Getting started

This guide takes a tool call from "the agent calls the tool directly" to "the call passes through AxioRank first." The gateway authenticates the agent with its API key, scores the call, applies your policies, and returns a decision — then records a redacted audit log.

1. Create an agent

In the dashboard, go to Outbound → Agents → Create Agent and copy the API key (axr_live_…). It's shown once.

2. Install the SDK

# Python
pip install axiorank

# TypeScript / JavaScript
npm install @axiorank/sdk

3. Guard a tool call

enforce raises when the gateway denies the call, so you guard a tool in one line. Use tool_call / toolCall instead if you'd rather inspect the decision yourself.

# Python
from axiorank import AxioRank, AxioRankDeniedError

axio = AxioRank(api_key="axr_live_...")

try:
    axio.enforce("aws.delete_bucket", {"name": "prod-data"})
    delete_bucket("prod-data")  # only runs if AxioRank allowed it
except AxioRankDeniedError as e:
    print(f"Blocked: {e.result.reason} (risk {e.result.risk})")

// TypeScript
import { AxioRank, AxioRankDeniedError } from "@axiorank/sdk";

const axio = new AxioRank({ apiKey: process.env.AXIORANK_API_KEY! });

try {
  await axio.enforce({ tool: "aws.delete_bucket", arguments: { name: "prod-data" } });
  await deleteBucket("prod-data"); // only runs if AxioRank allowed it
} catch (e) {
  if (e instanceof AxioRankDeniedError) {
    console.warn(`Blocked: ${e.result.reason} (risk ${e.result.risk})`);
  }
}

4. Read the decision

Every call resolves to one of two outcomes the caller sees:

• allow — no blocking policy matched; proceed.
• deny — a policy blocked the call; surface reason to the operator.

A require_approval policy holds the call for a human. The SDK waits out the hold transparently and resolves to the final allow / deny — you don't handle a third state. Secrets found in the arguments are redacted before the call is written to the audit log.

Next steps

• Python quickstart · TypeScript quickstart
• LangChain integration — guard every tool an agent runs.
• Gateway API — the raw HTTP contract for any language.
• Content-inspection engine — what the scanner looks for.