Checkpoint.AspNet
1.14.0
See the version list below for details.
dotnet add package Checkpoint.AspNet --version 1.14.0
NuGet\Install-Package Checkpoint.AspNet -Version 1.14.0
<PackageReference Include="Checkpoint.AspNet" Version="1.14.0" />
<PackageVersion Include="Checkpoint.AspNet" Version="1.14.0" />
<PackageReference Include="Checkpoint.AspNet" />
paket add Checkpoint.AspNet --version 1.14.0
#r "nuget: Checkpoint.AspNet, 1.14.0"
#:package Checkpoint.AspNet@1.14.0
#addin nuget:?package=Checkpoint.AspNet&version=1.14.0
#tool nuget:?package=Checkpoint.AspNet&version=1.14.0
Checkpoint for .NET
AI agent detection and policy enforcement for ASP.NET Core (.NET 8, 9 and 10) and .NET Framework (4.6.2 to 4.8.1). Every request is classified by the embedded KYA-OS engine, the same Rust engine the Checkpoint gateway and the TypeScript and Java SDKs run, compiled to WebAssembly.
Packages
| Package | What it is |
|---|---|
KyaOs.Checkpoint |
Install this one. NuGet resolves the right adapter for your project's target framework. |
Checkpoint.AspNetCore |
ASP.NET Core middleware for .NET 8 and later. |
Checkpoint.AspNet |
A System.Web IHttpModule for .NET Framework 4.6.2 and later: IIS, MVC 5, Web API 2 and Web Forms. |
Checkpoint.Core |
The engine host and detection API that both adapters share. |
Install
dotnet add package KyaOs.Checkpoint
Get your project ID and API key from Installations in the Checkpoint dashboard.
ASP.NET Core
Set the credentials in appsettings.json:
{
"Checkpoint": {
"ProjectId": "your_project_id",
"ApiKey": "your_api_key"
}
}
Register Checkpoint in Program.cs, before routing and authorization:
using Checkpoint.AspNetCore.Extensions;
using Checkpoint.Core.Configuration;
var builder = WebApplication.CreateBuilder(args);
builder.Services.AddCheckpoint(options =>
{
options.ProjectId = builder.Configuration["Checkpoint:ProjectId"];
options.ApiKey = builder.Configuration["Checkpoint:ApiKey"];
options.OnAgentDetected = DetectedAction.Block;
});
var app = builder.Build();
app.UseCheckpoint();
app.UseRouting();
app.UseAuthorization();
app.MapControllers();
app.Run();
.NET Framework
Add the module to Web.config; no code changes are needed:
<configuration>
<appSettings>
<add key="Checkpoint:ProjectId" value="your_project_id" />
<add key="Checkpoint:ApiKey" value="your_api_key" />
<add key="Checkpoint:OnAgentDetected" value="Block" />
</appSettings>
<system.webServer>
<modules runAllManagedModulesForAllRequests="true">
<add name="Checkpoint"
type="Checkpoint.AspNet.CheckpointModule, Checkpoint.AspNet" />
</modules>
<validation validateIntegratedModeConfiguration="false" />
</system.webServer>
</configuration>
The module needs a 64-bit host process. On a 32-bit host the site still serves traffic, but detection is unavailable.
Observe or enforce
OnAgentDetected defaults to DetectedAction.Log, which is observe mode: every request is classified and reported, and the SDK blocks nothing on its own.
Block, Redirect, Challenge and Instruct enforce.
Once ProjectId and ApiKey are set, the project's dashboard policy applies as well.
Without them, Checkpoint runs in local detection-only mode and logs one warning at startup naming the missing setting.
Documentation
- Setup, configuration and troubleshooting: https://kya.vouched.id/docs/integrations/dotnet
- Release history: https://github.com/Know-That-Ai/checkpoint/blob/main/packages/checkpoint-dotnet/CHANGELOG.md
Licensed under MIT.
| Product | Versions Compatible and additional computed target framework versions. |
|---|---|
| .NET Framework | net462 is compatible. net463 was computed. net47 was computed. net471 was computed. net472 was computed. net48 was computed. net481 was computed. |
-
.NETFramework 4.6.2
- Checkpoint.Core (>= 1.14.0)
NuGet packages (1)
Showing the top 1 NuGet packages that depend on Checkpoint.AspNet:
| Package | Downloads |
|---|---|
|
KyaOs.Checkpoint
AI agent detection and policy enforcement for any .NET HTTP server. Install this metapackage and NuGet automatically pulls in the right adapter for your runtime: Checkpoint.AspNetCore on modern .NET (ASP.NET Core 8+), or Checkpoint.AspNet on classic .NET Framework 4.6.2+ (System.Web / IIS). Same WASM-backed Rust detection engine on both stacks — same patterns, same scoring, same updates. |
GitHub repositories
This package is not used by any popular GitHub repositories.
| Version | Downloads | Last Updated |
|---|---|---|
| 1.15.0 | 65 | 10/22/2026 |
| 1.14.0 | 55 | 10/21/2026 |
| 1.13.0 | 90 | 10/20/2026 |
| 1.12.0 | 121 | 10/13/2026 |
| 1.11.9 | 128 | 10/9/2026 |
| 1.11.8 | 171 | 9/30/2026 |
| 1.11.7 | 5,763 | 9/20/2026 |
| 1.11.6 | 111 | 9/20/2026 |
| 1.11.5 | 133 | 9/19/2026 |
| 1.11.4 | 145 | 9/18/2026 |
| 1.11.3 | 124 | 9/17/2026 |
| 1.11.2 | 129 | 9/16/2026 |
| 1.11.1 | 116 | 9/16/2026 |
| 1.11.0 | 130 | 9/16/2026 |
| 1.10.0 | 123 | 9/15/2026 |
| 1.9.0 | 147 | 9/7/2026 |
| 1.8.1 | 163 | 9/3/2026 |
| 1.7.7 | 199 | 8/10/2026 |
| 1.7.6 | 132 | 8/7/2026 |
| 1.7.5 | 161 | 8/5/2026 |
1.14.0
Breaking changes:
- Changed: `HttpProofClaim.ResourceDid` is now `HttpProofClaim.Scope`, the engine's claim scope (the resource DID, or `authority:<host[:port]>`).
