KyaOs.Checkpoint 1.14.0

There is a newer version of this package available.
See the version list below for details.

dotnet add package KyaOs.Checkpoint --version 1.14.0

NuGet\Install-Package KyaOs.Checkpoint -Version 1.14.0

This command is intended to be used within the Package Manager Console in Visual Studio, as it uses the NuGet module's version of Install-Package.

<PackageReference Include="KyaOs.Checkpoint" Version="1.14.0" />

For projects that support PackageReference, copy this XML node into the project file to reference the package.

<PackageVersion Include="KyaOs.Checkpoint" Version="1.14.0" />
                    

                            Directory.Packages.props

<PackageReference Include="KyaOs.Checkpoint" />
                    

                            Project file

For projects that support Central Package Management (CPM), copy this XML node into the solution Directory.Packages.props file to version the package.

paket add KyaOs.Checkpoint --version 1.14.0

The NuGet Team does not provide support for this client. Please contact its maintainers for support.

#r "nuget: KyaOs.Checkpoint, 1.14.0"

#r directive can be used in F# Interactive and Polyglot Notebooks. Copy this into the interactive tool or source code of the script to reference the package.

#:package KyaOs.Checkpoint@1.14.0

#:package directive can be used in C# file-based apps starting in .NET 10 preview 4. Copy this into a .cs file before any lines of code to reference the package.

#addin nuget:?package=KyaOs.Checkpoint&version=1.14.0
                    

                            Install as a Cake Addin

#tool nuget:?package=KyaOs.Checkpoint&version=1.14.0
                    

                            Install as a Cake Tool

The NuGet Team does not provide support for this client. Please contact its maintainers for support.

Checkpoint for .NET

AI agent detection and policy enforcement for ASP.NET Core (.NET 8, 9 and 10) and .NET Framework (4.6.2 to 4.8.1). Every request is classified by the embedded KYA-OS engine, the same Rust engine the Checkpoint gateway and the TypeScript and Java SDKs run, compiled to WebAssembly.

Packages

Package	What it is
`KyaOs.Checkpoint`	Install this one. NuGet resolves the right adapter for your project's target framework.
`Checkpoint.AspNetCore`	ASP.NET Core middleware for .NET 8 and later.
`Checkpoint.AspNet`	A System.Web `IHttpModule` for .NET Framework 4.6.2 and later: IIS, MVC 5, Web API 2 and Web Forms.
`Checkpoint.Core`	The engine host and detection API that both adapters share.

Install

dotnet add package KyaOs.Checkpoint

Get your project ID and API key from Installations in the Checkpoint dashboard.

ASP.NET Core

Set the credentials in appsettings.json:

{
  "Checkpoint": {
    "ProjectId": "your_project_id",
    "ApiKey": "your_api_key"
  }
}

using Checkpoint.AspNetCore.Extensions;
using Checkpoint.Core.Configuration;

var builder = WebApplication.CreateBuilder(args);

builder.Services.AddCheckpoint(options =>
{
    options.ProjectId = builder.Configuration["Checkpoint:ProjectId"];
    options.ApiKey = builder.Configuration["Checkpoint:ApiKey"];
    options.OnAgentDetected = DetectedAction.Block;
});

var app = builder.Build();

app.UseCheckpoint();
app.UseRouting();
app.UseAuthorization();
app.MapControllers();
app.Run();

.NET Framework

Add the module to Web.config; no code changes are needed:

<configuration>
  <appSettings>
    <add key="Checkpoint:ProjectId" value="your_project_id" />
    <add key="Checkpoint:ApiKey" value="your_api_key" />
    <add key="Checkpoint:OnAgentDetected" value="Block" />
  </appSettings>

  <system.webServer>
    <modules runAllManagedModulesForAllRequests="true">
      <add name="Checkpoint"
           type="Checkpoint.AspNet.CheckpointModule, Checkpoint.AspNet" />
    </modules>
    <validation validateIntegratedModeConfiguration="false" />
  </system.webServer>
</configuration>

The module needs a 64-bit host process. On a 32-bit host the site still serves traffic, but detection is unavailable.

Observe or enforce

OnAgentDetected defaults to DetectedAction.Log, which is observe mode: every request is classified and reported, and the SDK blocks nothing on its own. Block, Redirect, Challenge and Instruct enforce. Once ProjectId and ApiKey are set, the project's dashboard policy applies as well. Without them, Checkpoint runs in local detection-only mode and logs one warning at startup naming the missing setting.

Documentation

Setup, configuration and troubleshooting: https://kya.vouched.id/docs/integrations/dotnet
Release history: https://github.com/Know-That-Ai/checkpoint/blob/main/packages/checkpoint-dotnet/CHANGELOG.md

Licensed under MIT.

There are no supported framework assets in this package.

Learn more about Target Frameworks and .NET Standard.

.NETFramework 4.6.2
- Checkpoint.AspNet (>= 1.14.0)
net10.0
- Checkpoint.AspNetCore (>= 1.14.0)
net8.0
- Checkpoint.AspNetCore (>= 1.14.0)

NuGet packages

This package is not used by any NuGet packages.

GitHub repositories

This package is not used by any popular GitHub repositories.

