KyaOs.Checkpoint 1.15.0 

dotnet add package KyaOs.Checkpoint --version 1.15.0
                    


                    

                
NuGet\Install-Package KyaOs.Checkpoint -Version 1.15.0
This command is intended to be used within the Package Manager Console in Visual Studio, as it uses the NuGet module's version of Install-Package. 
<PackageReference Include="KyaOs.Checkpoint" Version="1.15.0" />
For projects that support PackageReference, copy this XML node into the project file to reference the package. 
<PackageVersion Include="KyaOs.Checkpoint" Version="1.15.0" />
                    


                            Directory.Packages.props
                        

                    

                
<PackageReference Include="KyaOs.Checkpoint" />
                    


                            Project file
For projects that support Central Package Management (CPM), copy this XML node into the solution Directory.Packages.props file to version the package. 
paket add KyaOs.Checkpoint --version 1.15.0
                    


                    

                
#r "nuget: KyaOs.Checkpoint, 1.15.0"
#r directive can be used in F# Interactive and Polyglot Notebooks. Copy this into the interactive tool or source code of the script to reference the package. 
#:package KyaOs.Checkpoint@1.15.0
#:package directive can be used in C# file-based apps starting in .NET 10 preview 4. Copy this into a .cs file before any lines of code to reference the package. 
#addin nuget:?package=KyaOs.Checkpoint&version=1.15.0
                    


                            Install as a Cake Addin
                        

                    

                
#tool nuget:?package=KyaOs.Checkpoint&version=1.15.0
                    


                            Install as a Cake Tool

Checkpoint for .NET

AI agent detection and policy enforcement for ASP.NET Core (.NET 8, 9 and 10) and .NET Framework (4.6.2 to 4.8.1). Every request is classified by the embedded KYA-OS engine, the same Rust engine the Checkpoint gateway and the TypeScript and Java SDKs run, compiled to WebAssembly.

Packages

Package What it is
KyaOs.Checkpoint Install this one. NuGet resolves the right adapter for your project's target framework.
Checkpoint.AspNetCore ASP.NET Core middleware for .NET 8 and later.
Checkpoint.AspNet A System.Web IHttpModule for .NET Framework 4.6.2 and later: IIS, MVC 5, Web API 2 and Web Forms.
Checkpoint.Core The engine host and detection API that both adapters share.

Install

dotnet add package KyaOs.Checkpoint

Get your project ID and API key from Installations in the Checkpoint dashboard.

ASP.NET Core

Set the credentials in appsettings.json:

{
  "Checkpoint": {
    "ProjectId": "your_project_id",
    "ApiKey": "your_api_key"
  }
}

Register Checkpoint in Program.cs, before routing and authorization:

using Checkpoint.AspNetCore.Extensions;
using Checkpoint.Core.Configuration;

var builder = WebApplication.CreateBuilder(args);

builder.Services.AddCheckpoint(options =>
{
    options.ProjectId = builder.Configuration["Checkpoint:ProjectId"];
    options.ApiKey = builder.Configuration["Checkpoint:ApiKey"];
    options.OnAgentDetected = DetectedAction.Block;
});

var app = builder.Build();

app.UseCheckpoint();
app.UseRouting();
app.UseAuthorization();
app.MapControllers();
app.Run();

.NET Framework

Add the module to Web.config; no code changes are needed:

<configuration>
  <appSettings>
    <add key="Checkpoint:ProjectId" value="your_project_id" />
    <add key="Checkpoint:ApiKey" value="your_api_key" />
    <add key="Checkpoint:OnAgentDetected" value="Block" />
  </appSettings>

  <system.webServer>
    <modules runAllManagedModulesForAllRequests="true">
      <add name="Checkpoint"
           type="Checkpoint.AspNet.CheckpointModule, Checkpoint.AspNet" />
    </modules>
    <validation validateIntegratedModeConfiguration="false" />
  </system.webServer>
</configuration>

The module needs a 64-bit host process. On a 32-bit host the site still serves traffic, but detection is unavailable.

Observe or enforce

OnAgentDetected defaults to DetectedAction.Log, which is observe mode: every request is classified and reported, and the SDK blocks nothing on its own. Block, Redirect, Challenge and Instruct enforce. Once ProjectId and ApiKey are set, the project's dashboard policy applies as well. Without them, Checkpoint runs in local detection-only mode and logs one warning at startup naming the missing setting.

Documentation

Licensed under MIT.

There are no supported framework assets in this package.

Learn more about Target Frameworks and .NET Standard.

NuGet packages

This package is not used by any NuGet packages.

GitHub repositories

This package is not used by any popular GitHub repositories.

