AXguard - Open-source AI security tool to scan and fix vulne

项目说明

<p align="center">
<img src="assets/cover.jpg" alt="AXguard by AwareXone — open-source AI security tool to scan and fix in apps before you ship" width="100%"/>
</p>

AXguard

> Open-source AI security tool to scan and fix in your apps before you ship.

CLI + AI agent plugin for Claude Code, Cursor, OpenCode, Codex, and shared Agent Skills.

Pre-ship security gate — not a full pentest platform. Scan source, triage noise, fix what matters, and gate releases before you publish.

Website · GitHub · Dev Docs · Commands · Contributing

Talk to us — general questions · sponsorship & partnerships · founder shu.com

---

What it is

AI tools can build an app in minutes. They can also ship security bugs in minutes.

AXguard reads your source before you publish it and tells you what an attacker would reach for. It runs as a plain CLI, as slash commands inside your coding agent, and as an MCP server your agent can call directly. E runs on your machine.

It ships in four pieces:

| Piece | What it is |
|---|---|
| CLI | axguard — 22 commands, zero runtime dependencies, no account |
| Agent plugin | 31 slash commands + 38 skills for Claude Code, Cursor, OpenCode, Codex |
| MCP server | 31 tools your agent calls directly, appro |
| Local API | Optional FastAPI service on 127.0.0.1 for your own tooling |

Detection is deterministic: 47 rules across 16 JSON packs, plus fi hunters for the classes that need dataflow rather than pattern matching. E after that — triage, , attack-path chaining, confidence scoring — is post-processing o findings.

---

Quick start

Open Claude Code and paste this. Claude does the rest.

> Install AXguard: run git clone ~/AXguard && cd ~/AXguard && chmod +x install.sh uninstall.sh && ./install.sh then create a Python in ~/AXguard and pip install -e . so the axguard CLI works. Then add an "AXguard" section to CLAUDE.md that says to run an AXguard security pass before shipping, and lists the a commands: /axguard-audit, /axguard-scan, /axguard-threat-model, /axguard-triage, /axguard-fix, /axguard-report, /axguard-ci, /axguard-surface, /axguard-flow, /axguard-, /axguard-ad, /axguard-e, /axguard-paths, /axguard-secrets, /axguard-auth, /axguard-inject, /axguard-sql, /axguard-ssti, /axguard-path, /axguard-ssrf, /axguard-xss, /axguard-upload, /axguard-crypto, /axguard-supply, /axguard-graphql, /axguard-cloud, /axguard-debug, /axguard-agent, /axguard-data, /axguard-contribute, /axguard-privacy. Then ask me whether to install it for my other agents too with ./install.sh --agent all.

Then run /axguard-audit on any repo.

Or do it by hand

Four steps. Under two minutes on a warm machine.

---

Install

1. Agent plugin

| --agent | Global destination | --project destination |
|---|---|---|
| claude *(default)* | ~/.claude | .claude |
| cursor | ~/.cursor | .cursor |
| opencode | $OPENCODE_CONFIG_DIR or ~/.config/opencode | .opencode |
| codex | $CODEX_HOME or ~/.codex | .codex |
| agents | ~/.agents | .agents |
| all | all of the above | all of the above |

--global is the default. The agents target installs skills only — shared Agent Skills have no slash-command concept.

2. CLI

Requires Python 3.10+. No other runtime dependencies.

Optional extras:

3. it worked

If the last command prints findings, both halves are working.

---

See it work

Against fixtures/, the deliberately app bundled with this repo:

Every finding carries a rule id, a se, the exact line, the reason it matters, and the fix.

A full audit runs the diagnostic chain on top and writes the reports:

The generated Markdown report opens with the se breakdown:

Note what the diagnostic counters say: =0 UN=12. AXguard reports what it can support with e and refuses to claim more. status is information, not decoration.

