Configuration

AXguard works with zero config for local scan / audit. Optional project config is mainly for the GitHub adapter, MCP policy, and AI provider settings.

Files

Path	Role
`.axguard.yml` / `.axguard.yaml` / `.axguard.json`	Optional project config at repo root
`~/.axguard/`	Local preferences (privacy / engagement)
`.findings/axguard/`	Reports and diagnostic artifacts (local)

Never put secrets in .axguard.yml. Store only env var names for credentials.

Generate an example

axguard github setup .
axguard github validate .

Example shape

# Docs: GitHub config in the AXguard repo (docs/github/config.md)

github:
  app_id_env: AXGUARD_GITHUB_APP_ID
  private_key_path_env: AXGUARD_GITHUB_PRIVATE_KEY_PATH
  private_key_env: AXGUARD_GITHUB_PRIVATE_KEY
  webhook_secret_env: AXGUARD_GITHUB_WEBHOOK_SECRET
  webhook_host: 127.0.0.1
  webhook_port: 8787

review:
  enabled: true
  on_pull_request: true
  on_push: false
  check_name: "AXGuard Security Review"

preship:
  enabled: true
  check_name: "AXGuard Pre-Ship"

policy:
  fail_on: [critical, high]
  review_on: [likely]
  fail_on_analysis_error: false
  fail_on_unverified: false

analysis:
  mode: balanced   # fast | balanced | deep
  max_changed_files: 200
  max_annotations: 50

ai:
  provider: none   # none | local | openai | anthropic | …
  mode: no-llm     # no-llm | local | user_key
  api_key_env: AXGUARD_AI_API_KEY
  base_url_env: AXGUARD_AI_BASE_URL

privacy:
  retain_source: false
  log_source: false

Missing file → safe defaults: no-LLM, retain_source: false, fail only on verified critical/high (bot policy).

MCP policy

Optional mcp: section in .axguard.yml can bound approvals and limits for the MCP server. Prefer host-level approval UX (Cursor Run Mode, Claude /mcp, Codex tool approval) plus axguard mcp doctor. Details: MCP.

Environment variables (GitHub bot)

When using the optional GitHub adapter:

export AXGUARD_GITHUB_APP_ID=…
export AXGUARD_GITHUB_WEBHOOK_SECRET=…
export AXGUARD_GITHUB_PRIVATE_KEY_PATH=/path/to/app.pem

See GitHub.

CLI output directories

Most diagnostics default to --out-dir .findings/axguard. Override per command when you need isolated artifacts.

Get started

Understand

Analyze

Investigate

AI agents

Ship

Help

Files

Generate an example

Example shape

MCP policy

Environment variables (GitHub bot)

CLI output directories

​Files

​Generate an example

​Example shape

​MCP policy

​Environment variables (GitHub bot)

​CLI output directories

Files

Generate an example

Example shape

MCP policy

Environment variables (GitHub bot)

CLI output directories