MCP.Market

AXIOM MCP server

by dragoscv·io.github.dragoscv/axiom·v3.0.0
No reviews yet

Transactional write gate for coding agents: plan, canonical manifest, checks, two-phase apply.

B75/100grade B
Write a reviewInstall
What users say
No reviews yet
Be the first
Safety scan
B75/100

full report

Adoption
Growing

0 stars227 downloads/wk

Reviews

Write one

Nobody has reviewed AXIOM yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

AXIOM tools (19, 3 write)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

  • axiom_apply

    Transactionally write the bundle into the root: pre-image verification, staging, journal, atomic renames, scoped rollback on failure. Requires `confirmDigest === bundle.manifestDigest` (echo the digest you saw in dry-run); when the client supports elicitation the user must also confirm by typing the digest's first 12 hex characters. Idempotent: re-applying an applied digest is a no-op.

  • axiom_apply_dry_runwrite action

    Stage the bundle under <root>/.axiom/staging, run pre-apply checks and produce a unified diff against the current tree. Nothing outside .axiom/ is touched. Echo the returned manifestDigest as `confirmDigest` to axiom_apply.

  • axiom_axm_parse

    Parse .axm v2 text into a Plan with 1-based {line, column} diagnostics; `plan` is present only when error-free. Read-only.

  • axiom_check

    Evaluate the profile's predicates (plus the manifest's own checks) against the bundle. Repo facts are read from the root when one is available and the profile allows it. Verdict `error` means a provider could not run — never a silent pass.

  • axiom_check_start

    Same evaluation as axiom_check, but returned immediately as a task so long `guard.external` suites (up to 15 min per guard) outlive the client's per-call timeout. Poll axiom_task_get with the returned taskId every pollIntervalMs until status is completed|failed|cancelled; the CheckReport is in `result`. Finished tasks are pollable for ttlMs, then forgotten. Tasks live in this server process only (

  • axiom_manifest_diff

    Compare two manifests by artifact path and digest. Each side is a ManifestBundle or a `sha256:<hex>` reference to a bundle stored under an allowlisted root.

  • axiom_manifest_verify

    Structural and content-address verification: schema, recomputed manifestDigest, every inline blob hashes to its key, attestation subject matches. When a root with .axiom/trust/keys.json is available, detached DSSE signatures are verified and the trusted keyids are reported under `signatures`. Never writes.

  • axiom_plan_add

    Add a chunk of Plan artifacts (each ≤ 4 MiB call, inline content ≤ 256 KiB per artifact as in a Plan) to an open session. Paths must be unique across every chunk (ERR_INVALID_PLAN otherwise); a sealed or over-budget session is ERR_PLAN_SESSION_STATE.

  • axiom_plan_begin

    Start assembling a Plan whose JSON would exceed the 4 MiB per-call cap: send the header here (everything except `artifacts`), append artifacts in chunks with axiom_plan_add, then axiom_plan_seal compiles the whole. The sealed bundle's manifestDigest is identical to a one-shot axiom_plan_compile of the same Plan. Sessions are in-memory, expire after 30 min idle, and hold at most 2000 artifacts / 64

  • axiom_plan_compile

    Compile a Plan into a content-addressed ManifestBundle (sorted artifacts, sha256 digests, in-toto planDigest). `store: cas` writes blobs under <root>/.axiom/cas instead of inlining them. When a root is given the bundle is stored under <root>/.axiom/manifests/<hex>.json so later tools can reference it by digest. `template` sources need an emitter package loaded with `axiom mcp --emitter <pkg>` (e.g

  • axiom_plan_seal

    Assemble the session's header + every added artifact into one Plan and compile it exactly like axiom_plan_compile (same options, same digest). The session is consumed whether or not compilation succeeds. Bundles whose inline blobs exceed 4 MiB need `store: cas` (and therefore a root).

  • axiom_plan_validate

    Validate a Plan against PlanSchema and, when all sources are inline, compute its planDigest. Read-only; touches no files.

  • axiom_repo_snapshot

    Deterministic, content-addressed inventory of a root: every regular file (and symlink) as { path, bytes, sha256, mode, kind }, sorted by code point, with snapshotDigest = sha256(JCS(body)). No timestamps, no absolute paths — the same tree gives the same digest on every machine. Honours the root .gitignore, always skips .git/ and .axiom/, never follows symlinks, never leaves the root. Use it to bui

  • axiom_rollback

    Replay the journal of a committed/committing manifest in reverse: restore backups, remove created files, drop the applied marker.

  • axiom_roots_list

    The frozen set of roots this server may read and write, as given by --root at startup.

