{"id":48934934,"url":"https://github.com/manavarya09/guardrail","last_synced_at":"2026-04-17T11:05:33.491Z","repository":{"id":347180091,"uuid":"1193117763","full_name":"Manavarya09/Guardrail","owner":"Manavarya09","description":"The safety layer for AI-generated code. Scan and fix security issues, performance problems, and AI-specific anti-patterns. 22 rules. AST auto-fix. Zero config.","archived":false,"fork":false,"pushed_at":"2026-03-27T01:17:31.000Z","size":328,"stargazers_count":1,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2026-03-27T11:11:10.309Z","etag":null,"topics":["ai","ai-safety","ast","auto-fix","chatgpt","code-quality","code-scanner","copilot","developer-tools","eslint-alternative","linter","security","static-analysis","typescript"],"latest_commit_sha":null,"homepage":"https://guardrail-ai-self.vercel.app","language":"TypeScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Manavarya09.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-03-26T22:27:24.000Z","updated_at":"2026-03-27T01:17:35.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/Manavarya09/Guardrail","commit_stats":null,"previous_names":["manavarya09/guardrail"],"tags_count":1,"template":false,"template_full_name":null,"purl":"pkg:github/Manavarya09/Guardrail","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Manavarya09%2FGuardrail","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Manavarya09%2FGuardrail/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Manavarya09%2FGuardrail/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Manavarya09%2FGuardrail/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Manavarya09","download_url":"https://codeload.github.com/Manavarya09/Guardrail/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Manavarya09%2FGuardrail/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":31926263,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-04-17T10:35:34.458Z","status":"ssl_error","status_checked_at":"2026-04-17T10:35:09.472Z","response_time":62,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.6:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["ai","ai-safety","ast","auto-fix","chatgpt","code-quality","code-scanner","copilot","developer-tools","eslint-alternative","linter","security","static-analysis","typescript"],"created_at":"2026-04-17T11:05:11.501Z","updated_at":"2026-04-17T11:05:33.481Z","avatar_url":"https://github.com/Manavarya09.png","language":"TypeScript","readme":"\u003cdiv align=\"center\"\u003e\n\n# Guardrail\n\n**The safety layer for AI-generated code.**\n\nScan and fix security issues, performance problems, bad patterns, and AI-specific anti-patterns -- before they ship.\n\n[![CI](https://github.com/Manavarya09/Guardrail/actions/workflows/ci.yml/badge.svg)](https://github.com/Manavarya09/Guardrail/actions/workflows/ci.yml)\n[![npm](https://img.shields.io/npm/v/@guardrail-ai/cli.svg)](https://www.npmjs.com/package/@guardrail-ai/cli)\n[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)\n[![Node](https://img.shields.io/badge/node-%3E%3D18-brightgreen.svg)](https://nodejs.org)\n[![TypeScript](https://img.shields.io/badge/TypeScript-strict-blue.svg)](https://www.typescriptlang.org/)\n[![GitHub Marketplace](https://img.shields.io/badge/Marketplace-Guardrail-blue?logo=github)](https://github.com/marketplace/actions/guardrail-code-scanner)\n[![PRs Welcome](https://img.shields.io/badge/PRs-welcome-brightgreen.svg)](CONTRIBUTING.md)\n\n\u003c/div\u003e\n\n---\n\n```bash\nnpx @guardrail-ai/cli scan .\n```\n\n```\n   ____                     _           _ _\n  / ___|_   _  __ _ _ __ __| |_ __ __ _(_) |\n | |  _| | | |/ _` | '__/ _` | '__/ _` | | |\n | |_| | |_| | (_| | | | (_| | | | (_| | | |\n  \\____|\\__,_|\\__,_|_|  \\__,_|_|  \\__,_|_|_|\n\n  The safety layer for AI-generated code.