Local MCP capabilities provider for Expo
Nothing to run from here
AxioRank — Agent Firewall is installed from its publisher's own source and answers where it runs, so this marketplace is not in the path of a single call. There is no address here to send one to, and a panel that pretended otherwise would be showing you an answer we made up. Install it and call it from your own client — the Installation tab has the entry for each one.
22
tools declared
—
trust score
remote
at its publisher
—
calls last 7d
What it does
Security gateway for AI agents: score tool calls, verify agent cards, enforce policy, audit.
Quickstart
# 1 — add it to Claude Code
claude mcp add --scope user --transport http axiorank-agent-firewall-mcp https://app.axiorank.com/api/mcp-server/mcp
# 2 — ask your agent for something these tools do
# axiorank_score_tool_call, axiorank_verify_card, axiorank_check_approval and 19 more
AxioRank — Agent Firewall costs nothing on mcprush: there is no plan to choose here, no cap to set and nothing mcprush can bill you for.
Publishernot claimed
AAAll 1 server
app.axiorank.com1 server
1 category
Collected from a public index. Nobody has claimed this account, so nothing here was written by its author — claim it if it is yours.
Installation
Where are you running it?
Every route below installs the same thing and ends at the same approval screen. Nothing here runs on your machine and nothing runs on ours: this server answers at its publisher’s own address, and what you install is the connection straight to it.
Claude Codedeclared by this listing
This is a public server: it answers at its publisher’s own address and this marketplace is not in the path. Claude Code registers it in one command; --scope user makes it available in every project. The transport below is http, as the publisher's own manifest declares it.
claude mcp add --scope user --transport http axiorank-agent-firewall-mcp https://app.axiorank.com/api/mcp-server/mcpReconnect, or start a new session, and the tools appear in the model’s tool list.
Free on mcprush, and it answers at its publisher’s own address: this marketplace is not in the path, so there is no key of ours to hold and no card to add.
What it writes
One config entry pointing straight at the publisher’s own address — this marketplace is not in the path, and nothing from this listing executes on your machine.
What you approve
22 tools, with what each one reads, writes and reaches shown before you agree — the same list on every route above. Read the tool surface.
Tool surface
What the model actually sees. Descriptions are diffed on every release — see version history.
Inspect a proposed agent tool call BEFORE executing it. AxioRank scores its risk (0–100), runs content inspection (secrets, PII, destructive ops, prompt-injection, egress), applies your policies, records an audit log, and returns a decision: allow, deny, or hold. On hold, a human must approve. Poll axiorank_check_approval with the returned approvalId. Call this in your tool-use loop an
| Parameter | Type | Required | Notes |
|---|---|---|---|
| tool | string | yes | — |
| arguments | object | no | — |
| phase | string | no | — |
| resultText | string | no | — |
| promptText | string | no | — |
| completionText | string | no | — |
| context | string | no | — |
| costUsd | number | no | — |
| model | string | no | — |
| inputTokens | integer | no | — |
| outputTokens | integer | no | — |
| durationMs | integer | no | — |
| intent | string | no | — |
| taintHandle | string | no | — |
| passport | boolean | no | — |
| source | string | no | — |
| traceId | string | no | — |
| stepIndex | integer | no | — |
| sessionId | string | no | — |
| metadata | object | no | — |
Vet a remote agent or tool's identity card (A2A Agent Card, MCP server card, OAuth metadata, x402, …) BEFORE connecting to it. Supply EITHER url (AxioRank fetches the card) OR an inline document. AxioRank verifies signatures, scores supply-chain risk, folds in cross-tenant threat intel, and returns allow / review / deny with the resolved identity, capabilities and auth. Use it as a conne
| Parameter | Type | Required | Notes |
|---|---|---|---|
| url | string | no | — |
| document | no | — | |
| protocol | string | no | — |
Poll the verdict of a held (hold) tool call. Pass the approvalId returned by axiorank_score_tool_call. Blocks briefly server-side and returns as soon as an operator approves/denies; otherwise returns the still-pending status so you can call again. Requires the gateway:write scope and the same agent key that made the original call.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| approvalId | string | yes | The approvalId returned by axiorank_score_tool_call when the decision was 'hold'. |
List the agent-interop protocols AxioRank can govern (A2A, MCP, OAuth, x402, DIDs, robots.txt/llms.txt, AP2, …), grouped into six planes, each with coverage status (live/beta/planned) and direction (inbound/outbound/both). Use this to discover what AxioRank speaks before wiring up card verification or inbound bot management.