Version Downloads Last Updated
1.15.0 90 10/22/2026
1.14.0 91 10/21/2026
1.13.0 120 10/20/2026
1.12.0 159 10/13/2026
1.11.9 171 10/9/2026
1.11.8 212 9/30/2026
1.11.7 5,883 9/20/2026
1.11.6 148 9/20/2026
1.11.5 173 9/19/2026
1.11.4 183 9/18/2026
1.11.3 152 9/17/2026
1.11.2 161 9/16/2026
1.11.1 139 9/16/2026
1.11.0 182 9/16/2026
1.10.0 168 9/15/2026
1.9.0 225 9/7/2026
1.8.1 280 9/3/2026
1.7.7 336 8/10/2026
1.7.6 205 8/7/2026
1.7.5 266 8/5/2026
Loading failed

1.15.0

Breaking changes:
- Removed: The public resolution types `DidWebResolver`, `DidWebLocation`, `EngineDidDocument`, `EngineVerificationMethod`, `IssuerAllowlist`, `JsonWebKey2020Validator`, `SsrfSafeDidFetcher`, `DidFetchResponse`, `StatusIssuerDocuments`, `StatusListRegistry`, `StatusListResolver`, `StatusListResult`, `TtlCache<T>` and `DelegationDidDocs`, the `IResolutionWarmer` members `TryGetDidDoc`, `TryGetStatus` and `RegisterStatus`, and the public `ResolutionWarmer` constructor.
 The engine decodes documents itself now; use `ResolutionWarmer.CreateDefault`.
 The published adapters (1.11.9 and 1.14.0) call only `CreateDefault`, `PrimeAsync` and `RefreshTickAsync`, which stay. (#6607)
- Removed: `AuthorizeInputProjection.IsUnverifiedOptimisticProtocolBlock` and `VerificationMethod.McpIHandshake`.
 The engine refuses MCP-I and never reports a handshake, so neither was ever reached; `mcp_i_handshake` and `kyaos_handshake` are no longer treated as a verified identity by a composed policy or the dashboard allow list. (#6642)

Added:
- Engine-directed resolution: the SDK fetches the DID documents and status lists the engine names for a presented credential, in the background, from public HTTPS hosts only, and answers each request from its cache.
 A resource not fetched yet is answered 503 `kyaos/identity-pending` or `kyaos/status-pending`; a resource whose fetch failed is decided by the engine (for example `kyaos/did-unresolvable` for a signer's 404), where it used to stay pending.
 Servers need outbound HTTPS to the trusted roots and to the `did:web` hosts of the agents and issuers they accept. (#6607)
- `DelegationHolder.CustomerId`: the id after `:users:` in `Subject`, set only when the credential's issuer
 (the root that signed it) is one of the configured `TrustedDelegationRoots` and `Subject` is exactly
 `<issuer>:users:<id>`, with one non-empty segment after it. It is null for anything else: a `did:key`, another
 host's or organization's DID (including a user under a different trusted root than the signer), extra segments, or
 no trusted roots. A merchant acting as the shopper on a delegated request reads it instead of parsing `Subject`. It
 is the merchant's own customer id when the shopper signed in on Checkpoint's consent page with the merchant's
 sign-in (merchant OAuth, credential or token); with Checkpoint's sign-in methods it is an id Checkpoint assigned. (#6367)

Changed:
- An engine Block is answered as the engine renders it: the kya-os/http registry status for a `kyaos/*` code (for example 401 for `kyaos/missing-signature` and `kyaos/did-unresolvable`, 429 with `Retry-After: 1` for `kyaos/replay-capacity`), the reason-keyed status otherwise, and the engine's JSON body and `X-Checkpoint-*` headers, in either response format and in both adapters.
 Engine policy blocks now return the engine's status and body, not the configured notice.
 `BlockedResponse` and the PlainText notice apply only to blocks the SDK decides: the configured `OnAgentDetected` action, the structured dashboard policy, browser posture, and `kyaos/policy-unavailable`, `kyaos/verification-pending` and `kyaos/application-authorization-unavailable`. (#6590)
- `kyaos/identity-pending` and `kyaos/status-pending` answer with `Retry-After: 1` (was 3). (#6607)
- A status list must be hosted on its issuer's `did:web` host; a list on another trusted root's host no longer counts. (#6607)
- A delegation signed by an issuer key listed without assertion authority is refused as 401 `kyaos/did-unresolvable` (it was 403 `kyaos/chain-broken`), like an unlisted key. (#6607)
- DID documents are refreshed on the engine's maximum age (every 150 seconds for 300) instead of every 55 minutes, and a source that keeps failing is retried at most once per 30 seconds. (#6607)
- The embedded engines carry a refreshed OpenAI signing-key record (the same key, valid for longer). (#6652)

Deprecated:
- `CheckpointOptions.StatusListWarmTargets` is no longer used; a set value is logged once at startup. (#6607)

Fixed:
- The embedded engine, in engine-directed resolution, uses only the keys a DID document authorises for each purpose. Not used by the host yet. (#6576)
- A delegation credential whose status-list index is outside the list is refused (`kyaos/chain-broken`). (#6609)
- A kya-http/2 request signed by a `did:web` key that is not a trusted root now verifies; it was always `kyaos/did-unresolvable`. (#6607)
- ASP.NET Core: if adding the discovery `Link` header throws, the middleware logs a warning and sends the
 response without that header. The header is added when the response starts, so the exception used to fail the
 application's whole response. (#6386)
- One 5-second deadline bounds each DID document and status list fetch from the connect to the last body byte, TLS handshake included, so a slow peer cannot hold a fetch past it. (#6674)
- a Web Bot Auth request verified against OpenAI's key directory is named `ChatGPT`, as Tier 3 names the same agent, instead of `openai`, so a policy that names ChatGPT matches it verified or not. `openai` stays in `metadata.verified_vendor` and `detected_agent.vendor`. (#6652)

Other merged changes:
- chore(rules): refresh AI vendor IPs 2026-10-21 (#6506)

Already shipped in an earlier release: #6483.

Release history: https://github.com/Know-That-Ai/checkpoint/blob/main/packages/checkpoint-dotnet/CHANGELOG.md