Content inspection

Read every argument before the tool ever runs.

More than 131 detectors walk every string in a tool call and score what they find. Secrets are fingerprinted and masked out of the stored record, so you keep the proof without keeping the secret.

Open the console Read the docs

131+ detectors · 7 categories · redacted at write time

scan · argumentscritical

AWS access key idenv.AWS_ACCESS_KEY_ID

Email addresstext

Unbounded SELECT *sql

stored: secrets fingerprinted, never raw

Content detectors

Signal categories

Severity tiers

Critical-signal floor

The taxonomy

Seven categories, one pass over the payload.

Every string leaf is checked against detectors grouped into seven categories. A call can light up more than one at once.

Secret

AWS keys, tokens, private keys, and more. A live credential floors the score.

Destructive

Recursive deletes, DROP and TRUNCATE, and DELETE without a WHERE clause.

Injection

Prompt injection, SQL, NoSQL, template and shell injection, SSRF, and indirect injection in tool output.

Malware

Reverse shells, encoded PowerShell, download-and-run pipes, and credential dumping. Denied by default.

Financial

Crypto wallets, IBAN and SWIFT codes. Seed phrases and private keys are redacted like secrets.

PII

Emails, national IDs, bank routing numbers, IP addresses, and Luhn-checked cards.

Egress

Unbounded SELECT *, bulk export, exfiltration hosts, and oversized field values.

Model I/O guardrails

Guard the prompt and the response, not just the tools.

The same engine inspects what you send a model and what it sends back. inspectPrompt catches prompt injection, jailbreaks, and a secret or PII leaking into the prompt. inspectCompletion catches injected instructions, PII egress, and a leaked secret in the output. Both run locally, with no key and no network, or wrap your chat client to guard every call.

Inspect a prompt or a completion

import { inspectPrompt, inspectCompletion } from "@axiorank/sdk";

const p = inspectPrompt(userMessage);
if (p.decision === "deny") throw new Error(p.reason);

const out = await model.generate(userMessage);
const c = inspectCompletion(out.text);

Wrap your chat client

import OpenAI from "openai";
import { guardOpenAIChat } from "@axiorank/sdk";

const openai = new OpenAI();
const chat = guardOpenAIChat(openai.chat.completions);

// every call is scored on both sides
const res = await chat.create({ model: "gpt-4.1", messages });

Live inspector

Paste a tool call. Watch it get scanned.

Detection runs in your browser using the same patterns and severities as the gateway, and the score uses the production scoring function. Edit the arguments and the result updates instantly.

toolarguments

valid JSON · every string leaf is scanned

risk scorebase 90 → 96

96/100

signals · 1

Secret

AWS access key idcritical
secret.aws_access_key · env.AWS_ACCESS_KEY_ID
redacted · sha256:96bca470

Secrets and personal data never reach the audit log in the clear.

From signals to a score

Many signals, with diminishing returns.

Each finding carries points by severity. The most severe signal counts in full, and each one after it counts for a little less, so a pile of tiny findings cannot game the number.

Weighted by severity

Low, medium, high, and critical findings each carry their own weight before they are combined.

Diminishing returns

Signals are combined so the score climbs fast on the first real finding and levels off after.

Critical floor

A live cloud key, a private key, or a forged signature floors the score at 90 or above on its own.

One credential is enough

A single live credential pushes the risk score to at least 90, no matter how harmless the rest of the call looks.

Redaction

Proof a secret was there, without storing it.

When a detector finds a secret, the audit log keeps a fingerprint, not the value. You can prove a key leaked, see where, and confirm it was caught, while the raw secret is masked at write time and never persisted.

What your agent sent

{ "env": { "AWS_ACCESS_KEY_ID": "AKIAIOSFODNN7EXAMPLE" } }

What gets stored

{ "env": { "AWS_ACCESS_KEY_ID": "«redacted:secret.aws_access_key»" } }
fingerprint: redacted · sha256:1a2b3c4d

Every detector

Browse the catalog, scan an example.

Filter by category and severity, then run an example payload to see exactly which detectors fire.

Scan an example

See what your agents are really sending.

Route a tool call through the gateway and get a scored, redacted record of every payload in under 100 milliseconds.

Open the console Compare plans

Read every argument before the tool ever runs.

Seven categories, one pass over the payload.

Secret

Destructive

Injection

Malware

Financial

PII

Egress

Guard the prompt and the response, not just the tools.

Paste a tool call. Watch it get scanned.

Many signals, with diminishing returns.

Weighted by severity

Diminishing returns

Critical floor

Proof a secret was there, without storing it.

Browse the catalog, scan an example.

Continue across the control plane.

AI Gateway

Agent identity

MCP gateway

Policy engine

Guardrails

Pricing

Developers

See what your agents are really sending.