Changelog

Notable changes to the public API, SDKs, and webhooks. See Versioning & stability for what counts as a breaking vs. backward-compatible change. Dates are UTC.

2026-07-12: Open-source gateway 0.2.1

• Open-source gateway 0.2.1 (@axiorank/gateway): the self-hostable gateway is now a public repository at github.com/AxioRank/gateway, with 34 provider presets and Docker, Fly.io, Railway, and Render deploy targets (anywhere Node 20 or newer runs). See Open-source gateway.

2026-07-10: LangChain partner package, WordPress.org, Drupal 12

• langchain-axiorank: a standalone LangChain partner package (agent middleware) on PyPI, so a LangChain or LangGraph agent can be guarded without the full SDK. See LangChain.
• WordPress plugin on WordPress.org: the inbound-verification plugin is now listed in the WordPress.org plugin directory. See WordPress.
• Drupal 12: the Drupal module now supports Drupal 10, 11, and 12.

2026-07-08: Vercel AI SDK middleware, LiteLLM content inspection, Adobe Commerce

• @axiorank/ai-sdk: guardrail middleware for the Vercel AI SDK. One wrapLanguageModel call inspects the prompt, the completion (with optional redaction), and the tool calls a model proposes. See Vercel AI SDK.
• LiteLLM content-aware guardrail (axiorank): the Python SDK's LiteLLM integration is now a full CustomGuardrail that governs prompts, completions (with secrets and PII redaction), and proposed tool calls, on both the guardrails: config and litellm_settings.callbacks registration paths. See LiteLLM.
• Adobe Commerce (Magento 2): an Agent Verification extension for Adobe Commerce. See Adobe Commerce.

2026-07-07: OpenAI Realtime voice agents, Backdrop CMS module

• Realtime voice agents (@axiorank/sdk): guard the tool calls an OpenAI Realtime (voice) agent makes through @axiorank/sdk/realtime, so a spoken agent is governed like any other. See Voice agents.
• Backdrop CMS module: an Agent Verification module for Backdrop CMS, a thin client of the inbound verify endpoint. See Backdrop.

2026-07-06: AxioRank for HubSpot

• HubSpot Marketplace app: a one-click install that governs the AI agents reaching your CRM through HubSpot's remote MCP server, with an Agent Access card on every contact, company, and deal. See HubSpot.

2026-07-05: n8n node, more evidence profiles, org model governance, Browser Guard v0.2

• n8n community node (n8n-nodes-axiorank): drive AxioRank from an n8n workflow, backed by the platform-neutral /api/v1/automation/* surface (the same workspace-key API the Zapier app uses).
• HIPAA and more evidence profiles: the compliance evidence bundle now assembles against seven framework profiles via ?profile=. HIPAA, ISO 27001, NIST AI RMF, ISO 42001, and Australia's AI safety standard join SOC 2 and the EU AI Act.
• Centralized model governance: an organization can inherit provider credentials, enforce a default-deny model allowlist across every proxy surface, and cap spend org-wide.
• Browser Guard 0.2: the browser extension gains live re-scan, network-egress and clipboard inspection, and a configurable policy.

2026-07-04: Zapier integration, Drupal module, AI Gateway model catalog

• Zapier integration (app + workspace-key API): trigger a Zap on a governance event, and act back to approve a held call, quarantine an agent, or respond to an incident. Authenticated with a workspace key on the automation scope.
• Drupal module: verify the AI agents reaching a Drupal site's REST, JSON:API, and admin endpoints against your inbound surfaces, monitor or enforce. See Drupal.
• AI Gateway model catalog: provider presets, a 119-model catalog, and a public /models page, plus an SSRF guard on caller-supplied custom upstream URLs. See AI Gateway.

2026-07-03: Open-source gateway, flagship AI Gateway hub

• @axiorank/gateway (npm): an npx-runnable, open-source AI security gateway you can self-host, with API-key auth to pull and push its routes. See Open-source gateway.
• AI Gateway hub: response caching plus per-route retries and timeouts on the hosted AI Gateway, with a live playground to try a governed call.

