axiorank
AxioRank Agent Verification verifies the AI agents that reach your site's REST, JSON:API, admin, login, and other dynamic endpoints. It is a thin client of the AxioRank inbound verify endpoint: each protected request is forwarded as one authenticated POST, and the verdict is applied in Drupal. There is no local model to run.
How it works:
A request subscriber checks only the traffic worth checking: signed requests (Web Bot Auth), enabled sensitive endpoints, or bot-like user agents. Ordinary anonymous page views never call out.
Verdicts are scored by AxioRank and returned as allow, challenge, or block.
Start in monitor mode, where nothing is blocked and every verdict is logged in your AxioRank dashboard. Then switch to enforce to apply block (403) and challenge (401) verdicts.
It fails open: if AxioRank is unreachable, requests are allowed, so a verification outage never takes your site down.
Requirements: an AxioRank account and a website surface site key.