Overview·3 min read

Getting Started with AI Guard

Quick installation and setup guide for adding AI Guard to your JavaScript or TypeScript codebase in under 2 minutes.

AI Guard is designed to be adopted incrementally with zero disruption to your existing developer tooling. You can run it directly with npx, install it as an ESLint plugin, or integrate it into your GitHub Actions workflow.

Installation

Install AI Guard as a development dependency using your preferred package manager:

bash
# npm
npm install --save-dev eslint-plugin-ai-guard

# pnpm
pnpm add -D eslint-plugin-ai-guard

# yarn
yarn add -D eslint-plugin-ai-guard

Prerequisites: Node.js ≥ 18.0.0 and ESLint ≥ 8.0.0 (supports ESLint 8 and ESLint 9 Flat Config).

Running Your First Scan

You do not even need to configure your ESLint config file to run your first project scan. AI Guard ships with a high-performance native CLI:

bash
# Run a quick scan with the recommended preset
npx ai-guard run

# Or scan only modified files in your current working branch
npx ai-guard changed

The scan parses all .js, .ts, .jsx, and .tsx files using deterministic AST analysis, checking each syntax tree against AI-specific anti-patterns in under 400 milliseconds.

Choosing a Preset

AI Guard provides three carefully tuned presets depending on your team's workflow:

  1. `recommended` (Default): Zero noise. Turns on high-impact reliability and security rules at error level (such as unhandled floating promises, hardcoded secrets, and empty catches), while keeping context-dependent checks at warn or disabled.
  2. `strict`: Maximum safety for mature codebases. Enables all 18 rules at error level. Recommended for CI gates and pull request validation.
  3. `security`: Focused security auditing. Enables rules catching SQL concatenation, unsafe deserialization, missing route auth middleware, and API keys.

Applying Autofixes

Many common AI code defects can be safely corrected automatically:

bash
# Apply automatic fixes across your project
npx eslint . --fix

# Or run via AI Guard CLI
npx ai-guard run --fix

Rules like no-floating-promise will mark deliberate fire-and-forget calls with void, no-hardcoded-secret replaces raw literals with process.env, and no-empty-catch inserts explicit error audit TODOs.

Next Steps

NextESLint Plugin Configuration →