No parameter schema on file.
Liveness/readiness probe for the AxioRank control plane (API + database reachability). Returns status: ok|degraded.
No parameter schema on file.
List the active agents in your AxioRank workspace (id, name, labels, quarantine + last-used status). Use this to find an agent's id before calling agent-specific tools. Requires the agents:read scope.
No parameter schema on file.
Fetch one agent's posture (quarantine state, labels, last-used, revocation) by id, scoped to your workspace. Requires the agents:read scope.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| agentId | string | yes | The agent's UUID (from axiorank_list_agents). |
Reversible kill switch: quarantine an agent so the gateway DENIES all of its tool calls, or release it. Set quarantine: false to restore. Requires the agents:write scope.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| agentId | string | yes | The agent's UUID (from axiorank_list_agents). |
| quarantine | boolean | yes | true = quarantine (deny all its calls); false = release. |
Permanently revoke an agent: its API keys stop authenticating immediately (incident response). Irreversible. Issue a new agent to restore access. Its audit history is kept. Requires the agents:write scope. Prefer axiorank_quarantine_agent for a reversible pause.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| agentId | string | yes | The agent's UUID (from axiorank_list_agents). |
List the outbound governance policies in your workspace (enabled or not), each with its tool pattern, action (allow/deny/require_approval/redact), risk threshold, priority and enabled flag. Requires the policies:read scope.
No parameter schema on file.
Fetch one outbound policy by id, scoped to your workspace. Requires the policies:read scope.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| policyId | string | yes | The policy's UUID (from axiorank_list_policies). |
Create an outbound governance policy. It is created DISABLED so an LLM can never arm enforcement unattended. Review it (axiorank_get_policy) then enable it with axiorank_update_policy. toolPattern is a glob over tool names; action is allow / deny / require_approval / redact (redact masks PII in a model completion). Requires the policies:write scope.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| name | string | yes | — |
| toolPattern | string | yes | — |
| action | string | yes | — |
| riskThreshold | no | — | |
| signalCategory | no | — | |
| context | no | — | |
| priority | integer | no | — |
| enforcementMode | string | no | — |
Update an existing policy: enable/disable it, rename it, or change its priority. (Other fields are edited in the dashboard.) Requires the policies:write scope.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| policyId | string | yes | The policy's UUID (from axiorank_list_policies). |
| enabled | boolean | no | Arm (true) or disarm (false) the policy. |
| name | string | no | — |
| priority | integer | no | Lower runs first; ties broken by creation order. |
Search your workspace's governance audit trail, newest first, with filters: decision (allow/deny/hold), source (sdk/mcp), agentId, tool name (substring), minimum risk, and a time window (ISO from/to). Payloads are already secret-redacted. Use it to answer questions like "show denied tool calls in the last 24h". Requires the logs:read scope.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| decision | string | no | — |
| source | string | no | — |
| agentId | string | no | — |
| tool | string | no | Case-insensitive substring of the tool name. |
| minRisk | integer | no | — |
| from | string | no | ISO timestamp: inclusive lower bound on created_at. |
| to | string | no | ISO timestamp: exclusive upper bound on created_at. |
| limit | integer | no | — |
List security alerts/incidents in your workspace, newest first, filterable by status (open/acknowledged/resolved/suppressed), severity (low/medium/high/critical) and kind (high_risk/anomaly/auto_response/kill_chain/ml_threat). Requires the logs:read scope.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| status | string | no | — |
| severity | string | no | — |
| kind | string | no | — |
| limit | integer | no | — |
Fetch the kill-chain finding behind an alert (the multi-step attack pattern, severity, and the contributing tool-call ids) by alert id. Returns null evidence for a non-kill-chain alert. Requires the logs:read scope.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| alertId | string | yes | The alert/incident UUID (from axiorank_list_incidents). |
List external identities (card hosts/keys) flagged across the AxioRank network, with k-anonymity-gated aggregate counts (workspaces, sightings, deny/review, max risk). This is the shared cross-tenant feed, not your private data. Requires the logs:read scope.
