Axiom, a new local guardrail for AI coding agents, is tackling the persistent issue of LLMs hallucinating business logic and technical constraints. Released as a pre-write hook for Claude Code and Cursor, the tool intercepts tool calls to prevent agents from inventing limits that were never defined in the codebase. With zero dependencies, no API keys, and no token costs, Axiom runs entirely locally, offering a lightweight alternative to cloud-based semantic filters.

The Noema-Lemma-Manam Pipeline

The core engine operates through a three-stage pipeline: Noema, Lemma, and Manam. Noema extracts typed constraints from the task context using regex and AST patterns. Lemma then evaluates these against user-defined invariants using a deterministic Python logic solver. Finally, Manam enforces a tri-state epistemic controller: TRUE permits the write, FALSE blocks it with a constraint violation, and UNKNOWN halts the agent to ask the user for clarification. This fail-closed approach ensures that ambiguous actions don't silently corrupt the codebase.

Blocking Before the Write

Unlike post-write linters, Axiom acts as a pre-tool-use hook registered in .claude/settings.json or .cursor/hooks.json. This means the block happens before the file is modified. For generic agents like Aider or Continue, Axiom supports a stdin/stdout mode where JSON tool calls are piped through the subprocess, returning exit codes 0 (allow), 1 (deny), or 2 (ask). The tool specifically targets common accidental violations, such as hardcoded user IDs in auth paths, invented rate limits, and dangerous bash commands like rm -rf.

Limitations and Adversarial Resistance

The developers are transparent about the tool's scope: detection is regex and AST-based, not semantic. A motivated agent can bypass checks with minor obfuscation, such as storing limits in variables or using complex math expressions. Axiom is designed as a first line of defense against accidental hallucinations, not a complete security layer. For adversarial resistance, the team recommends pairing Axiom with container isolation, branch protection, and standard CI checks. Telemetry is off by default, sending only random install IDs and decision metadata, never code content or file paths.

Key Takeaways

  • Axiom blocks AI agent writes locally using a PreToolUse hook, preventing hallucinated constraints before they hit the disk.
  • The tool uses a tri-state logic (TRUE/FALSE/UNKNOWN) to either permit, block, or halt for clarification, avoiding silent failures.
  • It is not a security sandbox; semantic bypasses are possible, so it must be paired with container isolation and code review.
  • Installation is via a single curl | bash script, with no API keys or network calls required after setup.

The Bottom Line

Axiom is a pragmatic, hacker-friendly solution to the 'vibe coding' problem, stopping agents from making up their own rules. It won't stop a sophisticated attack, but it will definitely stop Claude from inventing a $75k transaction limit when your policy says $50k.