A custom `IHttpProofReplayStore` needs the rename. Per the SDK release policy this ships as a minor. (#6424)
- Changed: The embedded engine (0.4.0) refuses MCP-I envelopes and the legacy Layer 2 delegation headers outside the native propagation lane with `kyaos/unsupported-carriage` (403). The native propagation and agent credential lanes are unchanged. (#6544)
- Removed: `PatternAgentDetector`, `KnownAgents`, `BrowserPostureProofVerifier` and `BrowserPostureProof` from `Checkpoint.Core`.
Nothing in the SDK used them: `AddCheckpoint` registers `WasmAgentDetector`, the engine makes every detection decision, and no adapter verified DPoP posture proofs.
Code that constructed these types directly no longer compiles; use `WasmAgentDetector` (or `IAgentDetector` from DI) for detection.
No published `Checkpoint.AspNetCore`, `Checkpoint.AspNet` or `KyaOs.Checkpoint` version references them, so running an existing adapter on this Core is unaffected. (#6251)
Added:
- The embedded engine's OpenAI signing keys and vendor IP ranges stay current from the signed rule bundle feed, as in the TypeScript and Java SDKs.
The engine verifies every bundle (signature, version, expiry, size) and decides when to fetch; the SDK downloads in the background, never delays a request, and keeps the compiled-in or last accepted data on any failure.
Every pooled engine instance adopts an accepted bundle before its next request. (#6280)
- With a trusted edge (`EdgeTrustPolicy` Cloudflare, or TrustedProxy with hops), the `kya-edge-http2-fingerprint`, `kya-edge-tls-ciphers-sha1` and `kya-edge-tls-extensions-sha1` headers are forwarded to the engine as transport signals, as the Java SDK already does. (#6354)
- The engine names the claim a host makes to use an accepted signed request once: `detectionDetail.metadata` carries the new `kya_request_claim_scope` (a resource DID, or `authority:<host[:port]>`) with `kya_request_keyid`, `kya_request_nonce` and `kya_request_expires`, on every signed request that needs a claim. (#6408)
- Without `ApiKey` and `ProjectId`, proofs are claimed in a bounded process-local store, with a logged warning that it covers one instance only. (#6424)
- ASP.NET Core and classic ASP.NET report a request whose browser posture outcome is `absent` or `rejected` on a path listed in `postureReportPaths`, detection only, with the same canonical path matching as Java. The list is fetched when the pipeline is built (also with composed policy off) and refreshed in the background; requests that arrive before the first fetch are held (cap 1,000) and counted as `posture_hold_full` or `posture_list_unavailable` when dropped. (#6434)
- reports carry `context.correlationId` when the request supplies `x-kya-correlation-id` or `traceparent`. (#6434)
Changed:
- Outbound network: the SDK now makes outbound HTTPS GET requests to `https://feeds.kya-os.ai/rules/v1/bundle.json` by default, shortly after the first requests and then whenever the engine asks for fresh data, never more than one at a time.
With an egress allow-list, allow that host, set `VendorKeyFeedUrl` (Web.config `Checkpoint:VendorKeyFeedUrl`) to an https mirror, or set `EnableVendorKeyFeed = false` (Web.config `Checkpoint:EnableVendorKeyFeed`) to turn the feed off.
With the feed off or unreachable, the engine keeps the compiled-in keys and IP ranges, as before. (#6280)
- Every signed request the engine marks for a claim, including an unsafe-method request signed with an agent identity alone, is claimed once before the handler runs, and a request whose proof cannot be claimed is refused. (#6424)
- The embedded engines carry a refreshed OpenAI signing-key record (the same key, valid for longer). (#6482)
- The embedded engine is 0.3.0. It adds engine-directed resolution, which this SDK does not use yet, so behavior is unchanged. (#6466)
Fixed:
- An issuer key embedded under `assertionMethod` with a relative id now verifies delegations on hosts without a native HTTP resource. (#6553)
Security:
- Delegations are verified only with keys that the issuer's DID document lists under `assertionMethod`, controlled by the issuer, on every delegation path, including hosts without `HttpResourceDid` or `HttpResourceUri`.
A DID document that declares the same verification method id more than once can no longer be used to verify delegations. (#6553)
Other merged changes:
- perf(engine): build the user-agent pattern tables without a prefilter (#6282)
- test(dotnet): guard the engine wire contract against the golden fixtures (#6325)
- fix(engine): keep request signals when a signature cannot be verified (#6352)
- docs(dotnet): act as the shopper on a delegated request (#6366)
Also in this release, with no user-facing change of its own: #6442.
Already shipped in an earlier release: #5894, #6242.
Release history: https://github.com/Know-That-Ai/checkpoint/blob/main/packages/checkpoint-dotnet/CHANGELOG.md