No parameter schema on file.
List your workspace's most recent ML/LLM threat assessments (model verdict, threat class, confidence, recommendation) for tool calls and cards. Requires the logs:read scope.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| limit | integer | no | — |
Report this billing period's usage for your workspace: plan tier, governed events used vs the monthly limit, and ML assessments used. Requires the logs:read scope.
No parameter schema on file.
Mint a short-lived, scoped axr_tok_… access token for an existing agent. This is the Zero-Trust credential the agent sends as Authorization: Bearer <token>. It expires within the hour and cannot be replayed afterwards. Durable static keys are issued in the dashboard, not here. Requires the keys:write scope.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| agentId | string | yes | The agent's UUID (from axiorank_list_agents). |
| scopes | array | no | Operational scopes for the token (gateway:write, cards:verify, logs:read). |
| ttlSeconds | integer | no | Token lifetime in seconds (60–3600). Defaults to 900 (15 min). |
Create a new agent in your workspace and return a SHORT-LIVED bootstrap token to start using it immediately (no durable secret is emitted). For long-term auth, add a static key or a federation binding in the dashboard. Requires the agents:write scope.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| name | string | yes | — |
| description | string | no | — |
| labels | array | no | — |
| tokenScopes | array | no | Operational scopes for the token (gateway:write, cards:verify, logs:read). |
| ttlSeconds | integer | no | Token lifetime in seconds (60–3600). Defaults to 900 (15 min). |
Describe a risk in plain English and AxioRank's AI proposes a custom content detector (regex or keyword) and SAVES it DISABLED for your review. An LLM never arms detection unattended. Outbound content categories only (secret/pii/destructive/injection/egress). Requires the policies:write scope and an AI-assessments-enabled plan (Team+).
| Parameter | Type | Required | Notes |
|---|---|---|---|
| description | string | yes | What to detect, e.g. 'flag AWS secret access keys in tool arguments'. |
Free
$0 forever
- Every tool — any call limit is its publisher’s, not ours
- No card, and mcprush charges nothing for it
- Runs at its publisher’s own address — this marketplace is not in the path
- Nothing to cap, because mcprush bills nothing
What counts against your monthly calls
| Tool | Unit | Calls used | Out of the allowance |
|---|
Nothing here is billable: mcprush charges nothing to install AxioRank — Agent Firewall or to call it, at any volume.
Call allowance · this installenforced at the gateway
Monthly allowance, in calls
—
—
Alert at 80% · then the tool returns a normal MCP error
Used this month: —
—Grade not published
No rule-by-rule report on file for this release
Two independent axes, because powerful and malicious are different questions. The grade is threat only. The capability level is blast radius, and it is never a penalty on the grade — it is priced as one subtract-only term in the score, where you can see it.
This listing is an address its publisher runs, and you connect to it directly — this marketplace is not in the path. The scanner reads packages and public source, and an address is neither. So there is no grade — not a withheld one, an unmeasured one.
Release history
This is an address its publisher runs: which release it serves is theirs to choose, so there is nothing here to pin. The history below is for reading; the current release on file is 1.0.1.
1.0.1
undated
latestNo release note was published with this version.
—
no reviews yet
Who can review
One review per account, from a signed-in account that does not publish this listing. Nothing else is asked — you can say what you think before you install it. Publishers can reply once per review, and a review can be edited or deleted by whoever wrote it.
Sign in to write one
Any signed-in account that does not publish AxioRank — Agent Firewall can review it, once — before installing it or after. A review from an account that has installed it is marked as one.
No reviews yet
Nobody has reviewed this listing. The rating on the card is the mean of the reviews written here and nothing else, so there is no rating until somebody writes the first — which takes a signed-in account that does not publish it, and nothing else.