Termaxa

Product Introduction

1. Definition: Termaxa is an open-source, Rust-based security gate and audit layer for AI coding agents (LLM-powered tools). It operates as a hook or wrapper that intercepts and analyzes shell commands and file operations generated by tools like Claude Code, Cursor, GitHub Copilot, and Codex before they are executed.
2. Core Value Proposition: It exists to mitigate the inherent risk of allowing AI agents to execute commands in a developer's environment. Its primary value is consequence preview and safe execution, moving beyond simple command approval to show the actual files, database rows, or git commits that would be affected, creating backups, and enforcing a configurable security policy.

Main Features

1. Command Interception & Semantic Analysis: Termaxa hooks into the AI agent's execution pipeline (via shell hooks, tool-specific APIs like Cursor's, or a wrapper) to capture intended commands. It doesn't just parse strings; it semantically resolves commands, handling compound statements (&&), shell invocations (sh -c), git global flags (-C), and aliases to understand the true intent and target.
2. Blast Radius Preview & Policy Engine: Before any command runs, Termaxa analyzes it against a user-defined policy (written in YAML). It calculates and displays the "blast radius"—the specific files to be deleted, the SQL rows to be dropped, or the commits a git push --force would erase. The engine judges commands as Allow, Ask (requires user approval), or Deny based on this preview.
3. Pre-execution Backup & Tamper-Proof Audit Trail: For approved or "Ask" commands that modify state, Termaxa creates a backup (e.g., via pg_dump for PostgreSQL, file copies, git commit pinning) before execution. All decisions, commands, and their consequences are logged to a cryptographically hash-chained audit file stored in ~/.termaxa, which the AI agent cannot access or modify, ensuring non-repudiation.

Problems Solved

1. Pain Point: Unintended destructive actions by AI coding assistants. Developers risk agents running commands like rm -rf, DROP TABLE, or git push --force without a clear understanding of the impact, leading to data loss or system damage.
2. Target Audience: Software developers and engineers who regularly use AI-powered coding tools (Claude Code, Cursor, Copilot) in terminal-based workflows, particularly those working with production databases, critical git repositories, or complex infrastructure (Terraform, Docker). DevOps and platform engineers seeking to safely introduce AI agents into team environments.
3. Use Cases: Safely using AI for database refactoring (previewing ALTER TABLE or DROP statements), guarding against repository corruption (blocking force pushes), auditing AI agent activity for security compliance, and providing a safety net for junior developers using AI tools by enforcing a team-wide policy.

Unique Advantages

1. Strengths & Limitations (Pros & Cons):

   • Pros: Deep Command Understanding: Resolves complex command chains and native tool calls (Cursor's Delete). Proactive Safety: Backs up first, asks questions after securing state. Agent-Agnostic: Works across multiple AI tools via different integration methods. Transparent Audit: Immutable logs provide a clear history of AI-agent interactions. Open Source & Free Core: Self-hostable, inspectable, with no feature gates.
   • Cons: Configuration Overhead: Requires initial setup (termaxa init) and policy tuning for different projects. Not a Sandbox: It gates and logs actions but doesn't provide full isolation; a malicious or buggy allowed command can still cause damage. Native Tool Coverage: While expanding, may not intercept every non-shell write operation from all possible AI agent plugins or future tooling.

2. Key Alternatives & Differentiation:

   • Built-in Agent Prompts (e.g., Claude Code "Allow this command?"): These only show the command string, not its consequence. Termaxa differentiates by showing the blast radius and creating backups, offering a fundamentally deeper safety layer.
   • Full Sandbox Environments (e.g., Docker containers, VM-based isolation): These provide total isolation but are heavy, disrupt workflow (no direct access to local git, env vars), and don't help with understanding what the agent tried to do. Termaxa is a lightweight "windshield" that works within the developer's real environment, focusing on audit and rollback rather than containment.
   • Simple Shell Aliases/Wrappers: Basic scripts can block commands like rm -rf but lack semantic understanding, cannot preview database operations or git force-push impact, and are easily bypassed by command variations. Termaxa's resolved-target rules and intent classification are far more robust.

Frequently Asked Questions (FAQ)

1. How does Termaxa compare to Claude Code's built-in sandbox? Termaxa is a consequence preview and audit tool that works in your real environment, showing what files or data a command will affect and backing them up. Claude's sandbox is a containerized isolation environment that restricts file access. Termaxa provides deeper insight into what will happen, while a sandbox focuses on where it can happen. They can be complementary.
2. Can Termaxa prevent all data loss caused by AI agents? No. Termaxa is a safety gate and audit tool, not an impenetrable barrier. It is designed to catch dangerous commands via policy, show their impact, and enable rollback via backups. It cannot prevent damage from commands that are incorrectly allowed by policy or from bugs within the tool itself. Its security model is based on transparency and recovery.
3. Does Termaxa work with GitHub Copilot? Yes, Termaxa integrates with GitHub Copilot CLI. When Copilot CLI proposes a command, Termaxa can intercept it, and if configured to "Ask," the request for approval (with the reason and preview) is presented directly within Copilot's prompt interface.
4. Is Termaxa suitable for team or enterprise use? The core open-source tool is excellent for individual and small-team use, providing policy files and audit logs. For enterprise needs like centralized policy management, shared approval queues, and aggregated auditing, the upcoming Termaxa Cloud (mentioned as a future feature) is designed to address those scalability and management requirements.
5. What happens if the Termaxa hook itself has a bug or is bypassed? The project maintains a public list of security advisories (e.g., GHSA-rv66-7qcx-c45j) detailing past bypasses that were found and fixed in real-world use. Its development prioritizes robustness through extensive regression testing (~547 tests), live testing with multiple agents, and a transparent security process. The architecture also includes a "supervised mode" where a daemon runs under a privileged user account, separating the agent's permissions from the gate's decision logic.