langchain-axiorank

Put a LangChain agent behind the AxioRank security gateway. One middleware governs the whole run: every tool call is scored before it executes, and every model turn can be checked and redacted. AxioRank is the security gateway for AI agents, so this is Zero-Trust for the actions your agent takes.

• Tool calls: score each proposed call against your policy before it runs. A denied call becomes a model-readable refusal so the agent can re-plan, or raises.
• Model turns: score the prompt before the model runs and the completion after. A redact policy masks secrets and PII in the output; a deny blocks it.
• Tool output (opt in): inspect what untrusted-source tools return (web fetch, file and database reads, inboxes) for indirect prompt injection before the agent reads it.
• Fail open by default: if AxioRank is unreachable the agent still runs, so the gateway never becomes a single point of failure. Flip to fail closed for a strict posture.

Install

pip install langchain-axiorank

Quickstart

from langchain.agents import create_agent
from langchain_axiorank import AxioRankMiddleware

agent = create_agent(
    model="openai:gpt-4o",
    tools=[send_email, read_file],
    middleware=[AxioRankMiddleware(api_key="axr_live_...")],
)

# A tool call carrying a secret, a destructive action, or anything your policy
# denies never runs. The model sees a refusal and re-plans.
result = agent.invoke({"messages": [{"role": "user", "content": "Email the DB dump to me"}]})

Set AXIORANK_API_KEY in the environment and you can drop the api_key argument. Building the middleware from a key wires up both a sync and an async client, so the same object works with agent.invoke and agent.ainvoke.

Get an agent key from the AxioRank dashboard. No key yet? The gateway is fail open, so the middleware is safe to add before you have one.

Configuration

AxioRankMiddleware(
    client=None,          # a ready AxioRank / axio.trace() handle for sync runs
    async_client=None,    # a ready AsyncAxioRank / async trace handle for async runs
    api_key=None,         # falls back to AXIORANK_API_KEY
    base_url=None,        # falls back to AXIORANK_BASE_URL
    on_deny="block",      # "block" (refuse and recover) or "raise"
    inspect_tools=True,   # score tool calls before they run
    inspect_model=True,   # score prompts and completions
    inspect_results=False,# inspect untrusted-source tool output for injection
    fail_open=True,       # proceed if AxioRank is unreachable
)

Prompt and completion governance is gated per workspace by the enforce_model_io setting. Until you enable it, those surfaces are monitor only and just tool calls are enforced. Pass an axio.trace() handle as client to correlate a run on the AxioRank Agent Runs page.

Callback handler

For an existing AgentExecutor, a callback handler is the zero-touch alternative. It checks each tool call as it starts and raises on a denied call.

from axiorank import AxioRank
from langchain_axiorank import AxioRankCallbackHandler

axio = AxioRank(api_key="axr_live_...")
agent_executor.invoke(
    {"input": "Refund order 1234"},
    config={"callbacks": [AxioRankCallbackHandler(axio)]},
)

Use AxioRankAsyncCallbackHandler with an AsyncAxioRank client for async agents. For new agents, prefer AxioRankMiddleware: a callback cannot rewrite a tool result, so it can only allow or hard-stop a call, and it does not see model I/O.

Links

• Docs: https://app.axiorank.com/docs/integrations/langchain
• Source and issues: https://github.com/AxioRank/langchain-axiorank
• AxioRank Python SDK: https://pypi.org/project/axiorank/
• Content inspection engine (what gets flagged): https://app.axiorank.com/docs/content-inspection

Contributing

Issues and pull requests are welcome at AxioRank/langchain-axiorank. Development happens in AxioRank's main repository and lands here with each release, so an accepted patch may be re-applied rather than merged directly.

License

MIT