AI-powered CLI for code analysis, security hardening, and auto-fixing with instant rollback
npm install fixguardA verifiable, local-first CLI system for safe code evolution.
- š Multi-language support - TypeScript, JavaScript, Python, and more
- š”ļø Security hardening - OWASP-compliant checks and fixes
- āŖ Rollback support - Every change can be undone
- š Comprehensive reporting - Markdown, JSON, and SARIF formats
- š Safe by design - Tools and tests are the judges, never AI
``bashClone the repository
git clone https://github.com/your-org/fixguard.git
cd fixguard
Usage
$3
`bash
fixguard scan .
`$3
`bash
fixguard scan . --auto-fix
`$3
`bash
fixguard scan . --mode=guided-refactor
`$3
`bash
fixguard scan . --ci
`$3
`bash
fixguard report .
fixguard report . --format=json
fixguard report . --format=sarif
`$3
`bash
fixguard rollback
fixguard rollback --dry-run
`Execution Modes
| Mode | Description | Auto-fix | Refactor | Interactive |
|------|-------------|----------|----------|-------------|
|
observe | Read-only analysis (default) | ā | ā | ā
|
| safe-fix | Low-risk fixes only | ā
| ā | ā
|
| guided-refactor | Proposals + approval | ā
| ā
| ā
|
| ci | Strict, non-interactive | ā | ā | ā |Core Principles
1. AI has zero authority - Tools and tests decide
2. Every change is verifiable - Backed by tests
3. Every change is reversible - Snapshot and rollback
4. Every action is logged - Immutable run logs
5. If uncertain ā report, don't guess
Architecture
`
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā TypeScript Layer ā
ā (Orchestration - "What Happens") ā
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā¤
ā CLI ā Detection ā Decision ā Snapshots ā
ā ā ā Engine ā & Rollback ā
āāāāāāāāāāāāāāāāāāāāāāāāāā¬āāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā JSON Bridge
āāāāāāāāāāāāāāāāāāāāāāāāāā¼āāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā Python Layer ā
ā (Transformation - "How Code Changes") ā
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā¤
ā Analyzers ā Fixers ā Security ā Testing ā
ā (ESLint, ā (Rule- ā Hardening ā (Test Gen) ā
ā Ruff...) ā based) ā (OWASP) ā ā
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
``FixGuard checks and hardens:
- Rate limiting on public endpoints
- Input validation and sanitization
- Secret handling (no hardcoded keys)
- SQL injection prevention
- XSS prevention
All security fixes follow OWASP Top 10 best practices.
MIT