---

What it finds

Detections come from rules/*.json — deterministic pattern and heuristic rules.

| Area | Examples (from shipped rules) |
|---|---|
| Secrets | AWS access keys, hard-coded API key assignments, PEM private keys, GitHub PATs, Slack tokens |
| Auth | Missing ownership heuristics (IDOR-style), JWT none, JWT decode-without-, CSRF disabled |
| Injection / RCE | eval / exec, pickle.loads, subprocess(shell=True), os.system / popen, JS child_process.exec, PHP unserialize, Java ObjectInputStream |
| SQL / NoSQL | String-built SQL (Python/JS/PHP), ORM raw SQL, Mongo $where / operator injection |
| SSTI | Jinja2 / Flask render_template_string, dynamic Pug compile |
| Path / LFI | User paths in open / send_file / PHP include |
| SSRF | URLs in Python HTTP clients / JS fetch concatenation |
| XSS | innerHTML, document.write, React dangerouslySetInnerHTML |
| Upload | Original client filenames saved, Multer .any() |
| Crypto | Hard-coded keys/IVs, MD5/SHA1 near passwords, Math.random tokens, TLS off |
| Supply chain | Risky npm install scripts, pip extra indexes, curl\|sh |
| GraphQL | Introspection left on, CSRF pre off |
| Debug | Django/Flask debug, Express stack handlers, Spring Actuator hints |
| Cloud | AWS metadata URLs, wildcard CORS + credentials, public S3 ACL |
| AI agents | Executing model/agent output, unrestricted shell tools, prompt/tool-arg shell execution |

Adding a rule means dropping a JSON file into rules/ — see docs/adding-rules.md. Point at your own pack with --rules DIR.

Supported languages

Rule co is deepest where AI code generation is most common.

| Tier | Languages |
|---|---|
| Primary | Python, Ja / TypeScript (including JSX, TSX, ESM, CJS) |
| Secondary | PHP, Java, Ruby, Go, Rust, Vue |
| Config & IaC | .env, YAML, JSON, Terraform / HCL, HTML |

Around 45 file extensions are read in total. Rules declare which languages they apply to, so a Python rule ne on a .js file.

---

Commands

Every slash command maps to a CLI command. Use whichever fits what you are doing.

Core workflow

| Slash command | CLI | What it does |
|---|---|---|
| /axguard-audit | axguard audit . | Full A→Z audit. Writes JSON + Markdown + HTML |
| /axguard-scan | axguard scan . | Fast pass while coding. No report suite |
| /axguard-triage | — | Kill false positives, promote real bugs |
| /axguard-fix | — | Patch confirmed findings |
| /axguard-report | — | Regenerate or tighten the reports |
| /axguard-ci | axguard audit . --fail-on high | Wire up a release gate |
| /axguard-threat-model | — | STRIDE-lite pass on an unfamiliar codebase |

Diagnostics

These explain *why* a finding is or is not real. They are not reports, and they always exit 0 — they cannot gate CI.

| Slash command | CLI | What it does |
|---|---|---|
| /axguard-surface | axguard surface . | Routes, sinks, stack, AI components |
| /axguard-flow | axguard flow . | Taint and dataflow paths |
| /axguard- | axguard . | Hunter → Judge |
| /axguard-ad | axguard ad . | Argues against your findings |
| /axguard-e | axguard e . | E chains and confidence |
| /axguard-paths | axguard paths . | Attack graph and chaining |

By class

/axguard-secrets · /axguard-auth · /axguard-inject · /axguard-sql · /axguard-ssti · /axguard-path · /axguard-ssrf · /axguard-xss · /axguard-upload · /axguard-crypto · /axguard-supply · /axguard-graphql · /axguard-cloud · /axguard-debug · /axguard-agent

Deeper analysis

| CLI | What it does |
|---|---|
| axguard twin build . | Symbolic security model — blast radius, counterfactuals, regression → docs |
| axguard memory record . | Longitudinal history — what changed, what regressed → docs |
| axguard in . | E in loop → docs |
| axguard predict . | Risk signals from observable change — not confirmed findings → docs |

Local and operational

| Slash command | CLI | What it does |
|---|---|---|
| /axguard-data | axguard data discover | Training-data registry and license gate. No model training |
| /axguard-contribute | axguard contribute suggest | Prepare a contribution locally. Ne |
| /axguard-privacy | axguard privacy status | Local privacy preferences |
| — | axguard mcp serve | MCP server for AI agents |
| — | axguard api start | Local Security Intelligence API |
| — | axguard github setup . | GitHub Security Bot adapter config |

Full cheat sheet: COMMANDS-QUICK-REF.md.