2026-07-02: Agent Runs (sessions, metadata, sub-agents, gateway trace headers)

• Agent Runs: the console's Traces page became /runs, one row per agent run with its decision mix, cost, tokens, models, duration, and p95 step latency. /traces deep links redirect permanently.
• Tool-call API: POST /api/gateway/tool-call (and the MCP variant) accepts optional sessionId (uuid, groups traces into one conversation), metadata (a tag map, at most 16 keys and 2KB, values redacted at write), and parentStepIndex (nests a step under the call that spawned it). All degrade to absent on malformed input; the wire is unchanged when omitted.
• AI Gateway: X-AxioRank-Trace-Id, X-AxioRank-Session-Id, X-AxioRank-Step-Index, and X-AxioRank-Parent-Step-Index request headers stitch proxied model turns into the same run as your tool calls. With model-I/O governance off, a turn carrying a trace header is recorded as an observation-only step (allow, risk 0, telemetry only, no content stored).
• SDKs: sessionId/metadata on tool calls and clients, trace() options, trace().headers() (TypeScript) / trace.headers (Python) for the gateway headers, and trace().child() for sub-agent nesting. Available in @axiorank/sdk and axiorank (Python); all framework adapters inherit.
• OTLP export: spans carry axiorank.session_id when reported.

2026-06-25: Removed Bitcoin anchoring, @axiorank/audit-verify 0.3.1

• Bitcoin anchoring removed: the OpenTimestamps anchoring of audit checkpoints introduced on 2026-06-24 has been withdrawn. The ots witness scheme, the GET /api/v1/audit/log/{logId}/checkpoints/{seq}/anchor.ots download, and the per-workspace anchoring toggle are gone. Receipts, checkpoints, Sigstore Rekor and signed-note witnesses, and offline verification are unchanged.
• @axiorank/audit-verify 0.3.1: drops verifyOtsWitness, checkOts, and parseOts. 0.3.0 is deprecated; upgrade to 0.3.1. See npm.

2026-06-22: MCP govern loop, Shopify inbound verification

• Govern a discovered MCP server: POST /api/discovery/mcp-govern turns an mcpaudit finding into a tool-scoped policy in one click. The action is recomputed server-side from the finding's risk signals, so the rule can never be weaker than your engine would choose, and it starts in monitor mode. See Shadow AI discovery.
• Shopify: a Shopify app that verifies the AI agents reaching a storefront against your inbound surfaces, with no change to the verify API. See Shopify.

2026-06-21: AI Governance Copilot, emergency lockdown, PagerDuty

• AI Governance Copilot ("Ask AxioRank"): a grounded, read-only conversational analyst over your own governance data. It answers from your agents, policies, incidents, logs, and spend, cites the evidence, and turns a natural-language ask into a pre-filled, monitor-mode policy you confirm (it never writes). Available on every plan. See AI Governance Copilot.
• Emergency lockdown: a workspace-wide circuit breaker. POST /api/workspace/enforcement-floor holds or denies every governed call in one action, admin-only, on every plan, recorded in the change log. See Emergency lockdown.
• PagerDuty two-way incidents: the pagerduty notification channel now opens a PagerDuty incident (with a deep link) for each AxioRank incident and mirrors ack and resolve back through a signature-verified webhook. See PagerDuty.

2026-06-20: Splunk discovery, Datadog, Slack app, WordPress

• Splunk discovery connector: pull egress and proxy logs from Splunk into Shadow AI discovery to surface ungoverned AI usage, the inbound complement to streaming the audit log out.
• Datadog: stream the audit log to Datadog with prebuilt dashboards and monitors, send AxioRank alerts to the Datadog Events API, and pull Datadog logs into discovery. See Datadog.
• Slack app: an installable "Add to Slack" app with an App Home approvals dashboard, /axiorank slash commands, and inline approve and deny. See Slack.
• WordPress plugin: verify the AI agents reaching a WordPress site's REST API against your inbound surfaces, fail-open, with no server change. See WordPress.

2026-06-18: AI Gateway streaming, managed credentials, native Gemini

• Managed credentials (AI Gateway): store a provider key once (encrypted at rest) and send only the X-AxioRank-Key, so callers need no provider credential at all. Managed via POST / GET / DELETE /api/proxy/credentials.
• Bedrock ConverseStream: streaming Bedrock is governed at …/api/proxy/bedrock/v1/converse-stream, and under model-I/O governance the re-emitted stream preserves tool calls.
• Native Google Gemini: the native Gemini API (generateContent and streamGenerateContent) is governed through …/api/proxy/gemini.

2026-06-17: AI Gateway, spend governance, inbound Surfaces, taint lineage

• AI Gateway (drop-in proxy): govern every model call across your org by changing one base URL. OpenAI Chat Completions and Responses, Azure OpenAI, the Anthropic Messages API, Amazon Bedrock (Converse, SigV4), and Google Vertex are governed through one OpenAI-compatible proxy, streaming and non-streaming. See AI Gateway.
• Spend governance: report model and token counts (or costUsd) on a call and AxioRank attributes spend per agent and per model, charts it over time, and caps it with a workspace budget (monitor, warn, enforce) plus model-aware policies. See Spend governance.
• Inbound Surfaces (axiorank 0.16.0): the website-only "Properties" generalize into typed inbound surfaces (website, HTTP API, MCP server, A2A agent, webhook). The Python SDK restores parity with the TypeScript SDK's verifySurface / verifyRequest via verify_surface / verify_request.
• Cross-agent taint lineage (@axiorank/sdk 0.16.0, axiorank 0.15.0): a result-phase call returns a signed taintHandle / taint_handle. Pass it on the receiving agent's result and the gateway re-seeds that run's taint, so a value laundered through a second agent is still caught at the next sink.

