Skip to content

AxioRank: Zero-Trust for AI Agents

by axiorank.com · remote · no sign-in to list tools · v1.0.1 · published by com.axiorank

Zero-trust gateway for AI agents: score tool calls, verify agent cards, enforce policy, audit.

Deletes · 2Changes · 8
CompareRegistry entry

22 tools: 2 can delete or cancel things, 8 change things and 12 only read.

Scanned Oct 21, 2026

2 checks matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http axiorank https://app.axiorank.com/api/mcp-server/mcp --header 'Authorization: <your-authorization>'

Findings

Matches of fixed checks, with the text they matched.

1 warn1 info
  • Warnaxiorank_author_detector

    The server marks "axiorank_author_detector" as not read-only (readOnlyHint: false), and its words say it reads.

    Matched text

    annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":false,"openWorldHint":true}; The description's first verb is "describe": a word for reading.

    What this check looks for
  • Infoaxiorank_issue_token

    The description mentions "credential".

    Matched text

    description: "...existing agent. This is the Zero-Trust credential the agent sends as `Authorization: Bear..."

    What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

22 tools

Deletes or cancels 2Claude Code: deny
  • axiorank_quarantine_agentReversible kill switch: quarantine an agent so the gateway DENIES all of its tool calls, or release it.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Reversible kill switch: quarantine an agent so the gateway DENIES all of its tool calls, or release it. Set `quarantine: false` to restore. Requires the `agents:write` scope.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
  • axiorank_revoke_agentPermanently revoke an agent: its API keys stop authenticating immediately (incident response).No findings

    Why it is in this group

    • The name "axiorank_revoke_agent" says "revoke": a word for removing or ending something.
    • The description says "Irreversible".
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Permanently revoke an agent: its API keys stop authenticating immediately (incident response). Irreversible. Issue a new agent to restore access. Its audit history is kept. Requires the `agents:write` scope. Prefer `axiorank_quarantine_agent` for a reversible pause.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
Changes things 8Claude Code: ask
  • axiorank_author_detectorDescribe a risk in plain English and AxioRank's AI proposes a custom content detector (regex or keyword) and SAVES it DISABLED for your review.1 finding

    Why it is in this group

    • The description's first verb is "describe": a word for reading.
    • The server marks it as not read-only (readOnlyHint: false).

    Findings

    • Warn

      The server marks "axiorank_author_detector" as not read-only (readOnlyHint: false), and its words say it reads.

      Matched text

      annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":false,"openWorldHint":true}; The description's first verb is "describe": a word for reading.

      What this check looks for
    Description, as the server wrote it
    Describe a risk in plain English and AxioRank's AI proposes a custom content detector (regex or keyword) and SAVES it DISABLED for your review. An LLM never arms detection unattended. Outbound content categories only (secret/pii/destructive/injection/egress). Requires the `policies:write` scope and an AI-assessments-enabled plan (Team+).

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • axiorank_check_approvalPoll the verdict of a held (`hold`) tool call.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Poll the verdict of a held (`hold`) tool call. Pass the `approvalId` returned by `axiorank_score_tool_call`. Blocks briefly server-side and returns as soon as an operator approves/denies; otherwise returns the still-`pending` status so you can call again. Requires the `gateway:write` scope and the same agent key that made the original call.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • axiorank_create_agentCreate a new agent in your workspace and return a SHORT-LIVED bootstrap token to start using it immediately (no durable secret is emitted).No findings

    Why it is in this group

    • The name "axiorank_create_agent" says "create": a word for a change.
    Description, as the server wrote it
    Create a new agent in your workspace and return a SHORT-LIVED bootstrap token to start using it immediately (no durable secret is emitted). For long-term auth, add a static key or a federation binding in the dashboard. Requires the `agents:write` scope.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • axiorank_create_policyCreate an outbound governance policy.No findings

    Why it is in this group

    • The name "axiorank_create_policy" says "create": a word for a change.
    Description, as the server wrote it
    Create an outbound governance policy. It is created DISABLED so an LLM can never arm enforcement unattended. Review it (axiorank_get_policy) then enable it with axiorank_update_policy. `toolPattern` is a glob over tool names; `action` is allow / deny / require_approval / redact (redact masks PII in a model completion). Requires the `policies:write` scope.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • axiorank_issue_tokenMint a short-lived, scoped `axr_tok_…` access token for an existing agent.1 finding

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    Findings

    • Info

      The description mentions "credential".

      Matched text

      description: "...existing agent. This is the Zero-Trust credential the agent sends as `Authorization: Bear..."

