# AXIOM (npm · @codai/axiom-mcp)

Transactional write gate for coding agents: plan, canonical manifest, checks, two-phase apply.

- Trust score: 78/100 (medium)
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-09-25

## Components

- npm · `@codai/axiom-mcp`: 78/100 (this document), [markdown](https://verifymcp.io/servers/dragoscv-axiom/codai-axiom-mcp.md), [page](https://verifymcp.io/servers/dragoscv-axiom/codai-axiom-mcp)

## Channel facts

- Registry: `npm`
- Package: `@codai/axiom-mcp`
- Version: `2.3.0`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-09-25.

- **Supply Chain Security**: 100/100
  - No malware found by supply-chain analysis.
  - No known CVEs affecting this package version or its production dependencies.
  - No install/post-install scripts declared.
  - 0 of 20 dependencies flagged as unhealthy.
- **Provenance & Transparency**: 100/100
  - Source repository is publicly reachable at the declared URL.
  - Cryptographically verified build provenance (signed, bound to dragoscv/axiom).
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 1 days ago).
  - Publishes a security disclosure policy (SECURITY.md).
- **Schema Quality & AI Usability**: 48/100
  - 0% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (good).
  - Tool/resource definitions use about 2088 tokens (~72/item across 29 items; 17 tools + 12 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 13/100
  - Stability observed for 4 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 95/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 84% of tool parameters carry a description.
  - Structured output schemas are declared (100% of tools); any adoption earns full credit.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - We read all 17 captured tool definition(s), and no name or description among them implies an irreversible operation.
  - An AI judge read all 18 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a current MCP spec version (2026-07-28).

## Install

### How do I install the AXIOM MCP server?

AXIOM runs locally as an npm package, launched with npx -y @codai/axiom-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add dragoscv-axiom -- npx -y @codai/axiom-mcp
```

### Cursor

```json
{
  "mcpServers": {
    "dragoscv-axiom": {
      "command": "npx",
      "args": [
        "-y",
        "@codai/axiom-mcp"
      ]
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "dragoscv-axiom": {
      "command": "npx",
      "args": [
        "-y",
        "@codai/axiom-mcp"
      ]
    }
  }
}
```

### Codex

```bash
codex mcp add dragoscv-axiom -- npx -y @codai/axiom-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "dragoscv-axiom": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@codai/axiom-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add dragoscv-axiom --command npx --arg -y --arg @codai/axiom-mcp
```

### Hermes

```yaml
mcp_servers:
  dragoscv-axiom:
    command: "npx"
    args: ["-y", "@codai/axiom-mcp"]
```

### Netclaw

```json
{
  "McpServers": {
    "dragoscv-axiom": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "@codai/axiom-mcp"
      ]
    }
  }
}
```

### Vellum

```bash
assistant mcp add dragoscv-axiom -t stdio -c npx -a -y @codai/axiom-mcp
```

### Other

```json
{
  "mcpServers": {
    "dragoscv-axiom": {
      "command": "npx",
      "args": [
        "-y",
        "@codai/axiom-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-09-25 (score 78, 0)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-09-24 (score 78, +1)

No change was recorded against any check on this day. Stability & Change Management went from 7 to 10. That category is still filling its 30-day observation window: 2 days of observed history at the previous scan, 3 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-09-23 (score 77, +1)

- [security regression] Tool safety: pass → unverified
- [security] Stability: Stability not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet.
- [functional regression] Capabilities: pass → unverified
- [functional regression] Schema quality: 0 → unverified
- [functional regression] Tool coverage: 100 → unverified
- [functional improvement] Stability: unverified → 0.07
- [functional] Package version: 2.2.1 → 2.3.0

### 2026-09-21 (score 76)

First indexed and scored.

## MCP tools (17)

### `axiom_plan_validate` (~56 tokens)

Validate a Plan

Validate a Plan against PlanSchema and, when all sources are inline, compute its planDigest. Read-only; touches no files.

Input parameters:

- `plan` (object, required): Plan document (apiVersion axiom.dev/v2, kind Plan)

Output parameters:

- `errors` (array)
- `ok` (boolean)
- `planDigest` (string): sha256:<64 lowercase hex>

### `axiom_plan_compile` (~164 tokens)

Compile a Plan into a ManifestBundle

Compile a Plan into a content-addressed ManifestBundle (sorted artifacts, sha256 digests, in-toto planDigest). `store: cas` writes blobs under <root>/.axiom/cas instead of inlining them. When a root is given the bundle is stored under <root>/.axiom/manifests/<hex>.json so later tools can reference it by digest. `template` sources are rendered by the built-in `web` emitter (see `axiom emitters`); its version is recorded in toolchain.emitters.