2026-06-16: Gemini Enterprise, Shadow AI discovery

• Shadow AI discovery: find the AI usage that never went through AxioRank from four independent signal families: egress logs (/api/discovery/ingest), MCP scans (/api/discovery/mcp-scan), identity events (Microsoft Entra and CASB), and cloud audit trails (CloudTrail for Bedrock, GCP for Vertex). Findings forward back out to your SIEM. Pro and above. See Shadow AI discovery.
• mcpaudit --report (@axiorank/mcpaudit 0.3.0): mcpaudit scan --report <url> posts a scan straight into discovery as a candidate MCP server to govern.
• Gemini Enterprise: govern Google's Gemini Enterprise Agent Platform with a structural ADK runtime plugin (axiorank[adk]) plus a GCP Cloud Audit Logs discovery connector. See Gemini Enterprise.

2026-06-15: EU AI Act evidence, alert-fatigue controls

• EU AI Act evidence pack: map your audit trail and human-approval controls to Articles 12 and 14 with an interactive verifier. See EU AI Act evidence pack.
• Alert-fatigue controls: mute-policy suppression rules, per-channel quiet hours and rate caps (critical alerts always break through), and an opt-in daily digest, so a noisy workspace can quiet routine alerts without missing the ones that matter.

2026-06-13: Cloudflare Agents & Strands adapters, shareable scorecards, one-click installs

• Strands Agents (AWS) (axiorank 0.14.0): guard_tool / guard_tools wrap a Strands @tool so its arguments are scored before it runs. Framework-free; install with pip install "axiorank[strands]".
• Cloudflare Agents: the Agents SDK runs its tools through the Vercel AI SDK, so the existing @axiorank/sdk/vercel adapter guards them with no Cloudflare-specific package to install.
• --share on the CLI (@axiorank/sdk 0.14.0): add --share to npx @axiorank/sdk demo or npx @axiorank/sdk scan to publish that result as a public, read-only scorecard and print the link. Opt-in; nothing is shared without the flag.
• One-click MCP install & Docker image: install deep links for Claude, Cursor, and other MCP clients, plus a published container image for the MCP gateway and an MCP-registry kit, so putting AxioRank in front of an MCP server is a copy-paste step.

2026-06-12: Zero-key inspect(), model-I/O guardrails, redact, Google ADK

• Zero-key inspection (@axiorank/sdk 0.10.0, axiorank 0.12.0): inspect(), inspectText(), inspectPrompt(), and inspectCompletion() (Python: inspect, inspect_text, inspect_prompt, inspect_completion) score a tool call or model I/O locally, with no API key, no signup, and no network call. They run the same detector engine the gateway uses, so a local verdict matches the hosted one. Try it in one line: npx @axiorank/sdk demo, or npx @axiorank/sdk scan ./payload.json.
• Model-I/O guardrails (@axiorank/sdk 0.11.0): inspectPrompt() / inspectCompletion() screen an LLM's prompt and response (prompt injection, secret and PII leakage, and with the ML lane, toxicity and groundedness), so you can gate model input and output, not just tool calls.
• redact transform (@axiorank/sdk 0.13.0): a held call can be released with sensitive spans masked instead of blocked outright (the enforcement order is deny, then hold, then redact, then allow). The verdict types now carry the redacted payload so your code can forward the masked version.
• intent on tool calls (@axiorank/sdk 0.9.0, axiorank 0.11.0): pass a short intent string to give the flow judge context when it adjudicates a held call.
• Google ADK adapter (axiorank 0.9.0): guard_tool / guard_tools wrap a plain callable or a FunctionTool. Structural, so no google-adk version is pinned.
• Agent red-team in CI (@axiorank/sdk 0.12.0): run a corpus of multi-step attacks against your governed agent and fail the build if a kill chain gets through.

