Test agent
How the Ready4Bots test agent identifies itself, what it fetches, and how to verify or refuse it.
Operator
Launch Labs Systems LLC
1309 Coffeen Avenue STE 1200, Sheridan, WY 82801, USA
Purpose
The test agent reads public pages to see whether a customer's agent can find the business and reach guest checkout, or a signup or trial. It does not log in, enter personal data, place an order, or change the site.
User-Agent
Every request uses Ready4BotsAgent/1.0 (+https://ready4bots.com/bot).
robots.txt
Cart, checkout, and signup URLs that robots.txt disallows for * or a major AI bot, including Ready4BotsBot, are not fetched. Other discovery files are requested once so the report can record a block. A site can opt out of the test with either of these groups:
User-agent: Ready4BotsBot Disallow: / User-agent: Ready4BotsAgent Disallow: /
A site that opts out is not published as blocked. Email the contact above and we stop fetching that host.
Request rate
One check fetches the homepage and a fixed list of discovery files (robots.txt, llms.txt, sitemap, Agent Card, OpenAPI, MCP, and the Ready4Bots manifest), then up to six cart, checkout, or signup URLs that robots.txt allows. At most four requests run at once. Each request waits at most 5 seconds. The whole check stops after 30 seconds. This site does not run a continuous crawl.
Signatures and keys
When a signing key is configured, each request carries Signature, Signature-Input, and Signature-Agent (HTTP Message Signatures, RFC 9421, Web Bot Auth). The tag is web-bot-auth. keyid is the JWK SHA-256 thumbprint. Covered components are @method, @authority, @path, and the Signature-Agent member for that signature. Ed25519 is the primary algorithm. An ECDSA P-256 signature (alg ecdsa-p256-sha256) is added when that key is configured, for verifiers such as Shopify UCP Signed that require it. Request signatures expire after 10 minutes.
The public keys are at /.well-known/http-message-signatures-directory with content type application/http-message-signatures-directory+json. The directory response is signed (tag http-message-signatures-directory) over @authority from the request and Content-Digest of the body. It may be cached for 24 hours. That directory signature expires after 7 days.
How to verify us
- Read Signature-Agent. The member for the signature label is https://ready4bots.com (type directory).
- GET https://ready4bots.com/.well-known/http-message-signatures-directory and check the content type.
- Match keyid to a key whose kid is that thumbprint.
- Rebuild the RFC 9421 signature base, including the final line feed, and verify the signature.
- Reject the signature when tag is not web-bot-auth, or when created or expires is missing or outside its window.
Cloudflare's checker at https://crawltest.com/cdn-cgi/web-bot-auth returns 401 when the message format is acceptable but the key is not known to them, 200 when the signature verifies against a key they already have, and 400 when the headers are malformed.
Opt out
Email hello@ready4bots.com with the host to refuse. That is the opt-out contact.