The firewall for every agent — the ones you run, and the ones that visit you.
AxioRank inspects every tool call your AI agents make — catching leaked secrets, destructive commands, and prompt injection in under 100 ms, then enforcing your policies and writing a redacted, immutable audit trail. And on the way in, it verifies every AI agent that visits your site — cryptographically, not by user-agent string.
drop-in gateway · deny by default · secrets fingerprinted, never stored
The exposure
Agents act autonomously — with production credentials.
Give a model tools and it can read your database, push code, and call your cloud. The same autonomy that makes agents useful makes a single bad tool call catastrophic.
Agents hold real secrets
A tool call carries a live cloud key straight to an external service — one paste from exfiltration.
One statement drops prod
Generated SQL runs without a WHERE clause and rewrites — or deletes — an entire table.
Untrusted input hijacks
Hostile content steers the agent toward your cloud metadata endpoint to harvest credentials.
How it works
One synchronous hop from tool call to verdict.
The risk engine and policy layer are pure and in-process — no network calls on the hot path. The whole pipeline returns in under 100 ms.
- 01
Wrap
Your agent calls the gateway through the SDK instead of the tool directly.
axio.enforce({ tool, arguments }) - 02
Authenticate
The gateway resolves the agent from its API key — no session, no SDK rewrite.
Bearer axr_live_… - 03
Inspect
Detectors scan every payload leaf for signals and combine them into a score.
31 detectors → risk 0–100 - 04
Decide
Policies resolve under deny-overrides to a single allow or deny verdict.
deny-overrides - 05
Record
A redacted, immutable audit row is written and high-risk calls fire alerts.
redacted · append-only
Content inspection
Five categories. Thirty-one detectors.
Every string leaf of a tool call is scanned with bounded, ReDoS-safe patterns. Findings become redacted signals — the evidence proves a match without ever echoing the raw value.
Secret
12 detectorsLive credentials, fingerprinted and masked out of the stored payload.
Destructive
6 detectorsIrreversible commands against files, databases, and cloud resources.
Injection
6 detectorsAttempts to hijack the agent, your database, shell, or network.
PII
4 detectorsPersonal data, masked in evidence — card numbers are Luhn-validated.
Egress
3 detectorsBulk reads and oversized payloads that signal data exfiltration.
Live inspector
Run the firewall in your browser.
Edit a tool call and watch AxioRank inspect it. Detection runs client-side, but the score and verdict use the combine() and evaluatePolicy() functions straight from the production engine.
valid JSON · every string leaf is scanned
denied by policy "deny-live-secret" (secret detected)
Policy playground
deny-overrides · toggle a rule to re-evaluate- matcheddeny-live-secretdeny if secret detected · prio 5
- deny-destructivedeny if destructive detected · prio 15
- risk ≥ 75deny if risk ≥ 75 · prio 50
Policy engine
Deny-overrides, by design.
Policies are evaluated in priority order against a fixed precedence — the first matching rung wins, and denials sit on top. The safe default for a firewall: when nothing matches, the call is allowed, but any deny short-circuits everything below it.
A signal-category deny is as strong as an explicit deny — content inspection becomes enforceable, not just observable.
- 1denyExplicit denyaction = deny, no conditions
- 2denySignal denya flagged category is present on the call
- 3allowExplicit allowaction = allow, no conditions
- 4allowSignal allowan opt-out for a category on specific tools
- 5denyRisk thresholdrisk ≥ threshold for matching tools
- 6allowDefaultnothing matched
Audit & dashboard
Every call, logged and reviewable.
Decisions land in an immutable, redacted audit log — filterable by agent, tool, risk, and signal category — with high-risk activity surfaced the moment it happens.
- 12s98denyaws.s3.deleteBucketclaude-prodSecretDestructive
- 1m90denydb.querysupport-botDestructiveEgress
- 2m73allowslack.postintakePII
- 4m40allowgithub.pushci-runner—
- 6m84denygmail.sendoutreachPIIEgress
Top signals
last 24h- Secret47
- Destructive18
- PII9
- Injection5
- Egress3
Deny rate
24hRedaction
Proof a secret was there — without storing it.
Secrets are masked out of the payload at write time and replaced with a deterministic, irreversible fingerprint. The audit log can prove a key of this shape appeared, and even that the same key recurs, while never persisting the value itself.
{"env": {"AWS_ACCESS_KEY_ID": "AKIAIOSFODNN7EXAMPLE"}}
{"env": {"AWS_ACCESS_KEY_ID": «redacted:secret.aws_access_key»}}
The other direction
Now point it the other way.
Outbound, AxioRank governs the agents you run. Inbound, it verifies the agents that visit you — cryptographically, not by user-agent string. Same engine, both directions.
- 01
Request
An AI agent hits a property guarded by the AxioRank middleware.
axioGuard({ siteKey }) - 02
Identify
Match the visitor against the known-agent directory — GPTBot, ClaudeBot, Perplexity, and more.
20+ known agents - 03
Verify
Check the Web Bot Auth signature cryptographically; fall back to reverse-DNS and user-agent.
RFC 9421 · Ed25519 - 04
Score
Run the same detectors on the request for scraping, enumeration, and probe signals.
risk 0–100 - 05
Decide
Inbound policies resolve under block-overrides to one verdict.
allow · challenge · block
Integrations
Plugs into the stack you already run.
The gateway is the hot path; everything else is wired through tools you already trust — and degrades gracefully when they're not configured.
Supabase
Postgres, auth & policy store
Inngest
Async alerts & daily digests
Slack
Real-time high-risk alerts
PostHog
Decision & signal analytics
SDK
Drop it in. One line guards a call.
No agent rewrite — route tool calls through the gateway and let policy decide. Resolve the decision yourself with toolCall(), or let enforce() throw on a deny.
import { AxioRank, AxioRankDeniedError } from "@axiorank/sdk"; const axio = new AxioRank({ apiKey: process.env.AXIORANK_KEY! }); try { // One line guards the call — throws if the firewall denies it. await axio.enforce({ tool: "aws.s3.deleteBucket", arguments: { bucket: "prod-backups", force: true }, }); await s3.deleteBucket("prod-backups"); // only runs when allowed} catch (err) { if (err instanceof AxioRankDeniedError) { console.error(err.result.reason); // denied by policy "deny-destructive" }}Govern every agent — outbound and in.
Inspect the tool calls your agents make, verify the agents that visit you, and keep a redacted record of it all — in under 100 ms.