Input parameters:

- `plan` (object, required): Plan document
- `root` (string): Absolute repository root; must equal or lie inside an allowlisted --root
- `store` (string): Blob transport; default inline

Output parameters:

- `attestation` (object)
- `blobs` (object)
- `envelope` (object)
- `manifest` (object)
- `manifestDigest` (string): sha256:<64 lowercase hex>
- `signatures` (array)

### `axiom_manifest_verify` (~102 tokens)

Verify a ManifestBundle

Structural and content-address verification: schema, recomputed manifestDigest, every inline blob hashes to its key, attestation subject matches. When a root with .axiom/trust/keys.json is available, detached DSSE signatures are verified and the trusted keyids are reported under `signatures`. Never writes.

Input parameters:

- `bundle` (object, required): ManifestBundle
- `root` (string): Absolute repository root; must equal or lie inside an allowlisted --root

Output parameters:

- `canonical` (boolean)
- `errors` (array)
- `manifestDigest` (string): sha256:<64 lowercase hex>
- `missing` (array)
- `ok` (boolean)
- `signatures` (object)
- `signed` (boolean)

### `axiom_check` (~121 tokens)

Run policy checks on a bundle

Evaluate the profile's predicates (plus the manifest's own checks) against the bundle. Repo facts are read from the root when one is available and the profile allows it. Verdict `error` means a provider could not run — never a silent pass.

Input parameters:

- `bundle` (object, required): ManifestBundle
- `profile` (string): Profile name (builtin default|strict|permissive, or <root>/.axiom/profiles/<name>.json)
- `root` (string): Absolute repository root; must equal or lie inside an allowlisted --root

Output parameters:

- `apiVersion` (string)
- `durationMs` (integer)
- `factsDigest` (string): sha256:<64 lowercase hex>
- `findings` (array)
- `kind` (string)
- `manifestDigest` (string): sha256:<64 lowercase hex>
- `preImage` (string)
- `profile` (string)
- `providers` (array)
- `verdict` (string)

### `axiom_check_start` (~179 tokens)

Start policy checks as a background task

Same evaluation as axiom_check, but returned immediately as a task so long `guard.external` suites (up to 15 min per guard) outlive the client's per-call timeout. Poll axiom_task_get with the returned taskId every pollIntervalMs until status is completed|failed|cancelled; the CheckReport is in `result`. Finished tasks are pollable for ttlMs, then forgotten. Tasks live in this server process only (D-24 — tool-level tasks, not the io.modelcontextprotocol/tasks wire extension).

Input parameters:

- `bundle` (object, required): ManifestBundle
- `profile` (string): Profile name (builtin default|strict|permissive, or <root>/.axiom/profiles/<name>.json)
- `root` (string): Absolute repository root; must equal or lie inside an allowlisted --root

Output parameters:

- `elapsedMs` (integer)
- `pollIntervalMs` (integer)
- `status` (string)
- `taskId` (string)
- `tool` (string)
- `ttlMs` (integer)

### `axiom_task_get` (~80 tokens)

Poll a task

Status of a task created by axiom_check_start. While `working` only the descriptor is returned; once terminal, `result` (completed) or `error` (failed|cancelled) is attached. Unknown or expired taskId → ERR_TASK_NOT_FOUND.

Input parameters:

- `taskId` (string, required): taskId returned by axiom_check_start

Output parameters:

- `elapsedMs` (integer)
- `error` (object)
- `pollIntervalMs` (integer)
- `result` (object)
- `status` (string)
- `taskId` (string)
- `tool` (string)
- `ttlMs` (integer)

### `axiom_task_cancel` (~66 tokens)

Cancel a task

Abort a `working` task: every running guard process tree is killed and the task ends `cancelled` with error ERR_TASK_CANCELLED. Idempotent — a terminal task is returned unchanged.

Input parameters:

- `taskId` (string, required): taskId returned by axiom_check_start

Output parameters:

- `elapsedMs` (integer)
- `pollIntervalMs` (integer)
- `status` (string)
- `taskId` (string)
- `tool` (string)
- `ttlMs` (integer)

### `axiom_plan_begin` (~156 tokens)

Open a chunked plan session

Start assembling a Plan whose JSON would exceed the 4 MiB per-call cap: send the header here (everything except `artifacts`), append artifacts in chunks with axiom_plan_add, then axiom_plan_seal compiles the whole. The sealed bundle's manifestDigest is identical to a one-shot axiom_plan_compile of the same Plan. Sessions are in-memory, expire after 30 min idle, and hold at most 2000 artifacts / 64 MiB.

