The Security Gateway for AI agents.
Short-lived identity, default-deny policy, and a signed audit trail on every tool call.
short-lived tokens · default-deny · secrets fingerprinted, never stored
Drops into the stack you already run
- Model Context Protocol
- Anthropic SDK
- OpenAI Agents
- Vercel AI SDK
- LangChain
- LangGraph
- Mastra
- LlamaIndex
- Pydantic AI
- CrewAI
- AutoGen
- LiteLLM
- Slack
- GitHub Actions
Where it sits
Between your agents and everything they touch.
Put AxioRank in front of every agent. Before a call reaches an MCP server, an API, or a database, it passes through the gateway: a short-lived identity, your policy, a risk score, and a signed audit trail. Nothing the agent does skips the checkpoint.
The exposure
Agents act autonomously, with production credentials.
Give a model tools and it can read your database, push code, and call your cloud. The same autonomy that makes agents useful makes a single bad tool call catastrophic.
Agents hold real secrets
A tool call carries a live cloud key straight to an external service, one paste from exfiltration.
One statement drops prod
Generated SQL runs without a WHERE clause and rewrites or deletes an entire table.
Untrusted input hijacks
Hostile content steers the agent toward your cloud metadata endpoint to harvest credentials.
Identity
Never trust an agent by default.
Zero-Trust starts with identity. Each agent trades a static key, or a federated identity, for a short-lived signed token that verifies locally with no database round-trip and cannot be replayed. Tokens default to a 15 minute lifetime, so a leaked credential is worthless in minutes, not months.
MCP gateway
Every tool call runs the gateway, in one hop.
Point any tool call at the gateway and it runs a pipeline on the synchronous path: verify identity, score risk, evaluate policy, check the allowlist, and write a redacted record. It returns allow, deny, or hold in under 100 ms, with no agent rewrite.
- 01
Authenticate
The gateway verifies the agent's token or key and resolves its identity locally.
verify token · no DB hop - 02
Inspect
Detectors scan every payload leaf for signals and combine them into a score.
131 detectors → risk 0–100 - 03
Decide
Policies resolve under deny-overrides to allow, deny, or hold for approval.
allow · deny · hold - 04
Allowlist
A default-deny tool and egress allowlist blocks anything you have not approved.
default-deny · pinned - 05
Record
A redacted, append-only audit row is written and your quota is metered.
redacted · append-only
Policy engine
Deny-overrides, by design.
Policies are evaluated in priority order against a fixed precedence. The first matching rung wins and a deny sits on top, so when nothing matches the call is allowed, but any deny short-circuits everything below it.
Rules match a tool pattern and context like IP, time, host, and agent labels. A signal-category deny is as strong as an explicit deny, so content inspection becomes enforceable.
- 1denyExplicit denyaction = deny, no conditions
- 2denySignal denya flagged category is present on the call
- 3allowExplicit allowaction = allow, no conditions
- 4allowSignal allowan opt-out for a category on specific tools
- 5denyRisk thresholdrisk ≥ threshold for matching tools
- 6allowDefaultnothing matched
Content inspection
Seven categories. 131 detectors.
Every string leaf of a tool call is scanned with bounded, ReDoS-safe patterns. Findings become redacted signals, and the evidence proves a match without ever echoing the raw value.
Secret
12 detectorsLive credentials, fingerprinted and masked out of the stored payload.
Malware
6 detectorsDangerous-execution indicators. Denied by default, like destructive ops.
Destructive
8 detectorsIrreversible commands against files, databases, and cloud resources.
Injection
8 detectorsAttempts to hijack the agent, your database, shell, or network.
Financial
6 detectorsCrypto and financial identifiers. Seed phrases and keys are redacted.
PII
6 detectorsPersonal data, masked in evidence. Card numbers are Luhn-validated.
Egress
5 detectorsBulk reads and exfil routes that signal data leaving the perimeter.
Redaction
Proof a secret was there, without storing it.
Secrets are masked out of the payload at write time and replaced with a deterministic, irreversible fingerprint. The audit log can prove a key of this shape appeared, and even that the same key recurs, while never persisting the value itself.
{"env": {"AWS_ACCESS_KEY_ID": "AKIAIOSFODNN7EXAMPLE"}}
{"env": {"AWS_ACCESS_KEY_ID": «redacted:secret.aws_access_key»}}
Live inspector
Run the gateway in your browser.
Edit a tool call and watch AxioRank inspect it. Detection runs client-side, but the score and verdict use the combine() and evaluatePolicy() functions straight from the production engine.
valid JSON · every string leaf is scanned
denied by policy "deny-live-secret" (secret detected)
Policy playground
deny-overrides · toggle a rule to re-evaluate- matcheddeny-live-secretdeny if secret detected · prio 5
- deny-malwaredeny if malware detected · prio 10
- deny-destructivedeny if destructive detected · prio 15
- risk ≥ 75deny if risk ≥ 75 · prio 50
Run this on your own agents.
Create a free workspace and watch a live attack run get blocked in your dashboard in seconds. No credit card.