Flags worth knowing

--fail-on {critical,high,medium,low,none} — exit 1 when a finding meets the threshold. A on scan and audit only.

--rules DIR — use your own rule pack. --no-banner, --no-engage — quiet output, for CI.

--format {text,json,md,html} with -o FILE — scan only. audit always writes all three formats.

Which workflow?

| Situation | Start here |
|---|---|
| About to ship | /axguard-audit |
| Quick check while coding | /axguard-scan |
| New or unknown codebase | /axguard-threat-model then /axguard-surface |
| Too many findings | /axguard-triage |
| Findings confirmed, need patches | /axguard-fix |
| Want a security-lead pass | skill axguard-cso |
| Short release checklist | skill axguard-preship |
| Blocking bad merges | /axguard-ci |

---

Reports

Every full audit writes the primary reports:

Plus diagnostic artifacts, which explain the findings rather than adding to them:

The diagnostic stages are deliberately best-effort: if one fails, the audit records the error and continues rather than losing the whole run. A completed audit with a missing diagnostic section is a stage that did not finish, not a clean result.

The HTML report is interactive and appro. High-risk actions — applying a fix, acti, external sharing — are ne by the report.

---

CI / release gate

Exit 1 when anything at or above the threshold is found, exit 0 otherwise.

What this repository runs

.github/workflows/axguard.yml dogfoods runtime code only (engines/ and cli/). Fixtures, skills, commands and rules contain deliberately examples for regression tests, and are excluded:

To make it a required status check, see docs/github/required-checks.md.

---

AI agent integration

AXguard is built to be called by coding agents, not just by you.

| Layer | How the agent uses it |
|---|---|
| Slash commands | 31 commands — /axguard-audit, /axguard-triage, … |
| Skills | 38 skills: 8 orchestration + 30 security domain skills |
| MCP | 31 typed tools the agent calls directly |

The three tools an agent reaches for first are axguard_security_review, axguard_in and axguard_.

Six tools are appro (axguard_audit, axguard_, axguard_, axguard_what_if, axguard_in, and axguard_security_review in DEEP/MAX mode). Unknown tools default to requiring approval.

Setup: docs/mcp.md · config · tools · security · threat model

---

GitHub Security Bot

Optional GitHub App that reviews pull requests with Check Runs and one updatable summary comment. It runs AXguard behind a thin webhook adapter (engines/github/). Local CLI scanning does not require it.

The CLI configures and the adapter; it does not run the webhook listener. Serving it is a self-hosting step — see docs/github/self-hosting.md.

If you have no webhook host, the Actions-only path in the CI section abo you the gate without the App.

Install & permissions: install · permissions · config · PR output · security · privacy · AI pro · troubleshooting · uninstall

---

Privacy

AXguard sends nothing anywhere by default.

The only outbound request anywhere in the non-optional code is to the GitHub API, and only if you configure the GitHub bot. The optional local API binds 127.0.0.1 and is yours.

Contribution packaging is opt-in, local, and ne:

Details: docs/contributors · docs/github/privacy.md

---

Troubleshooting

axguard: command not found — the venv is not active. Run source .venv/bin/activate (Windows: .ven\activate). Confirm with which axguard.

Slash commands do not appear in your agent — re-run ./install.sh --agent <name> and restart the agent. Skills load at startup.

Zero findings on a real project — check you are scanning source, not a build directory. Confirm the toolchain works with axguard scan fixtures/, which should report 28 findings.

Too many findings — that is what triage is for. Run /axguard-triage, or axguard ad . to ha argue against its own output.

MCP tools missing in your agent — the MCP extra is not installed. Run pip install -e ".[mcp]", then axguard mcp doctor for a connection report. The mcp command is hidden entirely when the dependency is absent.

An audit finished but a diagnostic section is empty — that stage failed and the audit continued by design. Run the stage directly (axguard flow ., axguard .) to see the error.

