Termaxa — a gate for the shell commands AI coding agents run

$ termaxa

$ termaxa — a cooperative gate for the shell commands AI agents run

Preview what will happen. · Protect what matters. · Roll back when you're wrong.

A cooperative gate for the shell commands your AI agent runs. It previews the blast radius, backs up first, and blocks the dangerous ones. A windshield, not a sandbox.

> claude code wants to run:

DROP TABLE users;

> termaxa says:

│ ESTIMATED IMPACT

rows affected50,000

dependent tables3

force push1 commit lost

terraform destroy2 add, 1 destroy

INSURANCE (automatic)

✓ pg_dump✓

✓ git backup✓

✓ file snapshot✓

✓ audit record✓

> approve? [y/N]

works with

git

previews & backups

postgres

blast radius & rollback

terraform

plan preview

shell

policy & shell-aware eval

more coming_

live demo

1. predict

$ termaxa check "rm -rf /" ✗ denied: dangerous command segment 2/2 → rm -rf / rule: filesystem.delete

10ms

2. protect

$ termaxa preview "DROP TABLE users" → 50,000 rows → 3 dependent tables → backup ready (pg_dump) → rollback available

82ms

3. recover

$ termaxa rollback → restoring… → commit a1b2c3d restored → 50,000 rows restored ✓ done (17.3s)

17.3s

see it live

A real agent hits the gate.

Claude Code attempting a command — intercepted by Termaxa, live, inside the agent's own prompt. Nothing staged.

by the numbers

releases

~10,500

lines of Rust

444

regression tests

bugs found in the wild

live agents tested

hardened by real use

⚠ git force-push blind spot

The preview said "nothing to push" while a force push destroyed a commit. Now it shows what the remote will lose. (v0.6.1)

⚠ shell segmentation bypass

A live agent rode a destructive command in behind a harmless prefix. Compound commands are now split and judged per-segment. (v0.7)

⚠ repo-owned audit logs

Logs lived in the repo, so git reset --hard could erase them. State moved to ~/.termaxa, out of git's reach. (v0.8)

⚠ retry-with-different-syntax

A live Cursor agent, blocked on a delete, switched shells (PowerShell → cmd) to sneak it past. Termaxa now classifies intent, not spelling, and trips a per-session circuit breaker on the repeat. (v0.11)

⚠ native tools bypass the shell

The same Cursor agent then used its built-in file tool, deleting files the shell hook never saw. The gate covers shell; non-shell tools need a sandbox — and we say so. (documented)

⚠ path syntax decided your backup

Two engines parsed the same command independently. rm -rf C:\Users\x\Desktop was insured; rm -rf /c/Users/x/Desktop — the same directory — silently wasn't. Found by building the delete preview and comparing the two. They now share one implementation. (v0.14)

⚠ an escaped quote walked past the gate

A backslash-escaped quote collapsed a compound command into one segment, so an anchored deny rule never saw the second command: echo \" ; terraform destroy matched echo * and was allowed. Live since v0.7.0. Found by unifying two shell parsers and reading what they disagreed about — the disagreements were the bug list. Advisory published. (GHSA-rv66-7qcx-c45j, v0.16)

⚠ the supervisor was never reached

Supervised mode passed 439 unit tests, 18 privilege assertions and three green CI platforms. Then a real agent ran ls -la as a real second user, and the gate decided locally: its hook looked for the supervisor in its own home and found nothing there. The walls held; the door led nowhere. Every automated test had run both halves as the same user. (v0.17)

⚠ the agent's API moved under us

Cursor 3.11 renamed its hook events — and Termaxa silently stopped gating it. Every test stayed green (fixtures used the old shape). Caught live via payload capture, fixed the same night; the real 3.11 payloads are regression tests now. (v0.11.4)

field notes

AUG 2026

Claude Code shipped a sandbox. Here's what it protects — and what it doesn't.

Bash-only scope, reads wider than writes, a permissioned escape hatch, fail-open, no native Windows — and why containment isn't consequence isn't recovery.

JUL 2026

I asked an AI agent to delete a folder my tool was guarding.

Four rounds with a live Cursor agent: whack-a-mole retries, a classifier hole, a native-tool escape, and a silently renamed hook API.

what's next

[x] supervised mode — a daemon under your user decides; the agent runs as an account that cannot read the audit log, edit the backups, or stop it

[x] resolved-target rules — > .env and > ./.env are one file, not two strings

[x] hash-chained audit — an edited or removed entry is detectable

[ ] the rest of enforcement — wrap catches a shell by name, not /bin/sh by path

[ ] plugin registry & more agents

[x] cursor — live-tested (incl. the 3.11 hook API)

[x] post-execution receipts — approved commands don't trip the breaker

[x] execution report — session & 30-day flight recorder

[x] termaxa doctor — is the gate actually wired up?

[x] delete blast radius — what an rm actually costs

[ ] codex / copilot (dialects built, unverified)

[ ] termaxa cloud (shared policies & approvals)

v0.17.0 today · built in the open · honest about what's not done

this tool is free forever.

open source under MIT / Apache-2.0
no feature gates. no license keys. ever.
cloud sits on top of the free core, never in front of it.

from the maker

Manoj
solo maker · builds developer infrastructure

I build with Claude Code every day, and I kept getting nervous handing it commands that touch git history and production databases. The built-in "allow this command?" prompt tells you what it wants to run — not what will actually happen.

So I built the thing I wanted: a gate that shows the real consequence, takes a backup before you approve, and lets you roll back. The first time I pointed a live agent at it, the agent chained a destructive command behind a harmless one and slipped past a naive rule. Watching that happen is why Termaxa now splits compound commands and judges each part — that exact bypass is a regression test today.

— Manoj · also the maker of ZeroDrop, email-verification infrastructure for developers

install

$ cargo install termaxa && cd your-project && termaxa init

or grab a binary:

linux macos windows

then try it instantly — no setup, no project config: termaxa check "rm -rf /"

$ termaxa --version
termaxa 0.17.0

github docs security security@termaxa.com changelog

also from the maker: zerodrop → email verification infrastructure for developers