The AgentReady audit crawler

If you found this page in your server logs or firewall console: hello. This page says who we are, why we fetched your site, exactly what we touch — and how to verify, cryptographically, that a request claiming to be us really is.

Who we are

AgentReady (agentready.market) audits e-commerce stores for agent-readiness: can an AI shopping agent find, understand and buy on a store. It is operated by Boxing Vision (the Netherlands), and is unaffiliated with other AgentReady-named products. Contact: hello@agentready.market.

Why we fetched your site

Audits are merchant-initiated: someone submitted this store's URL for a scan — we run no site-wide discovery crawl. A scan touches only public, unauthenticated pages (homepage, one product page, robots.txt, llms.txt, sitemap, a few well-known agent endpoints), never creates an account, never completes a checkout, and stores no personal data.

Politeness: requests to your host are spaced at least 400 ms apart, responses are read up to 3 MB with short timeouts, and every request carries the contact header below.

How to verify it's us

Part of the audit deliberately re-fetches pages under different user-agent strings — that's the cloaking differential merchants ask us for (does your store treat AI bots differently from a browser?). So don't identify us by User-Agent. Two things stay constant on every request we send:

• The audit header — every request carries X-AgentReady-Audit: merchant-requested (+https://agentready.market/bot)
• A Web Bot Auth signature (RFC 9421 HTTP Message Signatures) — requests carry Signature-Agent: "https://www.agentready.market" plus Signature-Input/Signature headers, verifiable against our published Ed25519 key at /.well-known/http-message-signatures-directory. A request that presents our name without a valid signature is not us.

One deliberate exception: each scan sends a single unsigned control request — it still carries the audit header. That's our verified-agent check: it measures whether a store's firewall distinguishes cryptographically signed agents from anonymous automation, the same signing layer Visa's and Mastercard's agent programmes use.

Prefer we not scan?

Email hello@agentready.market with your domain and we'll exclude it. Since scans only run when someone submits a URL, exclusion simply means future submissions of your domain return nothing.

Machine-readable entry points for agents: /llms.txt · /agents.md · /.well-known/agent-card.json