Input parameters:

- `capabilities` (array)
- `checks` (array)
- `counter` (integer)
- `intent` (string, required)
- `metadata` (object)
- `name` (string, required)
- `profile` (string)

Output parameters:

- `artifacts` (integer)
- `bytes` (integer)
- `limits` (object)
- `sessionId` (string)
- `ttlMs` (integer)

### `axiom_plan_add` (~101 tokens)

Append artifacts to a plan session

Add a chunk of Plan artifacts (each ≤ 4 MiB call, inline content ≤ 256 KiB per artifact as in a Plan) to an open session. Paths must be unique across every chunk (ERR_INVALID_PLAN otherwise); a sealed or over-budget session is ERR_PLAN_SESSION_STATE.

Input parameters:

- `artifacts` (array, required): Plan artifacts, same shape as Plan.artifacts[]
- `sessionId` (string, required): sessionId returned by axiom_plan_begin

Output parameters:

- `artifacts` (integer)
- `bytes` (integer)
- `limits` (object)
- `sessionId` (string)
- `ttlMs` (integer)

### `axiom_plan_seal` (~120 tokens)

Seal a plan session and compile it

Assemble the session's header + every added artifact into one Plan and compile it exactly like axiom_plan_compile (same options, same digest). The session is consumed whether or not compilation succeeds. Bundles whose inline blobs exceed 4 MiB need `store: cas` (and therefore a root).

Input parameters:

- `root` (string): Absolute repository root; must equal or lie inside an allowlisted --root
- `sessionId` (string, required): sessionId returned by axiom_plan_begin
- `store` (string): Blob transport; default inline

Output parameters:

- `attestation` (object)
- `blobs` (object)
- `envelope` (object)
- `manifest` (object)
- `manifestDigest` (string): sha256:<64 lowercase hex>
- `signatures` (array)

### `axiom_apply_dry_run` (~126 tokens)

Dry-run apply (stage + diff, no writes to the tree)

Stage the bundle under <root>/.axiom/staging, run pre-apply checks and produce a unified diff against the current tree. Nothing outside .axiom/ is touched. Echo the returned manifestDigest as `confirmDigest` to axiom_apply.

Input parameters:

- `bundle` (object, required): ManifestBundle
- `profile` (string): Profile name (builtin default|strict|permissive, or <root>/.axiom/profiles/<name>.json)
- `root` (string): Absolute repository root; must equal or lie inside an allowlisted --root

Output parameters:

- `apiVersion` (string)
- `diff` (string)
- `drifted` (array)
- `error` (object)
- `files` (array)
- `git` (object)
- `journal` (string)
- `kind` (string)
- `manifestDigest` (string): sha256:<64 lowercase hex>
- `mode` (string)
- `root` (string)
- `status` (string)

### `axiom_apply` (~219 tokens)

Apply a bundle to the filesystem (two-phase commit)

Transactionally write the bundle into the root: pre-image verification, staging, journal, atomic renames, scoped rollback on failure. Requires `confirmDigest === bundle.manifestDigest` (echo the digest you saw in dry-run). Idempotent: re-applying an applied digest is a no-op.

Input parameters:

- `branch` (string): pr mode: branch name (default axiom/<name>/<digest12>)
- `bundle` (object, required): ManifestBundle
- `commitMessage` (string): pr mode: commit message (passed to git on stdin)
- `confirmDigest` (string): Must equal bundle.manifestDigest
- `mode` (string): fs (default) writes files; pr additionally creates a git branch and commits exactly the touched paths (no push, no PR creation)
- `profile` (string): Profile name (builtin default|strict|permissive, or <root>/.axiom/profiles/<name>.json)
- `root` (string): Absolute repository root; must equal or lie inside an allowlisted --root

Output parameters:

- `apiVersion` (string)
- `diff` (string)
- `drifted` (array)
- `error` (object)
- `files` (array)
- `git` (object)
- `journal` (string)
- `kind` (string)
- `manifestDigest` (string): sha256:<64 lowercase hex>
- `mode` (string)
- `root` (string)
- `status` (string)

### `axiom_rollback` (~81 tokens)

Roll back an applied manifest

Replay the journal of a committed/committing manifest in reverse: restore backups, remove created files, drop the applied marker.

