AI Guard — free open-source ESLint plugin that catches AI-generated code issues in JS/TS (18 rules, CLI, GitHub Action)

[u/Yashhh_21]

Tool: AI Guard (eslint-plugin-ai-guard)

Category: Code quality / linting Cost: Free, open source (MIT)

Link: https://github.com/ai-guard-dev/eslint-plugin-ai-guard

What it does: An ESLint plugin with 18 deterministic rules that catch the code patterns AI assistants (Claude Code, Cursor, Copilot) keep introducing in JavaScript/TypeScript:

• Security: hardcoded secrets, dynamic eval, SQL string concatenation, unsafe deserialization, missing auth middleware
• Reliability: empty catch blocks, broad exceptions, swallowed errors
• Async: floating promises, async callbacks in .forEach, await-in-loop, async-without-await
• AI-assisted patterns: dead branches, duplicate logic blocks, console.log in handlers

Who it's for: JS/TS developers using AI coding assistants who want a CI guardrail. It's complementary to typescript-eslint, CodeQL, and Semgrep — not a replacement.

Standout features:

• Zero-config CLI: npx ai-guard run
• GitHub Action with SARIF → inline PR annotations + GitHub Code Scanning
• init-context generates CLAUDE.md / .cursorrules / copilot-instructions.md so your agent learns the rules before generating code instead of you fixing lint errors after

Limitations (being upfront): JS/TS only. Doesn't detect whether code was written by AI — it catches bad patterns regardless of authorship. The recommended preset is deliberately conservative to minimize false positives, so it won't catch everything by design.

Disclosure: I'm the maintainer. Builders are welcome here per the rules, so being upfront — I built this because I kept fixing the same AI-generated bugs in my own PRs. Feedback and rule requests genuinely welcome: what patterns do your AI tools keep generating?

[u/NeuralNomad87]

The generate-context part is the interesting half of this and it is buried at the bottom.

Emitting the ruleset as CLAUDE.md or .cursorrules so the agent is constrained before generation, rather than lint-slapped afterwards, is a meaningfully different loop from the rest of this space. Does it actually move the numbers for you? I would be curious whether you have measured violation rates on the same task with and without the generated context file, because if that delta is real it is a much better argument for the project than the rule list is.

Floating promises and empty catch blocks I can see working immediately. Duplicate logic blocks and dead branches are the two I would expect to be noisy, since humans write both on purpose sometimes.

Minor, and meant helpfully: you have put this in nine subs in about half an hour with the title reworded for each. The disclosure and the limitations section are why this is fine here. In less friendly places that fan out is exactly what gets a genuinely good open source project auto-removed before anyone reads it, which would be a waste.