2026-06-11: Agent budgets, Gemini & smolagents adapters, detection hardening

• Agent budget guardrails (@axiorank/sdk 0.8.0, axiorank 0.10.0): attribute spend to a call with costUsd / cost_usd so a cost_usd budget policy can cap an agent once it is over budget. See Budgets.
• Gemini & smolagents adapters: Google Gemini (@axiorank/sdk/gemini; Python axiorank.integrations.google_genai) guards the google-genai function-calling loop and returns ready-to-send functionResponse parts; smolagents (axiorank.integrations.smolagents) wraps a Tool by shadowing forward. Both are structural and never import the framework SDK.
• Detection hardening: detectors now normalize homoglyphs, zero-width characters, and nested encodings before matching, so evasion via lookalike or layered-encoded payloads no longer slips through.
• Instant key revocation & data residency: revoking an API key now takes effect immediately at the gateway, and a workspace can pin a data region, including EU-resident model inference.

2026-06-10: One-click MCP connect, more Python adapters, approval follow-ups

• One-click MCP connect: the AxioRank MCP server now advertises OAuth discovery. Clients that support MCP authorization (Claude, Cursor, ChatGPT connectors) connect with just the URL and a consent screen; API keys keep working unchanged.
• Python adapters (axiorank 0.7.0): CrewAI (axiorank[crewai]), AutoGen · AG2 (framework-free), and a LiteLLM proxy guardrail (axiorank[litellm]) that governs every framework behind the proxy with zero per-agent code.
• Webhook event: approval.escalated joins the catalog. It fires when a held approval stays pending past the workspace's escalation window, so your systems can page a second tier.
• Public MCP discovery surface: the AxioRank MCP server now answers initialize, tools/list, and ping without credentials, so MCP registries and directories can health-check it and list its tools. Tool invocation still requires a bearer; an unauthenticated tools/call returns the 401 challenge that starts the OAuth flow.
• New docs: Approvals, Audit log export, Compliance evidence bundle, Workspace security, Detection intelligence, and the Anthropic Messages API adapter. Webhook docs now cover approval.escalated, secret rotation, and test events.
• CI drift gate (@axiorank/cli 0.1.2): axiorank config diff --exit-code exits non-zero when your live workspace governance has drifted from your checked-in config file, and the verify action takes a config file to diff against, so you can fail a build on governance drift. See GitOps.
• Wording-only patch releases: @axiorank/sdk 0.6.1, axiorank 0.7.1, and @axiorank/mcp-gateway 0.1.2 align package descriptions and READMEs with the Zero-Trust positioning. No code changes.
• Python SDK fix (axiorank 0.7.2): passing a trace handle into a framework adapter no longer raises AttributeError when the workspace enforces IFC, and axio.trace() now returns a passable handle (TypeScript parity); with / async with keep working unchanged.

2026-06-08: Framework adapters & the AxioRank MCP server

• Framework integrations: drop-in adapters route any framework's tool calls through the gateway, no rewrite. TypeScript (@axiorank/sdk 0.3.0) ships subpaths for the Vercel AI SDK, OpenAI Agents, LangChain · LangGraph, and Mastra; Python (axiorank 0.3.0) adds LlamaIndex, Pydantic AI, and OpenAI Agents extras alongside LangChain. See Framework integrations.
• AxioRank MCP server: call AxioRank's own governance and control-plane capabilities as tools from any MCP client (Cursor, Claude Desktop, …), authenticated with your API key. See AxioRank MCP server.

2026-06-07: Developer platform

• OpenAPI 3.1 spec published at /api/openapi.json, with an interactive API reference. Import it into Postman or any OpenAPI codegen.
• Developer webhooks: subscribe your services to platform events (tool_call.evaluated, approval.resolved, kill_chain.detected, and more) with signed, retried, replayable delivery. See Webhooks.
• SDKs: added webhook signature verification: constructEvent / verifyWebhookSignature (TypeScript) and construct_event / verify_signature (Python).
• Idempotency: POST /gateway/tool-call and /gateway/verify-card now accept an Idempotency-Key header; safe retries replay the first response. See Gateway API → Idempotency.
• Versioned URLs: the gateway is now reachable at the explicit /api/v1 base path; the unversioned /api/... paths remain as aliases. See Versioning & stability.

2026-06-06: Python SDK

• axiorank 0.1.0 on PyPI, at parity with the TypeScript SDK: sync (AxioRank) and async (AsyncAxioRank) clients, tool_call / enforce, card preflight, and a LangChain callback handler. See the Python quickstart.

2026-06-03: Gateway API + TypeScript SDK

• Gateway API: the public HTTP contract for tool-call scoring/enforcement, card preflight, and inbound request verification. See the Gateway API.
• @axiorank/sdk 0.1.0 on npm: toolCall() / enforce(), verifyCard(), and the axioGuard inbound middleware. See the TypeScript quickstart.
• @axiorank/mcp-gateway on npm: govern an MCP server with no code changes.