Input parameters:

- `manifestDigest` (string, required): `sha256:<hex>` (or bare hex) of the manifest to roll back
- `root` (string): Absolute repository root; must equal or lie inside an allowlisted --root

Output parameters:

- `manifestDigest` (string): sha256:<64 lowercase hex>
- `phase` (string)
- `root` (string)
- `status` (string)
- `steps` (integer)

### `axiom_manifest_diff` (~106 tokens)

Diff two manifests

Compare two manifests by artifact path and digest. Each side is a ManifestBundle or a `sha256:<hex>` reference to a bundle stored under an allowlisted root.

Input parameters:

- `a` (required): A ManifestBundle object, or `sha256:<hex>` of a bundle stored under <root>/.axiom/manifests
- `b` (required): A ManifestBundle object, or `sha256:<hex>` of a bundle stored under <root>/.axiom/manifests

Output parameters:

- `added` (array)
- `changed` (array)
- `removed` (array)

### `axiom_axm_parse` (~57 tokens)

Parse .axm source into a Plan

Parse .axm v2 text into a Plan with 1-based {line, column} diagnostics; `plan` is present only when error-free. Read-only.

Input parameters:

- `source` (string, required): .axm source text

Output parameters:

- `diagnostics` (array)
- `plan` (object)

### `axiom_roots_list` (~31 tokens)

List allowlisted roots

The frozen set of roots this server may read and write, as given by --root at startup.

Output parameters:

- `roots` (array)

### `axiom_repo_snapshot` (~269 tokens)

Snapshot a root

Deterministic, content-addressed inventory of a root: every regular file (and symlink) as { path, bytes, sha256, mode, kind }, sorted by code point, with snapshotDigest = sha256(JCS(body)). No timestamps, no absolute paths — the same tree gives the same digest on every machine. Honours the root .gitignore, always skips .git/ and .axiom/, never follows symlinks, never leaves the root. Use it to build Plans against real pre-image digests, or diff two snapshots with `axiom snapshot-diff`.

Input parameters:

- `exclude` (array): Relative globs to drop
- `followSymlinks` (boolean): Always false; symlinks are recorded, never followed
- `include` (array): Relative globs (*, **, ?) to keep; default everything
- `maxBytes` (integer): Stop once the summed size would exceed this; sets truncated
- `maxFiles` (integer): Stop after this many files (cap 50000); sets truncated
- `respectGitignore` (boolean)
- `root` (string): Absolute repository root; must equal or lie inside an allowlisted --root
- `withContentDigest` (boolean): false → sizes only, no sha256

Output parameters:

- `apiVersion` (string)
- `body` (object)
- `kind` (string)
- `root` (object)
- `snapshotDigest` (string): sha256:<64 lowercase hex>

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/dragoscv-axiom/codai-axiom-mcp#diagnostics

## Score history

- 2026-09-25: 78
- 2026-09-24: 78
- 2026-09-23: 77
- 2026-09-22: 76
- 2026-09-21: 76

## Common questions

### What is the AXIOM MCP server?

AXIOM is an MCP server listed in the public MCP registry as io.github.dragoscv/axiom. Transactional write gate for coding agents: plan, canonical manifest, checks, two-phase apply. This page covers its npm package (@codai/axiom-mcp).

### Is the AXIOM MCP server safe to use?

AXIOM scores 78 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 25 September 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the AXIOM MCP server expose?

AXIOM exposes 17 tools: axiom_plan_validate, axiom_plan_compile, axiom_manifest_verify, axiom_check, axiom_check_start, and 12 more. Their descriptions and schemas cost roughly 2,034 tokens of context every time the server is loaded.

### Is the AXIOM MCP server still maintained?

AXIOM is still listed as active in the MCP registry. We last reached this channel on 25 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

### What licence is the AXIOM MCP server under?

AXIOM declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.

## Links

- npm package: https://www.npmjs.com/package/@codai/axiom-mcp
- Socket report: https://socket.dev/npm/package/@codai/axiom-mcp
- Repository: https://github.com/dragoscv/axiom
- Website: https://dragoscv.github.io/axiom/
- Changelog RSS feed: https://verifymcp.io/servers/dragoscv-axiom/codai-axiom-mcp.xml
- Changelog JSON feed: https://verifymcp.io/servers/dragoscv-axiom/codai-axiom-mcp.json
- HTML version of this page: https://verifymcp.io/servers/dragoscv-axiom/codai-axiom-mcp