Choose Your Integration
Pick the right Checkpoint integration for your stack — Detect traffic, Enforce policies, or Govern AI agent access
Checkpoint offers three approaches to managing AI agent traffic: Detect (observe), Enforce (block), and Govern (authorize). You can start with one and layer on more as your needs evolve — most integrations take under 10 lines of code.
All Methods at a Glance
| Method | Pillar | Integration | Latency | Best For |
|---|---|---|---|---|
| Marketing Pixel | Detect | Script tag / GTM | Async | No-code, marketing teams |
| Beacon SDK | Detect | npm | < 5 ms | SPAs, static sites |
| Gateway | Detect + Enforce | DNS CNAME | ~1–5 ms | Any origin, zero code changes |
| Middleware | Detect + Enforce | npm (Next.js / Express) | ~5–10 ms | Server-side, auth routes |
| MCP-I | Govern | Dashboard or self-host | In-process | API providers, SaaS platforms |
Detect — Understand Your Traffic
Start here. Detect mode logs AI agent visits without blocking anything — zero risk, instant visibility.
| Method | How It Works | Coverage | Setup |
|---|---|---|---|
| Marketing Pixel | GTM tag fires on page load | ~85% | No code — GTM only |
| Beacon SDK | npm package with WebWorker offloading | ~95% | npm install + 3 lines |
| Middleware (detect mode) | Server-side analysis, logging only | ~98% | npm install + middleware config |
| Gateway (detect mode) | DNS-level inspection, logging only | ~98% | DNS CNAME change |
Enforce — Protect Your Application
Enforcement lets you block, challenge, or rate-limit AI agents based on policies you define in the dashboard.
Gateway
DNS CNAME — zero application code
- Works with any origin (Node, Python, Go, static)
- Edge enforcement at ~1–5 ms
- No deploy required to update policies
Middleware
npm package — full server-side control
- Next.js and Express SDKs
- Access to auth, session, and request context
- Custom response logic per route
Both methods share the same policy configuration — switch from detect to enforce by changing a single setting.
Govern — Authorize Verified AI Agents
Govern is for API providers and SaaS platforms that want to give verified AI agents controlled access instead of blocking them outright. Powered by the MCP-I protocol, it lets you define what agents can do, how they authenticate, and what data they can reach.
| Auth Method | Use Case |
|---|---|
| Consent Only | Low-risk public data — agent agrees to terms |
| OAuth | Delegated access with scoped permissions |
| Custom | Your existing auth system (API keys, JWTs) |
| Credentials | Service-to-service with shared secrets |
Deploy via one-click in the Dashboard or self-host for full control. See the migration guide if you already have an MCP server.
Choose by Scenario
Goal: See which AI agents are visiting your site.
Recommended: Marketing Pixel or Gateway (detect mode)
The Pixel deploys through GTM with no code changes. If you want coverage for non-JS agents too, point your DNS at the Gateway instead. Both feed into the same dashboard.
Goal: Detect and block AI agents on server-rendered routes.
Recommended: Middleware (enforce mode) + Beacon for client-side coverage
Middleware protects server routes and API endpoints. Add Beacon on the client for browser-fingerprint signals. Together they cover ~99% of agent traffic.
Goal: Protect API endpoints from unauthorized AI scraping.
Recommended: Gateway or Express Middleware
Gateway works with any backend language via DNS — no SDK needed. If you run Express/Node, the middleware gives you per-route control with access to request context.
Goal: Let verified AI agents access your platform on your terms.
Recommended: Govern (MCP-I) + Middleware or Gateway for enforcement
Govern handles agent identity, consent, and scoped permissions. Pair it with enforcement so unverified agents are blocked while approved agents get structured access.
Goal: Maximum coverage with multi-layer defense.
Recommended: Gateway + Middleware + Govern
Gateway catches traffic at the edge. Middleware adds server-side analysis with auth context. Govern provides identity verification for approved agents. All three report to the same dashboard with automatic deduplication.
Progressive Adoption
Most teams start with Detect to understand their AI agent traffic — the Pixel or Beacon takes minutes to deploy and carries no risk. Once you see what's hitting your site, switch to Enforce to block unwanted agents. The upgrade is a config change, not a new integration: flip your middleware or gateway from detect to enforce mode and define your policies in the dashboard.
When you're ready to go further, Govern lets you move from "block everything" to "authorize the right agents." Verified agents authenticate, agree to terms, and access only what you permit — turning adversarial traffic into a controlled channel.
Quick Reference
| If you want to... | Use this | Link |
|---|---|---|
| See AI traffic with no code changes | Marketing Pixel | Setup → |
| Detect agents in a SPA or static site | Beacon SDK | Setup → |
| Block agents at the edge (any backend) | Gateway | Setup → |
| Block agents in Next.js or Express | Middleware | Setup → |
| Define block/allow rules | Policies | Configure → |
| Let verified agents access your API | Govern (MCP-I) | Overview → |
| Deploy an MCP-I server | Govern Deployment | Guide → |
| Migrate an existing MCP server | Govern Migration | Guide → |
Methods are composable. You can run Pixel, Middleware, and Govern simultaneously — they share the same dashboard and detections are automatically deduplicated.
Next Steps
- Quick Start — Deploy your first integration in 5 minutes
- Detect — Deep dive into detection methods
- Enforce — Set up active enforcement
- Govern — Authorize AI agents with MCP-I
- Dashboard — Monitor and analyze agent traffic