\n\n  Target     ./src\n  Rules      30 rules across 4 categories\n  Files      12 files to scan\n  Engine     AST-powered (Babel parser)\n\n  ◉ src/api/auth.ts  (6 issues)\n  ──────────────────────────────────────────────\n    ✖  CRIT  Potential SQL injection\n      at src/api/auth.ts:18:18  security/sql-injection\n        17 │ function getUser(db, userId) {\n      \u003e 18 │   return db.query(\"SELECT * FROM users WHERE id = \" + userId);\n           │                    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n        19 │ }\n      ↳ Use parameterized queries: db.query(\"...WHERE id = $1\", [id])\n\n  ╔══════════════════════════════════════════════╗\n  ║  SCAN RESULTS                                ║\n  ╚══════════════════════════════════════════════╝\n\n  Health        ━━━━━━━━━━━━━━╌╌╌╌╌╌╌╌╌╌  62/100  [C]\n  Issues         2 CRITICAL   3 HIGH   4 WARN  = 9 total\n  Categories\n    🔒 Security      █████████████  5  (2 crit)\n    🤖 AI-Codegen    ████████       3\n    ⚡ Performance    ██             1\n\n  ┌──────────────────────────────────────────────┐\n  │  WHAT TO DO NEXT                              │\n  └──────────────────────────────────────────────┘\n\n    1. Fix critical vulnerabilities NOW\n    2. Auto-fix 3 issues: guardrail fix .\n    3. Generate fix guide: guardrail scan . --report md\n```\n\n---\n\n## Why Guardrail?\n\nAI code generators (Copilot, ChatGPT, Claude) are fast -- but they produce patterns that traditional linters miss.\n\n| Feature | ESLint | SonarQube | Snyk | **Guardrail** |\n|---------|--------|-----------|------|---------------|\n| Hardcoded secrets | Plugin | Yes | No | **Yes** |\n| SQL injection | No | Yes | No | **Yes** |\n| XSS detection | Plugin | Yes | No | **Yes** |\n| JWT misuse | No | No | No | **Yes** |\n| Path traversal | No | Yes | No | **Yes** |\n| Prototype pollution | No | No | No | **Yes** |\n| AI-hallucinated imports | No | No | No | **Yes** |\n| Placeholder/TODO detection | No | Partial | No | **Yes** |\n| Async without await | No | No | No | **Yes** |\n| N+1 query detection | No | No | No | **Yes** |\n| Inline code frames | No | No | No | **Yes** |\n| AI remediation report | No | No | No | **Yes** |\n| Baseline/gradual adoption | No | No | No | **Yes** |\n| Git diff scanning | No | No | No | **Yes** |\n| Pre-commit hook | Plugin | No | No | **Built-in** |\n| Inline suppression | Yes | Yes | No | **Yes** |\n| SARIF output | Plugin | Yes | Yes | **Yes** |\n| AST-based auto-fix | No | No | No | **Yes** |\n| Zero config | No | No | Yes | **Yes** |\n| \u003c 1s scan time | No | No | N/A | **Yes** |\n\n---\n\n## Quick Start\n\n```bash\n# Install globally\nnpm install -g @guardrail-ai/cli\n\n# Or run directly with npx\nnpx @guardrail-ai/cli scan ./src\n\n# Auto-fix issues\nguardrail fix ./src\n\n# Dry-run fixes (show diffs without applying)\nguardrail fix ./src --dry-run\n```\n\n---\n\n## 7 Commands\n\n```bash\nguardrail scan .                     # Scan for issues\nguardrail fix .                      # Auto-fix issues\nguardrail diff main                  # Scan only git-changed files (PR workflow)\nguardrail watch .                    # Real-time scanning on file changes\nguardrail hook install               # Add pre-commit git hook\nguardrail baseline create            # Snapshot issues for gradual adoption\nguardrail init                       # Initialize config file\n```\n\n### Reports\n\n```bash\nguardrail scan . --report md         # AI-guided fix report (for Claude/ChatGPT)\nguardrail scan . --report html       # Visual HTML report\nguardrail scan . --report sarif      # GitHub Code Scanning format\nguardrail scan . --report html,md    # Multiple formats at once\nguardrail scan . --json              # Machine-readable JSON\n```\n\n### Inline Suppression\n\n```javascript\n// guardrail-ignore-next-line\neval(trustedCode);\n\n// guardrail-ignore-next-line security/sql-injection\ndb.query(`SELECT * FROM ${safeTable}`);\n\nconst key = process.env.KEY; // guardrail-ignore\n```\n\n### Gradual Adoption (Baseline)\n\n```bash\nguardrail baseline create   # Snapshot all current issues\nguardrail scan .             # Now only reports NEW issues\nguardrail baseline status    # See suppressed count\nguardrail baseline clear     # Enforce all rules again\n```\n\n### Pre-commit Hook\n\n```bash\nguardrail hook install       # Blocks commits with critical/high issues\nguardrail hook uninstall     # Remove the hook\n```\n\n### Diff Scanning (PR Workflow)\n\n```bash\nguardrail diff main          # Only scan files changed vs main\nguardrail diff HEAD~3        # Last 3 commits\nguardrail diff               # Staged + unstaged changes\n```\n\n---\n\n## 30 Built-in Rules\n\n### Security (15 rules)\n\n| Rule | ID | Severity | Auto-fix |\n|------|----|----------|----------|\n| Hardcoded API Key | `security/hardcoded-api-key` | critical | No |\n| SQL Injection | `security/sql-injection` | critical | No |\n| No Eval | `security/no-eval` | critical | No |\n| XSS Vulnerability | `security/xss-vulnerability` | critical | No |\n| Path Traversal | `security/path-traversal` | critical | No |\n| JWT Misuse | `security/jwt-misuse` | critical | No |\n| Insecure CORS | `security/insecure-cors` | high | No |\n| Environment Variable Leak | `security/env-var-leak` | high | No |\n| Unsafe Regex (ReDoS) | `security/unsafe-regex` | high | No |\n| No Secrets in Logs | `security/no-secrets-in-logs` | high | No |\n| Prototype Pollution | `security/prototype-pollution` | high | No |\n| Open Redirect | `security/open-redirect` | high | No |\n| Insecure Cookie | `security/insecure-cookie` | high | No |\n| Insecure Randomness | `security/insecure-randomness` | high | No |\n| No Rate Limiting | `security/no-rate-limiting` | info | No |\n\n### AI-Codegen (11 rules) -- unique to Guardrail\n\n| Rule | ID | Severity | Auto-fix |\n|------|----|----------|----------|\n| Hallucinated Import | `ai-codegen/hallucinated-import` | high | No |\n| Placeholder Code | `ai-codegen/placeholder-code` | warning | No |\n| Hardcoded Localhost | `ai-codegen/hardcoded-localhost` | warning | No |\n| Overly Broad Catch | `ai-codegen/overly-broad-catch` | warning | No |\n| Unused Imports | `ai-codegen/unused-imports` | warning | Yes |\n| Any Type Abuse | `ai-codegen/any-type-abuse` | warning | No |\n| Fetch Without Error Handling | `ai-codegen/fetch-without-error-handling` | warning | No |\n| Promise Without Catch | `ai-codegen/promise-without-catch` | warning | No |\n| No Async Without Await | `ai-codegen/no-async-without-await` | warning | No |\n| Console Log Spam | `ai-codegen/console-log-spam` | info | Yes |\n| Magic Numbers | `ai-codegen/magic-numbers` | info | No |\n\n### Quality (2 rules)\n\n| Rule | ID | Severity | Auto-fix |\n|------|----|----------|----------|\n| Dead Code | `quality/dead-code` | warning | Yes |\n| Duplicate Logic | `quality/duplicate-logic` | warning | No |\n\n### Performance (2 rules)\n\n| Rule | ID | Severity | Auto-fix |\n|------|----|----------|----------|\n| Inefficient Loop | `performance/inefficient-loop` | warning | Yes |\n| N+1 Query | `performance/n-plus-one-query` | high | No |\n\n---\n\n## GitHub Action\n\n```yaml\n- uses: Manavarya09/Guardrail@v0.1.0\n  with:\n    target: './src'\n    severity: 'warning'\n    fail-on: 'high'\n    report: 'html'\n```\n\nIssues appear as PR annotations with file and line context.\n\n---\n\n## Claude Code Plugin (MCP)\n\n```json\n{\n  \"mcpServers\": {\n    \"guardrail\": {\n      \"command\": \"npx\",\n      \"args\": [\"@guardrail-ai/mcp\"]\n    }\n  }\n}\n```\n\nTools: `guardrail_scan`, `guardrail_fix`, `guardrail_list_rules`.\n\n---\n\n## Configuration\n\n```json\n{\n  \"include\": [\"src/**/*.{js,jsx,ts,tsx}\"],\n  \"exclude\": [\"**/*.test.ts\"],\n  \"severityThreshold\": \"warning\",\n  \"rules\": {\n    \"ai-codegen/magic-numbers\": false,\n    \"security/hardcoded-api-key\": { \"enabled\": true, \"severity\": \"critical\" }\n  }\n}\n```\n\nAlso supports `.guardrailrc`, `.guardrailrc.yaml`, `guardrail.config.js`, and `package.json` `\"guardrail\"` key.\n\n---\n\n## Architecture\n\n```\npackages/\n  core/       Rule engine, AST parser, file discovery, caching, inline suppression\n  rules/      30 built-in rules across 4 categories\n  fixer/      AST-based auto-fix engine with unified diff output\n  cli/        7 commands, 3 report formats, code frames, baseline, hooks\n  mcp/        Model Context Protocol server (Claude Code plugin)\n```\n\n---\n\n## Development\n\n```bash\ngit clone https://github.com/Manavarya09/Guardrail.git\ncd Guardrail\nnpm install\nnpm run build\nnpm test          # 139 tests\n```\n\nSee [CONTRIBUTING.md](CONTRIBUTING.md) for the rule authoring guide.\n\n---\n\n## License\n\n[MIT](LICENSE)\n","funding_links":[],"categories":[],"sub_categories":[],"project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmanavarya09%2Fguardrail","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmanavarya09%2Fguardrail","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmanavarya09%2Fguardrail/lists"}