Termaxa Review 2026: The Cooperative Safety Gate That Stops AI Agents From Breaking Your Repo

AI coding agents are great at shipping features and equally great at running rm -rf on the wrong directory. The usual answer is a sandbox, but sandboxes are heavy, slow to spin up, and block half the work you actually want to do. Termaxa takes a different line: instead of walling the agent off, it sits in front of every shell command and tells you — before anything executes — exactly what is about to be lost.

The project describes itself as “a cooperative windshield, not a sandbox.” That framing matters. Termaxa does not try to contain a malicious agent; it tries to keep a helpful-but-careless agent from destroying your database, your uncommitted work, or your production credentials. It is open source (Rust, dual MIT/Apache-2.0), free, and actively maintained — the repo was last pushed on 2026-09-04.

What Termaxa Does

Termaxa intercepts shell commands routed through it by coding agents like Claude Code and Cursor. It reads a policy file (.termaxa/policy.yaml) and then runs a pipeline: split the command, match it against policy, gather context, and decide. The decision is one of allow, ask, or deny. For anything consequential, it previews the blast radius — lost commits, affected line counts, rows a DROP TABLE would hit, resources that would be destroyed — and, crucially, takes a backup before the operation runs. Only after the preview and backup does it execute, logging everything to an audit trail.

Use Cases

• Unattended agent runs. Let a coding agent work while you sleep, but require human approval for anything destructive via default: ask.
• Risky repos. Point Termaxa at a production-adjacent checkout so a DROP or force-push gets backed up and previewed first.
• Team guardrails. Ship a shared policy.yaml so junior engineers and agents follow the same “ask before delete” rules.
• Post-mortems. Use termaxa report to reconstruct what an agent attempted across a session or the last 30 days.

Key Features

Blast-radius preview

Before a command runs, Termaxa shows the actual consequence — lost commits, affected rows, files to be deleted. It even splits compound commands like git status && rm -rf / so the dangerous half is still caught.

Policy engine

A simple YAML file drives allow / ask / deny. Unmatched commands fall through to a human approval point instead of silently executing.

Insurance and rollback

Auto-backups (pg_dump, git refs, file copies) run before destructive actions. termaxa rollback <id> restores state. The fail-open default can be switched to unrecognised: deny if you want stricter behavior.

Escalation / circuit breaker

Repeated destructive intent — even rephrased — triggers automatic denial, stopping an agent from grinding through a block by rewording the command.

Audit and self-check

Every attempt is logged as JSONL. termaxa report summarizes sessions; termaxa doctor verifies the hook is wired and alive.

Pricing

Termaxa is free and open source under a dual MIT / Apache-2.0 license with no CLA. Install via brew install termaxa/tap/termaxa or cargo install termaxa. There is no paid tier, which is exactly what you want from a safety tool you need to trust.

Common Questions

Is Termaxa a sandbox? No. It is a cooperative gate. Hooks advise; they do not enforce, and the default posture is fail-open. It is designed for “expensive agent mistakes,” not for containing a deliberately malicious agent — pair it with OS-level sandboxing for hard boundaries.

Which agents does it support? Claude Code and Cursor are tested end-to-end. Codex and Copilot can parse their respective formats but are not verified end-to-end yet.

Is it production-ready? It is pre-1.0 (v0.17.0). The code is real and tested (~10,250 lines of Rust plus 11,000 lines of tests), but the policy schema and CLI can shift between minor versions, so pin a release.

Verdict

Termaxa earns a 6.5/10. It is a genuinely useful, lightweight safety layer for anyone running Claude Code or Cursor on real repositories — the backups-plus-rollback design recovers from accidents instead of only trying to prevent them. The honest downsides are real: it is early, the community is small (around 20 GitHub stars), agent support is narrow, and it is not a hard security boundary. Use it as a cheap insurance policy against the common “agent deleted the wrong thing” disaster, not as a replacement for true isolation.