Agent framework
Cloudflare Agents + AxioRank
Cloudflare Agents run on Vercel AI SDK tools, so the AxioRank Vercel adapter guards them with no rewrite.
TypeScript · no agent rewrite · decision in under 100ms
import { guardTools } from "@axiorank/sdk/vercel";
// inside your AIChatAgent's onChatMessage:
return streamText({
model,
messages: this.messages,
tools: guardTools(this.tools, axio, { onDeny: "return" }),
});How it works
Three steps to a governed agent.
Put every tool your Cloudflare Agents agent runs behind the AxioRank gateway. The adapter funnels through the same scoring, policy, and audit as a hand-written integration, so the allow, deny, and hold semantics are identical.
Install the SDK
npm install @axiorank/sdkWrap your tools
Use the Cloudflare Agents adapter to wrap the tools you already define. Name, description, and schema are preserved.
Run with confidence
Every call is scored, checked against your policy, and audited. A denied call raises, or returns a short refusal the agent can recover from.
See it decide
Score a tool call live.
This is the real engine that sits behind the adapter. Edit the arguments or pick an attack preset and watch the risk score, the signals, and the decision update in your browser. No signup.
Why guard at the tool boundary
The agent keeps its autonomy. You keep control.
The model still chooses what to do. AxioRank checks the concrete tool call (its arguments, the resource it touches, the secrets and PII it carries) the moment before it runs, so a prompt-injected or mistaken action is caught at the point it would do harm.
Catches the real action
Detects leaked secrets, PII, destructive operations, prompt injection, and egress in the actual call.
No rewrite
Wrap the tools you already have. Names, descriptions, and schemas are preserved.
One line per tool
The adapter funnels through the same gateway as the raw SDK, so semantics match exactly.
More integrations
Already on another framework?
Guard your Cloudflare Agents agent today
Create a key, wrap your tools, and route a call through the gateway in minutes. Or try it locally with no key first.