  • axiom_status

    Read-only snapshot of a root's write state, same as `axiom status --json`: who holds .axiom/lock (pid, host, digest, since, stale), the wait queue, registered in-flight intents (paths), interrupted journals that need `axiom_rollback`, the last applied chain entry and whether the journal hash chain verifies. Never takes the lock.

  • axiom_task_cancelwrite action

    Abort a `working` task: every running guard process tree is killed and the task ends `cancelled` with error ERR_TASK_CANCELLED. Idempotent — a terminal task is returned unchanged.

  • axiom_task_get

    Status of a task created by axiom_check_start. While `working` only the descriptor is returned; once terminal, `result` (completed) or `error` (failed|cancelled) is attached. Unknown or expired taskId → ERR_TASK_NOT_FOUND.

  • axiom_writewrite action

    One-tool transactional write: send the files you want written/deleted. Without confirmDigest it compiles them against the current tree, runs the pre-apply checks and returns status `preview` with the manifestDigest and a unified diff (nothing outside .axiom/ touched). Call again with the SAME files, intent and profile plus confirmDigest=<manifestDigest> to apply atomically (when the client support

Public scan report

scanner v0.1.10 · 2026-10-30 · same rubric, same numbers if you re-run it

1 medium
  • Code scan27 source files scanned20/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitystatic API keys via environment variables6/15
  • Maintenancelast push 2 days ago15/15
  • Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10

Findings (1)

  • mediumeval / new Function usedexec.eval
    dist/axm-lazy.js: …s("Cloudflare")) return false; try { new Function(""); return true; } catch (_) { ret…
Overall 75/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How AXIOM compares

Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
75/100
higher than 45% of 48,255 servers
Tools
19
the typical server has 7
Tools that change things
16%
typical: 0%. Fewer write tools means less an agent can break
Downloads a week
227
more than 77% of 12,191 servers with a package

What its tools let an agent do: 16 read · 3 change

Release history: 8 versions in the registry since 2026-09-21, latest 2026-10-19, typically one every 3 days.

Install AXIOM in Claude Code, Cursor or VS Code

Runs npx -y @codai/axiom-mcp on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add axiom -- npx -y @codai/axiom-mcp
Add to Cursor

What the publisher says

From the AXIOM repository's README, as published. We do not edit it. Read it on GitHub

Docs · Quickstart · Tools · Architecture · Packages · Contributing

An agent describes a change set as a Plan. AXIOM compiles it to a canonical, content-addressed Manifest, runs checks over the whole set, and applies it with a hash-gated two-phase commit that leaves a journal and, optionally, a signed attestation. It ships as one npm package — @codai/axiom-mcp — that is an MCP server, a CLI, a PreToolUse hook and a GitHub Action.

Why

one write at a time. A forty-file refactor is forty blind decisions; AXIOM checks the whole manifest first — "if you touch X you must also touch Y", dependency budgets, secrets, paths.

  • Per change set, not per tool call. Harness hooks (Claude Code, Copilot, Cursor) decide

apply demands the digest you inspected (confirmDigest), re-hashes every pre-image at commit, and rolls back to the byte-identical prior tree on any failure — on a tree several agents share.

  • Byte-exact. The manifest is JCS-canonical (RFC 8785) and holds only sha256 digests;

with pinned Ed25519 keys and anti-rollback counters; verify --tree proves a tree matches a manifest and emits an in-toto attestation that CI uploads to Sigstore.

  • Provable. Every apply leaves a journal keyed by digest. Manifests can be DSSE-signed

What it does

flowchart LR
  subgraph entry [Entry points]
    direction TB
    MCP[MCP server<br/>stdio · Streamable HTTP]
    CLI[CLI<br/>axiom compile · check · apply]
    HOOK[PreToolUse hook<br/>axiom gate --stdin]
    GHA[GitHub Action<br/>dragoscv/axiom/action@v2]
  end
  P[Plan<br/>JSON or .axm] -->|compile| M[Manifest<br/>JCS · sha256 per file<br/>blobs · CAS · ref · patch]
  M -->|check| C[CheckReport<br/>pass · fail · error]
  C -->|apply · 2PC<br/>confirmDigest| T[Repository tree]
  T --> J[Journal · ApplyResult<br/>DSSE signature · in-toto attestation]
  J -.->|rollback| T
  entry --> P

Install

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

AXIOM: common questions

Is AXIOM MCP server safe?
Mostly: it is graded B (75/100). Read the AXIOM safety report
How do I install AXIOM?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does AXIOM need an API key?
Yes. The registry entry asks for AXIOM_SIGNING_KEY.
Is AXIOM maintained?
The last commit was 7 days ago (2026-10-28). The latest release is v3.0.0.
How does AXIOM compare with other MCP servers?
safety score 75/100 (higher than 45% of 48,255 servers); tools 19 (the typical server has 7); tools that change things 16% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.