axiorank 0.12.0

Official Python SDK for AxioRank. Zero-Trust for AI agents: route every tool call through one governed control plane.

axiorank

Catch leaked secrets, prompt injection, destructive commands, and PII in your AI agent's tool calls. This runs the same detection engine the hosted AxioRank gateway runs, in-process, with no API key and no signup.

Parity with the TypeScript @axiorank/sdk.

Install

pip install axiorank

Try it first (no API key)

See what AxioRank catches before you sign up. No key, no network:

python -m axiorank demo

In code, inspect() returns an advisory verdict (the default posture: deny on a live secret, a destructive operation, or risk at or above 75):

from axiorank import inspect

r = inspect("aws.s3.putObject", {
    "body": "AKIAIOSFODNN7EXAMPLE",
    "webhook": "http://attacker.example/exfil",
})
print(r.decision, r.risk)  # "deny" 96
print([s.detector for s in r.signals])  # ["secret.aws_access_key", ...]

inspect_text(tool, text) does the same for a tool's output, catching indirect prompt injection before your agent ingests it.

Enforce centrally

inspect() shows what is risky locally. To enforce it with your own policy, an audit trail, approvals, and kill-chain correlation, create a free key at axiorank.com and route calls through the gateway.

Quickstart (sync)

import os
from axiorank import AxioRank

axio = AxioRank(api_key=os.environ["AXIORANK_API_KEY"])  # looks like axr_live_...

# Get the decision and act on it yourself:
result = axio.tool_call("github.push", {"repo": "myrepo"})
if result.decision == "deny":
    print(f"Blocked: {result.reason} (risk {result.risk})")
else:
    ...  # proceed with the real tool call

enforce(): guard in one line

from axiorank import AxioRank, AxioRankDeniedError

axio = AxioRank(api_key=os.environ["AXIORANK_API_KEY"])

try:
    axio.enforce("aws.delete_bucket", {"name": "prod-data"})
    delete_bucket("prod-data")  # only runs if AxioRank allowed it
except AxioRankDeniedError as e:
    log.warning("AxioRank blocked the call: %s", e.result.reason)

A require_approval policy holds the call for a human; tool_call/enforce transparently wait out the hold and resolve to the final allow/deny.

Quickstart (async)

import os
from axiorank import AsyncAxioRank

async def main():
    async with AsyncAxioRank(api_key=os.environ["AXIORANK_API_KEY"]) as axio:
        result = await axio.tool_call("stripe.refund", {"amount": 5000})
        print(result.decision, result.risk)

Preflight an external server before trusting it

result = axio.verify_card(url="https://mcp.acme.com")
print(result.decision, result.identity.signature_valid, result.protocol)

# Or guard in one line; raises AxioRankCardDeniedError on `deny`:
axio.enforce_card(url="https://mcp.acme.com")

Anthropic Messages API

The Anthropic SDK doesn't run your tools; your loop does. Guard the dispatch step and send back the tool_result dicts it returns. Defaults to on_deny="return"; the adapter never imports anthropic itself.

import anthropic
from axiorank import AxioRank
from axiorank.integrations.anthropic import guard_tool_handlers

client = anthropic.Anthropic()
axio = AxioRank(api_key=os.environ["AXIORANK_API_KEY"])
dispatch = guard_tool_handlers({"deploy": lambda i: deploy(i["service"])}, axio)

msg = client.messages.create(model="claude-opus-4-8", tools=tools, messages=messages)
results = [dispatch(b) for b in msg.content if b.type == "tool_use"]
# send `results` back as the next user message

Async client? Use guard_tool_handlers_async (or guard_tool_use / guard_tool_use_async to guard a single block).

LangChain

pip install "axiorank[langchain]"

from axiorank import AxioRank
from axiorank.integrations.langchain import AxioRankCallbackHandler

axio = AxioRank(api_key=os.environ["AXIORANK_API_KEY"])

# Every tool the agent runs is checked against your policies first; a blocked
# tool raises and the step fails.
agent_executor.invoke(
    {"input": "..."},
    config={"callbacks": [AxioRankCallbackHandler(axio)]},
)

Prefer a model-readable refusal over a raised exception? Wrap individual tools:

from axiorank.integrations.langchain import guard_tool

safe_tool = guard_tool(my_tool, axio, on_deny="return")

LlamaIndex

pip install "axiorank[llamaindex]"

from axiorank.integrations.llamaindex import guard_tool

# Wrap any FunctionTool: its arguments are scored before it runs, and the
# schema, name, and description are preserved, so it is a drop-in replacement.
safe_tool = guard_tool(my_tool, axio)                      # raises on deny
recoverable = guard_tool(my_tool, axio, on_deny="return")  # model-readable refusal

Pydantic AI

pip install "axiorank[pydantic-ai]"

from axiorank.integrations.pydantic_ai import guard_tool

# Wrap a Tool; its name, description, and signature (schema) are preserved.
safe_tool = guard_tool(my_tool, axio)                       # sync tool
safe_async = guard_tool(my_tool, async_client=axio_async)   # async tool

OpenAI Agents (Python)

pip install "axiorank[openai-agents]"

from axiorank import AsyncAxioRank
from axiorank.integrations.openai_agents import guard_tool

axio = AsyncAxioRank(api_key=os.environ["AXIORANK_API_KEY"])

# The SDK runs tools async; a deny returns a refusal the model can re-plan around.
safe_tool = guard_tool(my_function_tool, axio, on_deny="return")

Configuration

Argument	Default	Notes
api_key	- (required)	Your agent's key (axr_live_...).
base_url	https://app.axiorank.com	Point at your own deployment.
timeout	10.0	Per-request timeout, in seconds.
approval_timeout	300.0	Max wait for a human to resolve a hold, seconds.
client	a fresh httpx.Client	Inject your own httpx client (tests, proxies).

License

MIT