Version	Downloads	Last Updated
1.15.0	90	10/22/2026
1.14.0	91	10/21/2026
1.13.0	121	10/20/2026
1.12.0	159	10/13/2026
1.11.9	171	10/9/2026
1.11.8	212	9/30/2026
1.11.7	5,886	9/20/2026
1.11.6	148	9/20/2026
1.11.5	173	9/19/2026
1.11.4	183	9/18/2026
1.11.3	152	9/17/2026
1.11.2	161	9/16/2026
1.11.1	139	9/16/2026
1.11.0	182	9/16/2026
1.10.0	168	9/15/2026
1.9.0	225	9/7/2026
1.8.1	280	9/3/2026
1.7.7	336	8/10/2026
1.7.6	205	8/7/2026
1.7.5	266	8/5/2026

1.14.0

Breaking changes:
- Changed: `HttpProofClaim.ResourceDid` is now `HttpProofClaim.Scope`, the engine's claim scope (the resource DID, or `authority:<host[:port]>`).
A custom `IHttpProofReplayStore` needs the rename. Per the SDK release policy this ships as a minor. (#6424)
- Changed: The embedded engine (0.4.0) refuses MCP-I envelopes and the legacy Layer 2 delegation headers outside the native propagation lane with `kyaos/unsupported-carriage` (403). The native propagation and agent credential lanes are unchanged. (#6544)
- Removed: `PatternAgentDetector`, `KnownAgents`, `BrowserPostureProofVerifier` and `BrowserPostureProof` from `Checkpoint.Core`.
Nothing in the SDK used them: `AddCheckpoint` registers `WasmAgentDetector`, the engine makes every detection decision, and no adapter verified DPoP posture proofs.
Code that constructed these types directly no longer compiles; use `WasmAgentDetector` (or `IAgentDetector` from DI) for detection.
No published `Checkpoint.AspNetCore`, `Checkpoint.AspNet` or `KyaOs.Checkpoint` version references them, so running an existing adapter on this Core is unaffected. (#6251)

Added:
- The embedded engine's OpenAI signing keys and vendor IP ranges stay current from the signed rule bundle feed, as in the TypeScript and Java SDKs.
The engine verifies every bundle (signature, version, expiry, size) and decides when to fetch; the SDK downloads in the background, never delays a request, and keeps the compiled-in or last accepted data on any failure.
Every pooled engine instance adopts an accepted bundle before its next request. (#6280)
- With a trusted edge (`EdgeTrustPolicy` Cloudflare, or TrustedProxy with hops), the `kya-edge-http2-fingerprint`, `kya-edge-tls-ciphers-sha1` and `kya-edge-tls-extensions-sha1` headers are forwarded to the engine as transport signals, as the Java SDK already does. (#6354)
- The engine names the claim a host makes to use an accepted signed request once: `detectionDetail.metadata` carries the new `kya_request_claim_scope` (a resource DID, or `authority:<host[:port]>`) with `kya_request_keyid`, `kya_request_nonce` and `kya_request_expires`, on every signed request that needs a claim. (#6408)
- Without `ApiKey` and `ProjectId`, proofs are claimed in a bounded process-local store, with a logged warning that it covers one instance only. (#6424)
- ASP.NET Core and classic ASP.NET report a request whose browser posture outcome is `absent` or `rejected` on a path listed in `postureReportPaths`, detection only, with the same canonical path matching as Java. The list is fetched when the pipeline is built (also with composed policy off) and refreshed in the background; requests that arrive before the first fetch are held (cap 1,000) and counted as `posture_hold_full` or `posture_list_unavailable` when dropped. (#6434)
- reports carry `context.correlationId` when the request supplies `x-kya-correlation-id` or `traceparent`. (#6434)

Changed:
- Outbound network: the SDK now makes outbound HTTPS GET requests to `https://feeds.kya-os.ai/rules/v1/bundle.json` by default, shortly after the first requests and then whenever the engine asks for fresh data, never more than one at a time.
With an egress allow-list, allow that host, set `VendorKeyFeedUrl` (Web.config `Checkpoint:VendorKeyFeedUrl`) to an https mirror, or set `EnableVendorKeyFeed = false` (Web.config `Checkpoint:EnableVendorKeyFeed`) to turn the feed off.
With the feed off or unreachable, the engine keeps the compiled-in keys and IP ranges, as before. (#6280)
- Every signed request the engine marks for a claim, including an unsafe-method request signed with an agent identity alone, is claimed once before the handler runs, and a request whose proof cannot be claimed is refused. (#6424)
- The embedded engines carry a refreshed OpenAI signing-key record (the same key, valid for longer). (#6482)
- The embedded engine is 0.3.0. It adds engine-directed resolution, which this SDK does not use yet, so behavior is unchanged. (#6466)

Fixed:
- An issuer key embedded under `assertionMethod` with a relative id now verifies delegations on hosts without a native HTTP resource. (#6553)

Security:
- Delegations are verified only with keys that the issuer's DID document lists under `assertionMethod`, controlled by the issuer, on every delegation path, including hosts without `HttpResourceDid` or `HttpResourceUri`.
A DID document that declares the same verification method id more than once can no longer be used to verify delegations. (#6553)

Other merged changes:
- perf(engine): build the user-agent pattern tables without a prefilter (#6282)
- test(dotnet): guard the engine wire contract against the golden fixtures (#6325)
- fix(engine): keep request signals when a signature cannot be verified (#6352)
- docs(dotnet): act as the shopper on a delegated request (#6366)

Also in this release, with no user-facing change of its own: #6442.

Already shipped in an earlier release: #5894, #6242.

Release history: https://github.com/Know-That-Ai/checkpoint/blob/main/packages/checkpoint-dotnet/CHANGELOG.md