Apache-2.0 · zero dependencies · on npm

Let verified agents into your platform.

Agents welcome. Free forever. When an AI agent arrives to post, buy, or call your API, verify who it is and what it's allowed to do, then welcome it in or turn it away. Drop-in, runs in your own backend.

$npm install axis-platform-sdk

read the quickstart

Gate a route. One import, one line.

node / express

import { axisGate } from 'axis-platform-sdk/express'

app.post('/comments',
  axisGate({ audience, requireScopes: ['content:comment'] }),
  (req, res) => res.json({ by: req.axis.agent_id }))

cloudflare worker

import { axisGate, denialResponse } from 'axis-platform-sdk'

const gate = axisGate({ audience, requireScopes: ['content:comment'] })
// in fetch(): const v = await gate(request)

Prove it in one minute. The starter ships a smoke test.

terminal

$ git clone https://github.com/MachinesOfDesire/axis-platform-sdk
$ cd axis-platform-sdk/templates/node-express && npm install && npm run smoke
PASS — no AIT -> 401 no_token
PASS — invalid AIT -> 403 denied
All checks passed.

Verify identity

Signature, revocation, and delegation chain, checked by the public registry.

Check the permission

Match the action against the agent's proven scope, not what its token claims.

Turn bad actors away

Block one agent or a whole operator at runtime, with no redeploy.

Zero infra

One outbound HTTPS call. No database, no key from us, nothing to host.

Identity is the floor. AXIS gates on what stands above it. Anyone can mint a keypair for an agent. AXIS tells you who is accountable for it: every agent traces to an operator verified at email, domain, or business (KYB) level, and every permission is an operator-signed, time-boxed delegation that can only narrow, never widen. Require the accountability you trust: minTier: 'kyb_business'

Self-host, day one. The SDK runs entirely in your own backend, everything you need to launch today. alpha A cloud-hosted version (hosted console, one activity log across all your agents, and independent audit-grade retention) is in alpha now.

Give your agent an identity platforms can verify.

any MCP client (claude, cursor, …)

{ "mcpServers": { "axis": {
  "command": "npx", "args": ["axis-agent-mcp"]
} } }

operator cli

$ axis grant content:comment --ttl 30
$ axis audit --tail 20
$ axis revoke --all

Keys stay home

Ed25519 keys are generated on your machine and held in the OS keychain. No tool ever returns them.

One-click onboarding

The agent surfaces a signup link; you sign in and it's registered. No platform needed to start.

You hold the leash

Grant, require approval, or revoke per scope. A local dashboard when you'd rather click than type.

Signed audit log

Every token minted and delegation signed is recorded locally, append-only.

See it in production. An example integration built on AXIS runs this whole loop on live websites today: verified agents comment, site owners approve and revoke. See the example →