Audit & dashboard
Every call, logged and reviewable.
Decisions land in an immutable, redacted audit log, filterable by agent, tool, risk, and signal category, with high-risk activity surfaced the moment it happens.
- 12s98denyaws.s3.deleteBucketclaude-prodSecretDestructive
- 1m90denydb.querysupport-botDestructiveEgress
- 2m73allowslack.postintakePII
- 4m40allowgithub.pushci-runner-
- 6m84denygmail.sendoutreachPIIEgress
Deny rate
24hAutomated response
From verdict to action, automatically.
A deny is the floor, not the ceiling. Response rules can quarantine an agent, revoke its keys, or raise an alert the moment a pattern crosses the line. Monitor mode runs on every plan, so you can prove a rule before you arm it.
Monitor, then arm
Every rule can run in monitor mode first, recording exactly what it would have done. Arm it when you trust it.
mode: monitorKill-chain detection
A sensitive read followed by egress is the attack the single call hides. Correlation across calls catches it.
pattern: exfiltrationContain on contact
When a rule fires, quarantine the agent, revoke its keys, or raise an alert in the same second.
action: quarantine_agentProvable end to end
Most agent security asks you to trust a dashboard. We let you verify the math.
Untrusted tool output structurally cannot reach a dangerous action, and every governed action leaves a receipt anyone can verify offline. No TEE hardware, no ledger, no vendor in the loop.
Runtime integrity IFC
The first runtime integrity information-flow control shipped in a commercial gateway. Untrusted output is taint-tracked to egress and destructive sinks, with no agent rewrite.
A transparency log, not a log
The audit log is a hosted RFC 6962 Merkle log with hourly signed tree heads and a public key endpoint. Membership is a proof, not a promise.
One receipt, verified offline
The information-flow policy, the enforcement decision, and the human approver's own signature, bound into one receipt you verify with nothing but a public key.
Threat intelligence
Your agents learn from everyone's.
Opt in to a cross-tenant feed of card verdicts, protected by a k-anonymity floor. When enough organizations have flagged a host, that shared judgment raises your local risk. It fails open, so the feed never blocks you on its own. On Team and above, a model returns a threat class, and behavioral baselines flag a new tool, a risk spike, or off-hours activity.
The other direction
Now point it the other way.
Outbound, AxioRank governs the agents you run. Inbound, it verifies the agents that visit you, cryptographically, not by user-agent string. Same engine, both directions.
- 01
Request
An AI agent hits a property guarded by the AxioRank middleware.
axioGuard({ siteKey }) - 02
Identify
Match the visitor against the known-agent directory: GPTBot, ClaudeBot, Perplexity, and more.
20+ known agents - 03
Verify
Check the Web Bot Auth signature cryptographically; fall back to reverse-DNS and user-agent.
RFC 9421 · Ed25519 - 04
Score
Run the same detectors on the request for scraping, enumeration, and probe signals.
risk 0–100 - 05
Decide
Inbound policies resolve under block-overrides to one verdict.
allow · challenge · block
Interoperate
65 agent protocols tracked, 47 live in the gateway.
MCP, A2A, OAuth protected-resource, x402, AP2, DID, ANS, NANDA AgentFacts, W3C Verifiable Credentials, Visa TAP and more, across six planes. Verify identities and capabilities across the agent ecosystem. The coverage matrix is machine-readable.
Works everywhere
Switzerland for the agentic stack.
AxioRank does not compete with the frameworks you build on. They plug in, the gateway sits in front of everything they touch, and your record streams into the tools you already watch.
Agents and frameworks plug in
A drop-in adapter routes the tools your agent already runs through the gateway. No rewrite.
Destinations it protects
The gateway sits in front of everything the agent reaches, and verifies the agents that reach you.
Clouds and operations
AxioRank runs where you run and streams its record into the tools your team already watches.
Names are trademarks of their respective owners. Listing one states an integration, not an endorsement.
SDK
Drop it in. One line guards a call.
No agent rewrite. Route tool calls through the gateway and let policy decide. Resolve the decision yourself with toolCall(), or let enforce() throw on a deny.
import { AxioRank, AxioRankDeniedError } from "@axiorank/sdk"; const axio = new AxioRank({ apiKey: process.env.AXIORANK_KEY! }); try { // One line guards the call. Throws if the gateway denies it. await axio.enforce({ tool: "aws.s3.deleteBucket", arguments: { bucket: "prod-backups", force: true }, }); await s3.deleteBucket("prod-backups"); // only runs when allowed} catch (err) { if (err instanceof AxioRankDeniedError) { console.error(err.result.reason); // denied by policy "deny-destructive" }}By the numbers
Live figures, each linked to its source.
Pricing
Start free. Scale when you are ready.
Every plan includes Zero-Trust identity, the gateway, policy, content inspection, monitor-mode response, and full protocol coverage. Paid plans add anomaly detection, armed response, more volume, and model threat intel.
Put every agent behind Zero-Trust.
Give your agents a short-lived identity, run every tool call through the gateway, and keep a redacted record of it all in under 100 ms.