README

Verify the AI agents that reach your TYPO3 site, and enforce the AxioRank verdict inline.

What it is

AI agents now log in, call JSON endpoints, search, and submit forms on TYPO3 sites. This extension registers your site as a website inbound surface in AxioRank and, for each request worth checking, sends one authenticated POST /api/gateway/verify-request and acts on the verdict. It is a thin client: there is no local model and no bundled SDK. The identity check (Web Bot Auth signatures, the known-agent directory, risk scoring) happens in AxioRank.

Because the guard is a PSR-15 middleware in your own request path, it can block an unverified agent in real time, not after the fact.

Features

• PSR-15 middleware on the frontend and backend request stacks.
• Monitor first, then enforce. Enforcement acts only when your AxioRank surface is also enforcing, so a single flag cannot cause an accidental outage.
• Fail-open by design. A verification timeout or outage never blocks a request.
• Effective settings resolve from the environment constant, then per-site configuration, then the global extension configuration.
• A backend module with a connection status, lifetime activity, recent verdicts, and a Test connection button.
• An in-backend Agents module to manage allow, challenge, and block rules and to flip monitor and enforce, using a management-scoped site key.
• Dashboard widgets (agents verified, agents blocked, recent agents) and a Reports status entry.
• Console commands axiorank:selftest and axiorank:prune, both schedulable.
• A <axr:badge /> Fluid view helper for a "Protected by AxioRank" trust badge.
• English and German backend labels.

Install

composer require axiorank/typo3-agent-verification

Then register a website surface in AxioRank, copy its site key (axr_site_...), and set it in one of:

• the AXIORANK_SITE_KEY environment constant (recommended, keeps the key out of the database),
• a per-site value in the Sites module, or
• the global extension configuration under Admin Tools, Settings.

Open the AxioRank backend module and press Test connection. Leave the mode on Monitor until you have watched the verdicts, then switch to Enforce.

What gets verified

Only the traffic worth checking, so ordinary human page views never call out:

• any request carrying Web Bot Auth signature material (always),
• the backend and login, JSON page types, on-site search, and form submissions, each a toggle, and
• any request whose user agent looks like a crawler or AI agent.

Fully page-cached responses served before the middleware are not checked. That is by design: it protects the dynamic surface, which is where agent traffic and risk actually are.

What is sent to AxioRank

For each checked request: the method, host, path, query, user agent, client IP, and the headers that carry the agent's signature. Cookies, the Authorization header, and other credentials are stripped before the request leaves your server.