AxioRank ORG

AxioRank Agent Verification
===========================

Verify the AI agents that reach your Backdrop site's login, admin, search,
AJAX, XML-RPC, and API endpoints, and challenge or block the ones that fail.
Monitor and enforce modes, in-admin rule management, fail-open by design.

A thin client of the AxioRank inbound verify endpoint:
each protected request is forwarded as one authenticated POST to
/api/gateway/verify-request and the verdict is applied in Backdrop. There is
no local model to run and no SDK to bundle. It is the Backdrop counterpart of
the AxioRank WordPress plugin and Drupal module.

Requirements
------------

This module has no dependencies beyond Backdrop core. To use it you need a free
AxioRank account (https://axiorank.com) and a website-surface site key
(axr_site_...). For the in-admin Agents page, the site key also needs the
management scope.

Installation
------------

• Install this module using the official Backdrop CMS instructions at

https://docs.backdropcms.org/documentation/extend-with-modules.

• Register a website surface in AxioRank and copy its site key.

• Visit the configuration page under Administration > Configuration >

Web services > AxioRank Agent Verification (admin/config/services/axiorank), paste the site key, choose the endpoints to verify, and leave the mode on Monitor. For better secret hygiene, set the key in settings.php instead of the form: $settings['axiorank_site_key'] = 'axr_site_...';

• Use Test connection to confirm AxioRank is reachable. Watch the verdicts in

your dashboard, then switch this site and your AxioRank surface to Enforce when you are confident.

Manage agent rules
------------------

The Agents tab (admin/config/services/axiorank/agents) reads and writes your
surface's real AxioRank inbound rules through a site-key-scoped API: set the
surface posture and add allow, challenge, or block rules per agent, category,
verification status, or risk, without leaving Backdrop. This needs a site key
with the management scope.

An API verifier, not a cached-page crawler blocker
--------------------------------------------------

hook_init does not run on fully page-cached requests, which are served before
Backdrop bootstraps. That is by design: this module governs the surface that
actually reaches PHP, your login, admin, search, AJAX, XML-RPC, and API
endpoints, plus any signed or bot-like request. To challenge crawlers on cached
pages, verify at the edge in front of the cache.

Issues
------

Bugs and feature requests should be reported in the
Issue Queue.

Current Maintainers
-------------------

• Tejaswi Suresh, for AxioRank.
• Seeking additional maintainers.

Credits -------

• Written and maintained by AxioRank, the security

gateway for AI agents.

License
-------

This project is GPL v2 software.
See the LICENSE.txt file in this directory for complete text.

Collapse