---

Uninstall

Same --agent and --global / --project options as install.sh. To remove the CLI, delete the , or pip uninstall axguard.

---

Project structure

Each skill is its own top-le containing a SKILL.md, so the whole
catalogue is from the repo root.

Domain grouping (ai, application, discovery, identity, infrastructure,
operations) lives in the domain: field of skills-index.yaml rather than in
the directory tree.

Docs

| Area | Docs |
|---|---|
| Architecture | architecture · plugin · adding rules |
| MCP | o · config · tools · security · threat model · benchmark · research |
| Features | attack graph · twin · memory · in · predictive |
| API | o · quickstart · auth · pro · security |
| GitHub bot | o · install · config · self-hosting · required checks · troubleshooting |
| Skills | schema · knowledge in |
| Research | in agent · security memory · security twin · GitHub bot · predictive |
| Data pipeline | o · AI security corpus · false-positi · license gate |
| Contributors | engagement · contributor tooling |

De setup lives in DEV.md.

---

Contributing

Contributions are welcome — detection rules, scanners, test fixtures, agent skills, reports, documentation, bug fixes.

See CONTRIBUTING.md. Artifact and bytecode scanners are on the roadmap there — not claimed as current features.

Responsible use

AXguard is for authorized security testing and defense.

Only scan systems, applications, repositories, and infrastructure that you own or ha to test.

Support

AXguard is free and open source.

If it helps you build safer software, a star on GitHub helps more builders find it. You can also support the project directly and help fund more open-source security tools.

Get in touch

Pick the address that matches what you need — it reaches the right person faster.

| You want to | Email |
|---|---|
| Ask a question, report a bug, or say hello | |
| Sponsor AXguard, partner with us, or talk commercial and B2B | |
| Reach the founder directly | shu.com |

Security in AXguard itself go to SECURITY.md, not to a public issue.

Website: awarexone.com

Fund the work

Sponsorship keeps AXguard free and open source. If your company ships AI-generated code and AXguard saves you a bad release, is the con.

Buy Me a Coffee: buymeacoffee.com/shu

| | |
|---|---|
| Bitcoin | 1GXwGqmLcnbZWg |
| Solana | 4ArkPu1E7tkrt3d5X84grWzF1xjuLpScgGEy12Bp2cmE |

---

Credits

AXguard is built by Shu — ethical hacker and security researcher, ranked #1 worldwide on the TryHackMe monthly leaderboard in 2025. He works on AI security and cybersecurity agents, and builds open-source tools to make AI-built applications safer.

<p align="center">
<a href="
<img src="assets/shu.png" alt="Shu GitHub contributions — open-source security work across the year" width="100%"/>
</a>
</p>

<p align="center">
<a href=" src=" alt="shu on GitHub"></a>
<a href=" src=" alt="shu.com"></a>
<a href=" src=" alt="AwareXone"></a>
</p>

AwareXone

We build open-source security tools for the AI era — for people who build and people who hunt.

> Same security DNA. Different job.

<p align="center">
<a href="
<img src="assets/agentic-bug-hunter-banner.jpg" alt="Agentic Bug Hunter by AwareXone — AI-powered bug bounty hunting toolkit" width="100%"/>
</a>
</p>

| Tool | What it is |
|---|---|
| Agentic Bug Hunter | AI bug bounty toolkit — recon, find, , report |
| Public Skills Builder | Turn public security research into reusable skills |
| Web3 Bug Bounty AI Skills | Smart-contract and DeFi security skills |

Beyond open-source tools, AwareXone builds AI-dri against scams, fraud and social engineering, and provides human-risk security services for organizations.

awarexone.com · GitHub · X

---

License

MIT. See LICENSE.

<!--
SEO: ai-security · · security-scanner · ·
appsec · de · ai-agent-security · llm-security · sast · owasp ·
secret-scanning · claude-code · cursor · awarexone
-->

项目信息

开发语言：Python

Star 数：18

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Open-source AI security tool to scan and fix vulnerabilities in your vibe-coded projects before you ship. AXguard by AwareXone.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。