode/axiom-task.json` ) | No — flags after write | \n\n**Generic `--stdin` mode** — any agent that can pipe JSON through a subprocess:\n\n```\necho '{\"tool_name\":\"Write\",\"tool_input\":{\"file_path\":\"src/auth/middleware.py\",\"content\":\"if user.id==1: return True\"}}' \\\n  | python3 .claude/skills/axiom-csc/hooks/pre_tool_use.py --stdin\n# exit 1 = deny, exit 2 = ask, exit 0 = allow\n```\n\n| Category | What Axiom catches | Known gaps | \n|---|---|---|\n| **Payments / numeric bounds** | Hardcoded limits that don't match your policy | Limits stored in variables ( `max = 10000; amount > max` ); math expressions —`MAX_TRANSACTION = 10000 * 8` is read as`10000` , not`80000` | \n| **Auth: hardcoded ID** | `user.id == 1` checks in auth paths (AST-based) | Aliased variables more than one hop deep | \n| **Auth: unconditional return** | `if True: return True` in auth paths | Complex conditional chains | \n| **Auth: role literals** | `\"admin\"` ,`\"root\"` in non-config auth files | Config files exempt by design; non-English role names | \n| **Auth: commented checks** | `# check permission` in auth files | Non-English comments | \n| **Dangerous Bash** | DROP TABLE, rm -rf (non-tmp), curl\\|bash, writes to .axiom/ | Multi-line commands, heredocs, commands via Python subprocess; encoded payloads piped to bash ( `base64 -d \\| bash` , xxd, hex decode patterns) | \n| **Secrets** | AWS keys, Stripe live/test keys, OpenAI keys, PEM blocks, hardcoded passwords | Secrets stored in variables before assignment; base64-encoded secrets | \n| **Dependency confusion** | Misspellings of requests, numpy, flask, django, express, react, lodash, axios | Packages not in the hardcoded known list | \n| **Rate limits** | Invented req/min values | Values in separate config files | \n| **File uploads** | Assumed size caps | Caps expressed in bytes not MB | \n| **Database** | Arbitrary LIMIT clauses | LIMIT in comments or strings | \n| **API quotas** | Made-up daily call limits | Quotas in env vars | \n\nAuth checks are **path-scoped** — they only fire in files under `auth/`, `middleware/`, `permissions/`, or `roles/`. The same pattern in `src/utils/helpers.py` is allowed.\n\nAuth bypass detection uses Python's `ast` module, so whitespace and simple aliases don't bypass it.\n\n**Without Axiom** — agent sets MAX_TRANSACTION higher than policy allows:\n\n```\n# Claude writes:\nMAX_TRANSACTION = 75000   # raised for enterprise tier\n```\n\n**With Axiom** (hook fires immediately on the Edit call):\n\n```\n❌ [Lemma BLOCK] AxiomConstraintViolation: transaction_value = 75000.0 violates lte 50000\n[axiom-csc] Invariant violation: ❌ [Lemma BLOCK] AxiomConstraintViolation: transaction_value = 75000.0 violates lte 50000\n```\n\nClaude sees the denial reason and asks for clarification instead of silently writing the bad value.\n\nTo record the demo GIF: install [vhs](https://github.com/charmbracelet/vhs) (`brew install charmbracelet/tap/vhs`), then run:\n\n```\nvhs scripts/demo.tape\n```\n\nOr record with asciinema: `asciinema rec demo.cast && bash scripts/record_demo.sh` — upload the `.cast` file to asciinema.org and embed the link here.\n\n**Without Axiom:**\n\n```\n# Claude writes to src/auth/middleware.py:\nif user.id == 1:\n    return True   # hardcoded ID bypass\n```\n\n**With Axiom:**\n\n```\n❌ [Lemma BLOCK] AxiomConstraintViolation: auth_hardcoded_id = 1 violates banned true\n[axiom-csc] Invariant violation: auth_hardcoded_id — hardcoded user ID check detected in auth path\n```\n\n| Mode | Trigger | Behavior | \n|---|---|---|\n| STRICT | *(default)* | Halt on any UNKNOWN or violation | \n| AUDIT | `[AXIOM: AUDIT]` | Execute + append telemetry block | \n| REPAIR | `[AXIOM: REPAIR]` | Auto-rewrite violations before output | \n\n```\n# Check telemetry status\npython3 .claude/skills/axiom-csc/scripts/axiom.py telemetry status\n\n# Enable / disable telemetry\npython3 .claude/skills/axiom-csc/scripts/axiom.py telemetry on\npython3 .claude/skills/axiom-csc/scripts/axiom.py telemetry off\n\n# Submit a false positive / false