verify_ai_crawler

io.github.TizonaMCP/tizona · Verify this server

FREE. Answer whether a crawler is who it claims to be, by the strongest available method. CRYPTOGRAPHIC (best): if the request carries a Web Bot Auth signature (HTTP Message Signatures, RFC 9421), pass its signature, signatureInput, signatureAgent and url — we fetch the operator's published key and verify the signature, which proves control of the key, not merely a network origin. NETWORK: otherwise pass a source ip (and userAgent or claimed) and we check it against the operator's own published IP ranges (OpenAI, Anthropic, Google, Perplexity, Microsoft/Bing, Apple, DuckDuckGo, Common Crawl, Mistral, Kagi, and more). Returns one of: verified, spoofed, unrecognised (no verifiable published identity — we can only check operators who publish ranges or sign), or indeterminate. Conservative by design: it never calls a claim spoofed when it merely cannot be checked. A user-agent is a claim; a published IP range or a valid signature is the credential.