axiomCAUTION
The transactional write gate for coding agents: Plan -> canonical Manifest -> set-level checks -> hash-gated two-phase apply. MCP server, CLI, PreToolUse hook, GitHub Action.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://www.npmjs.com/package/@codai/axiom-mcp) [](https://www.npmjs.com/package/@codai/axiom-mcp) [](https://github.com/dragoscv/axiom/actions/workflows/ci.yml) [](https://github.com/dragoscv/axiom/actions/workflows/release.yml) [](https://scorecard.dev/viewer/?uri=github.com/dragoscv/axiom) [](LICENSE) [](https://dragoscv.github.io/axiom/) [](https://registry.modelcontextprotocol.io/v0.1/servers/io.github.dragoscv%2Faxiom/versions/latest) [](https://nodejs.org)
Docs · Quickstart · Tools · Architecture · Packages · Contributing
An agent describes a change set as a Plan. AXIOM compiles it to a canonical, content-addressed Manifest, runs checks over the whole set, and applies it with a hash-gated two-phase commit that leaves a journal and, optionally, a signed attestation. It ships as one npm package — @codai/axiom-mcp — that is an MCP server, a CLI, a PreToolUse hook and
a5aaca5a8803OBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add axiom-mcp --env AXIOM_SIGNING_KEY=${AXIOM_SIGNING_KEY} -- npx -y @codai/[email protected] mcpExposed tools (17)
11 read · 6 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
axiom_apply | write | Transactionally write the bundle into the root: pre-image verification, staging, journal, atomic renames, scoped rollback on failure. Requires |
axiom_apply_dry_run | write | Stage the bundle under <root>/.axiom/staging, run pre-apply checks and produce a unified diff against the current tree. Nothing outside .axiom/ is touched. Echo the returned manifestDigest as |
axiom_axm_parse | read | Parse .axm v2 text into a Plan with 1-based {line, column} diagnostics; |
axiom_check | read | Evaluate the profile |
axiom_check_start | write | Same evaluation as axiom_check, but returned immediately as a task so long |
axiom_manifest_diff | read | Compare two manifests by artifact path and digest. Each side is a ManifestBundle or a |
axiom_manifest_verify | read | Structural and content-address verification: schema, recomputed manifestDigest, every inline blob hashes to its key, attestation subject matches. When a root with .axiom/trust/keys.json is available, detached DSSE signatures are verified and the trusted keyids are reported under |
axiom_plan_add | write | Add a chunk of Plan artifacts (each ≤ 4 MiB call, inline content ≤ 256 KiB per artifact as in a Plan) to an open session. Paths must be unique across every chunk (ERR_INVALID_PLAN otherwise); a sealed or over-budget session is ERR_PLAN_SESSION_STATE. |
axiom_plan_begin | write | Start assembling a Plan whose JSON would exceed the 4 MiB per-call cap: send the header here (everything except |
axiom_plan_compile | read | Compile a Plan into a content-addressed ManifestBundle (sorted artifacts, sha256 digests, in-toto planDigest). |
axiom_plan_seal | read | Assemble the session |
axiom_plan_validate | read | Validate a Plan against PlanSchema and, when all sources are inline, compute its planDigest. Read-only; touches no files. |
axiom_rollback | read | Replay the journal of a committed/committing manifest in reverse: restore backups, remove created files, drop the applied marker. |
axiom_roots_list | write | The frozen set of roots this server may read and write, as given by --root at startup. |
axiom_status | read | Read-only snapshot of a root |
axiom_task_cancel | read | Abort a |
axiom_task_get | read | Status of a task created by axiom_check_start. While |
Trust audit
CAUTIONgrade F · trust 54/100 Install with care. The audit found things worth knowing before you trust its output.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | WARN |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (2 observation(s))
- Network
- declared (4 observation(s))
- Shell
- declared (5 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
axiom_starter_full.zip
"expr": "manifest.name == 'xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
"expr": "manifest.name == 'demo' || 'xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
"expr": "manifest.name == 'demo' || 'xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
{ path: ".env", content: "AWS_KEY=AKIAAAAAAAAAAAAAAAAA" },// Identifier-shaped values (`libsecret = "keyring.backends.libsecret"`, `TOKEN = "REVISION_SCRIPT_FILENAME"`).
'api_key: "sk-live-9f8e7d6c5b4a3210"',
await start({ token: "0123456789abcdef-secret" });const { client } = await connect({ token: "0123456789abcdef-secret" });const token = "0123456789abcdef-secret";
privateKey: "-----BEGIN RSA PRIVATE KEY-----",
axiom-1.0.0-bundle.tar.gz
codai-axiom-mcp-1.0.11.tgz
.copilot-ripple.json
.vscodeignore
if ../../mcp-publisher publish 2>&1 | tee publish.log; then exit 0; fi
readFileSync(new URL("../../packages/vscode-axm/syntaxes/axm.tmLanguage.json", import.meta.url), "utf8"),const source = readFileSync("../../axiom/notes-v2.axm", "utf-8");path: "../../../etc/passwd", // Path traversal
path: "../../etc/passwd", // Path traversal
/.env" ... curl
`--root`. Streamable HTTP clients point at `http://127.0.0.1:3411/mcp` after
{ "servers": { "axiom": { "type": "http", "url": "http://127.0.0.1:3411/mcp" } } }- VS Code: `{ "type": "http", "url": "http://127.0.0.1:3411/mcp" }`; add@types/node, tsx, typescript, vitest
Gates applied: no_behavioural_pass.
a5aaca5a8803full audit observations/trust-audit/mcp-server/dragoscv__axiom.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | a5aaca5a8803 | CAUTION | F | 54 | first audit |
Questions
What is the axiom MCP server?
The transactional write gate for coding agents: Plan -> canonical Manifest -> set-level checks -> hash-gated two-phase apply. MCP server, CLI, PreToolUse hook, GitHub Action.
What tools does axiom expose?
17 in total: 11 read-only, 6 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is axiom safe to connect to an agent?
With care. The audit graded it F (54/100) and found 25 things worth knowing before you trust this server, listed below with the exact line each was found on.
What credentials does axiom need?
It reads ACTIONS_ID_TOKEN_REQUEST_URL, AXIOM_SIGNING_KEY, DB_PASSWORD and SECRET_X from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does axiom run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as axiom-axm at 2.0.0.
How current is this page?
The grade is for one exact copy of the source (a5aaca5a8803), read on 2026-10-11. The repository is watched and re-audited when it changes.