negative case\npython3 .claude/skills/axiom-csc/scripts/axiom.py report\n```\n\nEdit `.axiom/invariants.yaml` (auto-generated by `axiom_init.py`):\n\n```\nrules:\n  - concept: transaction_value\n    op: lte\n    value: 50000\n    action_on_fail: BLOCK\n\n  - concept: dangerous_bash\n    banned: true\n    action_on_fail: BLOCK\n\n  - concept: secret_pattern\n    banned: true\n    action_on_fail: BLOCK\n\n  - concept: dep_confusion\n    banned: true\n    action_on_fail: BLOCK\n\n  - concept: role_assignment\n    required: true\n    action_on_missing: ASK\n```\n\n**Rule fields:**\n\n| Field | Meaning | \n|---|---|\n| `op: lte` +`value: N` | Fail if extracted numeric value exceeds N | \n| `banned: true` | Fail if any matching entity is found in the tool call | \n| `required: true` | Ask for clarification if the entity is not found | \n\n| Limitation | Why | \n|---|---|\n| Semantic bypasses | An agent can write `50000 + 25000` or put values in variables — Noema extracts literals only | \n| Container escape | Axiom runs inside the agent's process; a compromised container can bypass the hook entirely | \n| Single call scope | The hook sees one tool call at a time — invariants spread across files are not checked | \n| Path-scope bypass | Auth checks only cover the four named directories; a renamed auth module is not caught | \n| Edit-distance coverage | Dependency confusion uses a fixed known-package list — typos against unlisted packages are missed | \n\nAxiom is a first line of defense, not a complete security layer. Use it alongside proper code review, CI checks, secret scanning (gitleaks), and least-privilege infrastructure.\n\nTelemetry is **off by default**. When enabled:\n\n**What is sent:**\n\n- A random install ID (uuid4, not tied to your machine or account)\n- Timestamp, decision (allow/ask/deny), rule ID, tool name, latency, skill version, OS name, Python version\n\n**What is NEVER sent:**\n\n- Tool input, code, file paths, file names, shell commands\n- Contents of `invariants.yaml` , env vars, CWD, or project names\n\n**How to turn off:**\n\n```\npython3 .claude/skills/axiom-csc/scripts/axiom.py telemetry off\n```\n\nOr set `\"telemetry\": false` in `~/.config/axiom-csc/config.json`.\n\n`axiom report` is always **manual**: you pick the case, review the redacted payload, and explicitly type `yes` to submit. Reports become public GitHub issues under CC-BY-4.0.\n\nSee [PRIVACY.md](https://github.com/axiom-csc/axiom-skill/blob/main/PRIVACY.md) for full details.\n\n**Q: Why not use Claude Code's plugin marketplace?**\n\nClaude Code's plugin marketplace distributes MCP servers and slash-command skills — it does not currently support PreToolUse hooks, which is the hook type this tool requires to block before a write happens. Installing via this script is the only supported path until Anthropic adds marketplace support for hooks. When they do, we'll publish there.\n\nSee [CONTRIBUTING.md](https://github.com/axiom-csc/axiom-skill/blob/main/CONTRIBUTING.md). Good first issues tagged on GitHub — S3 file size extractor, Kubernetes quota templates, Supabase RLS parser.\n\nMIT · [Axiom CSC](https://github.com/axiom-csc)", "url": "https://wpnews.pro/news/axiom-blocks-ai-agents-from-inventing-limits-your-code-never-defined", "canonical_source": "https://github.com/axiom-csc/axiom-skill", "published_at": "2026-11-06 01:00:43+00:00", "updated_at": "2026-11-06 01:20:14.347307+00:00", "lang": "en", "topics": ["ai-agents", "ai-tools", "developer-tools", "ai-safety"], "entities": ["Axiom", "axiom-csc", "Claude Code", "Cursor", "Noema", "Lemma", "Manam", "VS Code"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/axiom-blocks-ai-agents-from-inventing-limits-your-code-never-defined", "markdown": "https://wpnews.pro/news/axiom-blocks-ai-agents-from-inventing-limits-your-code-never-defined.md", "text": "https://wpnews.pro/news/axiom-blocks-ai-agents-from-inventing-limits-your-code-never-defined.txt", "jsonld": "https://wpnews.pro/news/axiom-blocks-ai-agents-from-inventing-limits-your-code-never-defined.jsonld"}}