Introduction
Checkpoint protects your applications from AI agents and automated bots
Checkpoint is a comprehensive AI agent detection and protection platform. It identifies and manages automated traffic on your web applications with enterprise-grade detection, flexible enforcement, and identity-based governance for AI agents.
- Can
- payment:create
- Limit
- up to $20 per order
- Expires
- in 8 min
Get started
Quickstart
Install the CLI, run setup, and watch the first visit arrive. About five minutes, step by step.
Let your agent set it up
One command gives Claude Code, Cursor, or any coding agent the Checkpoint skill. It does the setup and hands you only the steps that need your sign-in or approval.
Installation
Every way to install the kya-os CLI, plus each Checkpoint SDK by hand if you'd rather not use it.
CLI reference
Every kya-os command and flag, how --project resolves, and the files the CLI reads and writes.
Why Checkpoint?
- Advanced AI Detection: State-of-the-art algorithms to identify AI agents, bots, and automated browsers
- Flexible Enforcement: Permit, block, redirect, challenge for consent, or require cryptographic identity (
INSTRUCT); you decide how to handle detected agents - Identity Governance: Control what AI agents can access using KYA-OS (Know Your Agent — Operating System), the open identity protocol that Govern implements; see the Glossary
- Real-time Analytics: Monitor traffic patterns, detection trends, and agent activity
- Privacy Controls: IP anonymization, URL redaction, and Do Not Track support on the Pixel and Beacon. Both store the full IP address unless you turn anonymization on
Platform Overview
See Core Concepts for the mental model behind these three pillars: how detection, enforcement, and identity fit together.
Detect
Identify AI agents and bots from client-side or server-side signals. Start here: the Pixel and Beacon log visits without blocking anything.
Enforce
Apply Cedar policies at the edge (Gateway) or in your app (Middleware). Begin in observe mode, then graduate to blocking, redirecting, or challenging.
Govern (KYA-OS)
Authorize verified agents with cryptographic identity, scoped delegations, tool-level permissions, and user consent.
Core Concepts
Detections versus verdicts, the trust ladder, observe-first rollout, and where identity comes in.
Choose Your Integration
Every method reports to the same dashboard, so you can start with one and layer on more as your needs evolve. Detections are not deduplicated across methods: each detection surface writes its own rows, so a request two surfaces both report is counted twice (see Detection Semantics). Most integrations take under 10 lines of code.
Marketing Pixel
No-code script tag, directly or through Google Tag Manager. Detect only, zero risk.
Beacon SDK
npm SDK with richer browser signals and optional Web Worker offload. Detect only.
Gateway
Point a DNS CNAME at the edge. Sees every request to your domain with no code changes.
Middleware
Next.js, Express, ASP.NET, or Java middleware. Sees every request that reaches your server.
KYA-OS
Dashboard-deployed or self-hosted identity for API providers and SaaS platforms.
REST API
Call detection directly from any language.
All Methods at a Glance
Start with Detect. Detection-only integrations (Pixel, Beacon) log AI agent visits without blocking anything (zero risk, instant visibility) before you decide what to enforce.
Methods are composable. You can run Pixel, Middleware, and Govern simultaneously. They share the same dashboard. Detections are not deduplicated: Pixel and Middleware each write their own rows, so count each surface separately.
Choose by Scenario
Goal: See which AI agents are visiting your site.
Recommended: Marketing Pixel or Gateway (observe mode)
The Pixel deploys through GTM with no code changes. If you want coverage for non-JS agents too, point your DNS at the Gateway instead. Both feed into the same dashboard.
Progressive Adoption
Most teams start with Detect to understand their AI agent traffic: the Pixel or Beacon takes minutes to deploy and carries no risk. Once you see what's hitting your site, switch to Enforce to block unwanted agents. The upgrade is a config change, not a new integration: define your policies in the dashboard, then flip your middleware to enforce mode (or promote your gateway rules from log to a real verdict).
When you're ready to go further, Govern lets you move from "block everything" to "authorize the right agents." Verified agents authenticate, agree to terms, and access only what you permit, turning adversarial traffic into a controlled channel.
Quick Start
Ready to install? Follow the Quick Start Guide to have Checkpoint running in about 5 minutes.
Architecture Overview
Checkpoint uses a multi-layered approach to detect and manage automated traffic:
- Detection Layer: Analyzes requests using user agent, TLS fingerprint, headers, and behavioral signals
- Classification Engine: Classifies traffic as
human,ai_agent,bot, orincomplete_datawith confidence scores (0–100) - Policy Engine: Evaluates enforcement rules (allow lists, deny lists, path rules, thresholds)
- Governance Layer: KYA-OS identity verification, delegation proofs, and scoped access control
- Analytics Layer: Tracks and reports detection metrics with session consolidation
Next Steps
- Core Concepts: The mental model behind detection, enforcement, and identity
- Quick Start: Get up and running in 5 minutes
- Integrations: Server, platform, and analytics integrations for an existing stack
- Cookbooks: Practical, step-by-step guides for common setups
- Dashboard: Navigate the Checkpoint dashboard
- API Reference: Complete REST API documentation
Support
- Email: kya@vouched.id
- Issues: kya+issues@vouched.id