Checkpoint is a comprehensive AI agent detection and protection platform. It identifies and manages automated traffic on your web applications with enterprise-grade detection, flexible enforcement, and identity-based governance for AI agents.

Why Checkpoint?

Advanced AI Detection — State-of-the-art algorithms to identify AI agents, bots, and automated browsers
Flexible Enforcement — Permit, block, redirect, challenge for consent, or require cryptographic identity (INSTRUCT) — you decide how to handle detected agents
Identity Governance — Control what AI agents can access using KYA-OS (Know Your Agent, Operating System), the open identity protocol that Govern implements; see the Glossary
Real-time Analytics — Monitor traffic patterns, detection trends, and agent activity
Privacy First — GDPR compliant with configurable privacy settings

Platform Overview

See Core Concepts for the mental model behind these three pillars — how detection, enforcement, and identity fit together.

Detect

Identify AI agents and bots from client-side or server-side signals. Start here: the Pixel and Beacon log visits without blocking anything.

Enforce

Apply Cedar policies at the edge (Gateway) or in your app (Middleware). Begin in observe mode, then graduate to blocking, redirecting, or challenging.

Govern (KYA-OS)

Authorize verified agents with cryptographic identity, scoped delegations, tool-level permissions, and user consent.

Core Concepts

Detections versus verdicts, the trust ladder, observe-first rollout, and where identity comes in.

Choose Your Integration

Every method reports to the same dashboard, and detections are deduplicated across them, so you can start with one and layer on more as your needs evolve. Most integrations take under 10 lines of code.

Marketing Pixel

No-code script tag or Google Tag Manager template. Detect only, zero risk.

Beacon SDK

npm SDK with richer browser signals and optional Web Worker offload. Detect only.

Gateway

Point a DNS CNAME at the edge. Sees every request to your domain with no code changes.

Middleware

Next.js, Express, or ASP.NET middleware. Sees every request that reaches your server.

KYA-OS

Dashboard-deployed or self-hosted identity for API providers and SaaS platforms.

REST API

Call detection directly from any language.

All Methods at a Glance

Start with Detect. Detection-only integrations (Pixel, Beacon) log AI agent visits without blocking anything — zero risk, instant visibility — before you decide what to enforce.

Method	Pillar	Integration	Sees	Overhead	Best For
Marketing Pixel	Detect	Script tag / GTM	JS-executing browsers	None — async, off-path	No-code, marketing teams
Beacon SDK	Detect	npm	JS-executing browsers, richer signals	None — async, non-blocking	SPAs, static sites
Gateway	Detect + Enforce	DNS CNAME	Every request to your domain	In-path at the edge	Any origin, zero code changes
Middleware	Detect + Enforce	npm (Next.js / Express)	Every request reaching your server	In-request	Server-side, auth routes
KYA-OS	Govern	Dashboard or self-host	Authenticated agent identity	In-process	API providers, SaaS platforms

Methods are composable. You can run Pixel, Middleware, and Govern simultaneously — they share the same dashboard and detections are automatically deduplicated.

Choose by Scenario

Goal: See which AI agents are visiting your site.

Recommended: Marketing Pixel or Gateway (observe mode)

The Pixel deploys through GTM with no code changes. If you want coverage for non-JS agents too, point your DNS at the Gateway instead. Both feed into the same dashboard.

Pixel setup → · Gateway setup →

Progressive Adoption

Most teams start with Detect to understand their AI agent traffic — the Pixel or Beacon takes minutes to deploy and carries no risk. Once you see what's hitting your site, switch to Enforce to block unwanted agents. The upgrade is a config change, not a new integration: define your policies in the dashboard, then flip your middleware to enforce mode (or promote your gateway rules from log to a real verdict).

When you're ready to go further, Govern lets you move from "block everything" to "authorize the right agents." Verified agents authenticate, agree to terms, and access only what you permit — turning adversarial traffic into a controlled channel.

Quick Start

Ready to install? Follow the Quick Start Guide to have Checkpoint running in about 5 minutes.

Architecture Overview

Checkpoint uses a multi-layered approach to detect and manage automated traffic:

Detection Layer — Analyzes requests using user agent, TLS fingerprint, headers, and behavioral signals
Classification Engine — Classifies traffic as human, ai_agent, bot, or incomplete_data with confidence scores (0–100)
Policy Engine — Evaluates enforcement rules (allow lists, deny lists, path rules, thresholds)
Governance Layer — KYA-OS identity verification, delegation proofs, and scoped access control
Analytics Layer — Tracks and reports detection metrics with session consolidation

Next Steps

Core Concepts — The mental model behind detection, enforcement, and identity
Quick Start — Get up and running in 5 minutes
Integrations — Server, platform, and analytics integrations for an existing stack
Cookbooks — Practical, step-by-step guides for common setups
Dashboard — Navigate the Checkpoint dashboard
API Reference — Complete REST API documentation

Support

Email: kya@vouched.id
Issues: kya+issues@vouched.id

Welcome