      What this check looks for
    Description, as the server wrote it
    Mint a short-lived, scoped `axr_tok_…` access token for an existing agent. This is the Zero-Trust credential the agent sends as `Authorization: Bearer <token>`. It expires within the hour and cannot be replayed afterwards. Durable static keys are issued in the dashboard, not here. Requires the `keys:write` scope.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • axiorank_score_tool_callInspect a proposed agent tool call BEFORE executing it.No findings

    Why it is in this group

    • The name "axiorank_score_tool_call" says "call": a word for a change.
    Description, as the server wrote it
    Inspect a proposed agent tool call BEFORE executing it. AxioRank scores its risk (0–100), runs content inspection (secrets, PII, destructive ops, prompt-injection, egress), applies your policies, records an audit log, and returns a decision: `allow`, `deny`, or `hold`. On `hold`, a human must approve. Poll `axiorank_check_approval` with the returned `approvalId`. Call this in your tool-use loop and refuse or wait on any non-`allow` decision. Requires the `gateway:write` scope.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • axiorank_update_policyUpdate an existing policy: enable/disable it, rename it, or change its priority.No findings

    Why it is in this group

    • The name "axiorank_update_policy" says "update": a word for a change.
    Description, as the server wrote it
    Update an existing policy: enable/disable it, rename it, or change its priority. (Other fields are edited in the dashboard.) Requires the `policies:write` scope.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • axiorank_verify_cardVet a remote agent or tool's identity card (A2A Agent Card, MCP server card, OAuth metadata, x402, …) BEFORE connecting to it.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Vet a remote agent or tool's identity card (A2A Agent Card, MCP server card, OAuth metadata, x402, …) BEFORE connecting to it. Supply EITHER `url` (AxioRank fetches the card) OR an inline `document`. AxioRank verifies signatures, scores supply-chain risk, folds in cross-tenant threat intel, and returns `allow` / `review` / `deny` with the resolved identity, capabilities and auth. Use it as a connection preflight. Requires the `cards:verify` scope.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
Only reads 12Claude Code: allow
  • axiorank_get_agentFetch one agent's posture (quarantine state, labels, last-used, revocation) by id, scoped to your workspace.No findings

    Why it is in this group

    • The name "axiorank_get_agent" says "get": a word for reading.
    Description, as the server wrote it
    Fetch one agent's posture (quarantine state, labels, last-used, revocation) by id, scoped to your workspace. Requires the `agents:read` scope.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • axiorank_get_healthLiveness/readiness probe for the AxioRank control plane (API + database reachability).No findings

    Why it is in this group

    • The name "axiorank_get_health" says "get": a word for reading.
    Description, as the server wrote it
    Liveness/readiness probe for the AxioRank control plane (API + database reachability). Returns `status: ok|degraded`.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • axiorank_get_incidentFetch the kill-chain finding behind an alert (the multi-step attack pattern, severity, and the contributing tool-call ids) by alert id.No findings

    Why it is in this group

    • The name "axiorank_get_incident" says "get": a word for reading.
    Description, as the server wrote it
    Fetch the kill-chain finding behind an alert (the multi-step attack pattern, severity, and the contributing tool-call ids) by alert id. Returns null evidence for a non-kill-chain alert. Requires the `logs:read` scope.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • axiorank_get_policyFetch one outbound policy by id, scoped to your workspace.No findings

    Why it is in this group

    • The name "axiorank_get_policy" says "get": a word for reading.
    Description, as the server wrote it
    Fetch one outbound policy by id, scoped to your workspace. Requires the `policies:read` scope.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • axiorank_get_protocol_coverageList the agent-interop protocols AxioRank can govern (A2A, MCP, OAuth, x402, DIDs, robots.txt/llms.txt, AP2, …), grouped into six planes, each with coverage status (live/beta/plann…No findings

    Why it is in this group

    • The name "axiorank_get_protocol_coverage" says "get": a word for reading.
    Description, as the server wrote it
    List the agent-interop protocols AxioRank can govern (A2A, MCP, OAuth, x402, DIDs, robots.txt/llms.txt, AP2, …), grouped into six planes, each with coverage status (live/beta/planned) and direction (inbound/outbound/both). Use this to discover what AxioRank speaks before wiring up card verification or inbound bot management.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • axiorank_get_usageReport this billing period's usage for your workspace: plan tier, governed events used vs the monthly limit, and ML assessments used.No findings

    Why it is in this group

    • The name "axiorank_get_usage" says "get": a word for reading.
    Description, as the server wrote it
    Report this billing period's usage for your workspace: plan tier, governed events used vs the monthly limit, and ML assessments used. Requires the `logs:read` scope.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • axiorank_list_agentsList the active agents in your AxioRank workspace (id, name, labels, quarantine + last-used status).No findings

