AxioRank Agent Verification

Verify the AI agents that reach your Backdrop site's login, admin, search, AJAX, XML-RPC, and API endpoints, and challenge or block the ones that fail. Monitor and enforce modes, in-admin rule management, fail-open by design.

A thin client of the AxioRank inbound verify endpoint: each protected request is forwarded as one authenticated POST to /api/gateway/verify-request and the verdict is applied in Backdrop. There is no local model to run and no SDK to bundle. It is the Backdrop counterpart of the AxioRank WordPress plugin and Drupal module.

Requirements

This module has no dependencies beyond Backdrop core. To use it you need a free AxioRank account (https://axiorank.com) and a website-surface site key (axr_site_...). For the in-admin Agents page, the site key also needs the management scope.

Installation

• Install this module using the official Backdrop CMS instructions at https://docs.backdropcms.org/documentation/extend-with-modules.

• Register a website surface in AxioRank and copy its site key.

• Visit the configuration page under Administration > Configuration > Web services > AxioRank Agent Verification (admin/config/services/axiorank), paste the site key, choose the endpoints to verify, and leave the mode on Monitor. For better secret hygiene, set the key in settings.php instead of the form: $settings['axiorank_site_key'] = 'axr_site_...';

• Use Test connection to confirm AxioRank is reachable. Watch the verdicts in your dashboard, then switch this site and your AxioRank surface to Enforce when you are confident.

Manage agent rules

The Agents tab (admin/config/services/axiorank/agents) reads and writes your surface's real AxioRank inbound rules through a site-key-scoped API: set the surface posture and add allow, challenge, or block rules per agent, category, verification status, or risk, without leaving Backdrop. This needs a site key with the management scope.

An API verifier, not a cached-page crawler blocker

hook_init does not run on fully page-cached requests, which are served before Backdrop bootstraps. That is by design: this module governs the surface that actually reaches PHP, your login, admin, search, AJAX, XML-RPC, and API endpoints, plus any signed or bot-like request. To challenge crawlers on cached pages, verify at the edge in front of the cache.

Issues

Bugs and feature requests should be reported in the Issue Queue.

Current Maintainers

• Tejaswi Suresh, for AxioRank.
• Seeking additional maintainers.

Credits

• Written and maintained by AxioRank, the security gateway for AI agents.

License

This project is GPL v2 software. See the LICENSE.txt file in this directory for complete text.