Welcome
Checkpoint protects your applications from AI agents and automated bots
Checkpoint is a comprehensive AI agent detection and protection platform. It identifies and manages automated traffic on your web applications with enterprise-grade detection, flexible enforcement, and identity-based governance for AI agents.
Why Checkpoint?
- Advanced AI Detection — State-of-the-art algorithms to identify AI agents, bots, and automated browsers
- Flexible Enforcement — Permit, block, redirect, challenge for consent, or require cryptographic identity (
INSTRUCT) — you decide how to handle detected agents - Identity Governance — Control what AI agents can access using KYA-OS (Know Your Agent, Operating System), the open identity protocol that Govern implements; see the Glossary
- Real-time Analytics — Monitor traffic patterns, detection trends, and agent activity
- Privacy First — GDPR compliant with configurable privacy settings
Platform Overview
See Core Concepts for the mental model behind these three pillars — how detection, enforcement, and identity fit together.
Detect
Identify AI agents and bots using client-side or server-side signals. Checkpoint supports multiple detection methods you can use independently or combine.
- Marketing Pixel — No-code, drop-in script tag
- JavaScript Beacon — Full-featured SDK with WebWorker support
Server-side and edge detection are documented with their enforcement counterparts — see Middleware and Gateway below.
Learn more about detection methods →
Enforce
Take action on detected agents with configurable policies. Start in observe mode, then graduate to blocking, redirecting, or challenging when you're confident in your detection settings.
- Gateway Enforcement — Edge-level enforcement via DNS
- Middleware Enforcement — Code-level enforcement in your app
- Policy Configuration — Fine-tune rules and thresholds
Learn more about enforcement →
Govern (KYA-OS)
Control what AI agents can access using identity-based governance. KYA-OS adds authentication, authorization, and consent to AI agent interactions.
- Delegation — Scoped, time-limited access grants
- Tool-Level Permissions — Per-tool scope requirements
- OAuth Integration — Standard OAuth 2.0 flows for agent auth
- Consent Management — User-facing consent pages
Choose Your Integration
Marketing Pixel
GTM-compatible pixel for marketing teams - no coding required
Beacon
Lightweight tracking beacon for any website with WebWorker support
Marketing Pixel
GTM-compatible pixel for marketing teams - no coding required
Beacon
Lightweight tracking beacon for any website with WebWorker support
You can start with one method and layer on more as your needs evolve: most integrations take under 10 lines of code.
All Methods at a Glance
Start with Detect. Detection-only integrations (Pixel, Beacon) log AI agent visits without blocking anything — zero risk, instant visibility — before you decide what to enforce.
| Method | Pillar | Integration | Sees | Overhead | Best For |
|---|---|---|---|---|---|
| Marketing Pixel | Detect | Script tag / GTM | JS-executing browsers | None — async, off-path | No-code, marketing teams |
| Beacon SDK | Detect | npm | JS-executing browsers, richer signals | None — async, non-blocking | SPAs, static sites |
| Gateway | Detect + Enforce | DNS CNAME | Every request to your domain | In-path at the edge | Any origin, zero code changes |
| Middleware | Detect + Enforce | npm (Next.js / Express) | Every request reaching your server | In-request | Server-side, auth routes |
| KYA-OS | Govern | Dashboard or self-host | Authenticated agent identity | In-process | API providers, SaaS platforms |
Methods are composable. You can run Pixel, Middleware, and Govern simultaneously — they share the same dashboard and detections are automatically deduplicated.
Choose by Scenario
Goal: See which AI agents are visiting your site.
Recommended: Marketing Pixel or Gateway (observe mode)
The Pixel deploys through GTM with no code changes. If you want coverage for non-JS agents too, point your DNS at the Gateway instead. Both feed into the same dashboard.
Goal: Detect and block AI agents on server-rendered routes.
Recommended: Middleware (enforce mode) + Beacon for client-side coverage
Middleware protects server routes and API endpoints. Add Beacon on the client for browser-fingerprint signals. Together they cover both surfaces: every request that reaches the server, plus client-side signals from JS-executing browsers.
Goal: Protect API endpoints from unauthorized AI scraping.
Recommended: Gateway or Express Middleware
Gateway works with any backend language via DNS — no SDK needed. If you run Express/Node, the middleware gives you per-route control with access to request context.
Goal: Let verified AI agents access your platform on your terms.
Recommended: Govern (KYA-OS) + Middleware or Gateway for enforcement
Govern handles agent identity, consent, and scoped permissions. Pair it with enforcement so unverified agents are blocked while approved agents get structured access.
Goal: Maximum coverage with multi-layer defense.
Recommended: Gateway + Middleware + Govern
Gateway catches traffic at the edge. Middleware adds server-side analysis with auth context. Govern provides identity verification for approved agents. All three report to the same dashboard with automatic deduplication.
Progressive Adoption
Most teams start with Detect to understand their AI agent traffic — the Pixel or Beacon takes minutes to deploy and carries no risk. Once you see what's hitting your site, switch to Enforce to block unwanted agents. The upgrade is a config change, not a new integration: define your policies in the dashboard, then flip your middleware to enforce mode (or promote your gateway rules from log to a real verdict).
When you're ready to go further, Govern lets you move from "block everything" to "authorize the right agents." Verified agents authenticate, agree to terms, and access only what you permit — turning adversarial traffic into a controlled channel.
Quick Start
Ready to install? Follow the Quick Start Guide to have Checkpoint running in about 5 minutes.
Architecture Overview
Checkpoint uses a multi-layered approach to detect and manage automated traffic:
- Detection Layer — Analyzes requests using user agent, TLS fingerprint, headers, and behavioral signals
- Classification Engine — Classifies traffic as
human,ai_agent,bot, orincomplete_datawith confidence scores (0–100) - Policy Engine — Evaluates enforcement rules (allow lists, deny lists, path rules, thresholds)
- Governance Layer — KYA-OS identity verification, delegation proofs, and scoped access control
- Analytics Layer — Tracks and reports detection metrics with session consolidation
Next Steps
- Core Concepts — The mental model behind detection, enforcement, and identity
- Quick Start — Get up and running in 5 minutes
- Integrations — Server, platform, and analytics integrations for an existing stack
- Cookbooks — Practical, step-by-step guides for common setups
- Dashboard — Navigate the Checkpoint dashboard
- API Reference — Complete REST API documentation
Support
- Email: kya@vouched.id
- Issues: kya+issues@vouched.id