wtf is guard-ai?

guard-ai is a code scanning tool built to catch problems that AI coding assistants tend to introduce without anyone noticing. When large language models write code, they sometimes invent software package names that do not actually exist, a trick attackers exploit by registering those fake package names themselves so that anyone who accidentally installs them runs malicious code. AI tools can also leave placeholder text where a real password or API key should go, like typing your key here, which developers sometimes commit to their codebase by mistake. A third common issue is AI leaving behind incomplete code with comments such as rest of code here, which quietly breaks the program once it reaches production. guard-ai checks your code for all three of these problems. It runs from the command line, as a pre-commit hook that checks code before you save a change to version control, or inside a continuous integration pipeline that automatically tests code changes. It supports Python files as well as JavaScript and TypeScript files, plus package.json files used by Node projects. To avoid slowing things down or hitting rate limits when checking whether a package name is real, it keeps a local cache of package registry lookups that refreshes every twenty four hours. It also tries to avoid false alarms by recognizing standard library modules, built-in Node modules, and your own local project files, so it does not flag things that are actually fine. For automated pipelines, you can set it to fail the build when it finds issues above a chosen severity level, and it can output results as structured JSON for other tools to read. It also respects ignore files, including your project's existing gitignore file and a dedicated guardignore file. Installation is a single pip command, and it is released under the MIT license.