AI coding agents can produce a change that compiles and passes tests while still making a codebase harder to maintain. A client component might import persistence code, a route might bypass an established auth boundary, or a new dependency might cross a layer the team deliberately kept separate. I built Codapult Guard to make those boundaries explicit and enforceable. Guard discovers facts about a JavaScript/TypeScript repository, surfaces candidate rules and contracts, and leaves approval to the team. Once approved, those rules can be checked deterministically in local workflows and CI. Existing findings can be baselined so the gate focuses on new regressions covered by the policy. Guard is local-first and model-agnostic. It does not call an LLM or edit source files itself. Its CLI and MCP server provide project-specific architecture context to compatible coding agents, and verification receipts record which policy and checks governed a result. It's MIT-licensed and designed to work alongside TypeScript, ESLint/Biome, tests, and security scanners, not replace them. I'd value feedback from people using Cursor, Claude Code, Codex, or other AI coding agents in real JS/TS repositories. Which architectural boundary is hardest to keep intact in your codebase?

Codapult Guard

Deterministic architecture checks for AI coding agents

Deterministic architecture checks for AI coding agents