    Why it is in this group

    • The name "axiorank_list_agents" says "list": a word for reading.
    Description, as the server wrote it
    List the active agents in your AxioRank workspace (id, name, labels, quarantine + last-used status). Use this to find an agent's id before calling agent-specific tools. Requires the `agents:read` scope.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • axiorank_list_incidentsList security alerts/incidents in your workspace, newest first, filterable by status (open/acknowledged/resolved/suppressed), severity (low/medium/high/critical) and kind (high_ris…No findings

    Why it is in this group

    • The name "axiorank_list_incidents" says "list": a word for reading.
    Description, as the server wrote it
    List security alerts/incidents in your workspace, newest first, filterable by status (open/acknowledged/resolved/suppressed), severity (low/medium/high/critical) and kind (high_risk/anomaly/auto_response/kill_chain/ml_threat). Requires the `logs:read` scope.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • axiorank_list_ml_assessmentsList your workspace's most recent ML/LLM threat assessments (model verdict, threat class, confidence, recommendation) for tool calls and cards.No findings

    Why it is in this group

    • The name "axiorank_list_ml_assessments" says "list": a word for reading.
    Description, as the server wrote it
    List your workspace's most recent ML/LLM threat assessments (model verdict, threat class, confidence, recommendation) for tool calls and cards. Requires the `logs:read` scope.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • axiorank_list_policiesList the outbound governance policies in your workspace (enabled or not), each with its tool pattern, action (allow/deny/require_approval/redact), risk threshold, priority and enab…No findings

    Why it is in this group

    • The name "axiorank_list_policies" says "list": a word for reading.
    Description, as the server wrote it
    List the outbound governance policies in your workspace (enabled or not), each with its tool pattern, action (allow/deny/require_approval/redact), risk threshold, priority and enabled flag. Requires the `policies:read` scope.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • axiorank_list_threat_intelList external identities (card hosts/keys) flagged across the AxioRank network, with k-anonymity-gated aggregate counts (workspaces, sightings, deny/review, max risk).No findings

    Why it is in this group

    • The name "axiorank_list_threat_intel" says "list": a word for reading.
    Description, as the server wrote it
    List external identities (card hosts/keys) flagged across the AxioRank network, with k-anonymity-gated aggregate counts (workspaces, sightings, deny/review, max risk). This is the shared cross-tenant feed, not your private data. Requires the `logs:read` scope.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • axiorank_search_audit_logsSearch your workspace's governance audit trail, newest first, with filters: decision (allow/deny/hold), source (sdk/mcp), agentId, tool name (substring), minimum risk, and a time w…No findings

    Why it is in this group

    • The name "axiorank_search_audit_logs" says "search": a word for reading.
    Description, as the server wrote it
    Search your workspace's governance audit trail, newest first, with filters: decision (allow/deny/hold), source (sdk/mcp), agentId, tool name (substring), minimum risk, and a time window (ISO `from`/`to`). Payloads are already secret-redacted. Use it to answer questions like "show denied tool calls in the last 24h". Requires the `logs:read` scope.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 1.0.1. Values in angle brackets are yours to fill in.

claude mcp add --transport http axiorank https://app.axiorank.com/api/mcp-server/mcp --header 'Authorization: <your-authorization>'

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__axiorank__axiorank_get_protocol_coverage",
      "mcp__axiorank__axiorank_get_health",
      "mcp__axiorank__axiorank_list_agents",
      "mcp__axiorank__axiorank_get_agent",
      "mcp__axiorank__axiorank_list_policies",
      "mcp__axiorank__axiorank_get_policy",
      "mcp__axiorank__axiorank_search_audit_logs",
      "mcp__axiorank__axiorank_list_incidents",
      "mcp__axiorank__axiorank_get_incident",
      "mcp__axiorank__axiorank_list_threat_intel",
      "mcp__axiorank__axiorank_list_ml_assessments",
      "mcp__axiorank__axiorank_get_usage"
    ],
    "ask": [
      "mcp__axiorank__axiorank_score_tool_call",
      "mcp__axiorank__axiorank_verify_card",
      "mcp__axiorank__axiorank_check_approval",
      "mcp__axiorank__axiorank_create_policy",
      "mcp__axiorank__axiorank_update_policy",
      "mcp__axiorank__axiorank_issue_token",
      "mcp__axiorank__axiorank_create_agent",
      "mcp__axiorank__axiorank_author_detector"
    ],
    "deny": [
      "mcp__axiorank__axiorank_quarantine_agent",
      "mcp__axiorank__axiorank_revoke_agent"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as axiorank. Review it before you use it.