AI agents visit your site every day. They scrape your data, call your APIs, interact with your systems. Most don't tell you who they are or what they're doing. You find out when something breaks — or you never find out at all.
In every case, the agent operated without a signed commitment of what it was authorized to do. No contract. No declaration. No record. No accountability.
Agents scrape your pricing, your content, your customer-facing data. They rotate IPs, fake their identity, and operate 24/7. Your logs show traffic. They don't show intent.
Your API gets hit by agents making thousands of requests. Some are legitimate integrations. Some are competitors. Some are hostile. You can't tell them apart.
An agent accesses something it shouldn't. Exfiltrates data. Overloads your system. There's no signed record of what it promised, what it did, or who's responsible.
Cloudflare Bot Management costs thousands. AIUC certifies ten enterprise vendors. Your site faces hundreds of unknown agents and has zero visibility.
That's it. That's the entire idea. Everything else follows from this.
BotConduct is open source. The middleware runs on your server, not ours. The cryptography is standard Ed25519 — auditable by anyone. Every line of verification code is public. You don't send us your traffic. You don't depend on our uptime. You don't take our word for anything.
The agent's declaration is signed with its own key. Your middleware verifies the signature locally. No call home. No cloud dependency. No black box.
Middleware runs on YOUR infrastructure
Verification is offline — no calls to BotConduct
All code is auditable on GitHub
Standard cryptography (Ed25519, JWT)
No vendor lock-in — fork it anytime
Works alongside Cloudflare, DataDome, or nothing
If it lies, your middleware catches it and files a signed complaint to the public registry. The next site that agent visits sees the record.
The middleware publishes a machine-readable contract on your site: what resources are available, at what rate, for what purposes. Choose a template, adjust if needed. Done once.
Before operating, the agent reads your contract, picks a scope, and signs a cryptographic declaration: "I will access /api/products at 10 requests/min for price research." The signature is verifiable by you without calling anyone.
Each request carries the signed declaration. Your middleware checks: valid signature? Within declared scope? All offline. No latency added. No external dependency.
The agent said GET only but tried POST. Said 10/min but hit 50/min. Your middleware generates a signed complaint with evidence and sends it to the public registry. Automatic.
Before letting an agent in, any site can check its history: how many complaints, from how many sites, for what reasons. Reputation built by the market, not by a vendor.
pip install botconduct-middleware from botconduct_middleware import BCSMiddleware app = BCSMiddleware(app, template="government-api")
npm install @botconduct/middleware app.use(require('@botconduct/middleware')({ template: 'ecommerce' }))
Templates: government-api · ecommerce · fintech · publisher · open-api
Runs on your server. Publishes your contract. Verifies declarations. Files complaints. All automatic.
pip install botconduct # One line changed in your code: import botconduct as bcs response = bcs.get("https://api.example.com/data", purpose="research")
Your agent reads the site's contract, signs a declaration, and includes it in every request. Build reputation automatically by operating honestly.
The adversarial stress test simulates real attacks against your agent. Find vulnerabilities before your users do. Free. 3 evaluations.
curl -X POST https://botconduct.org/api/v3/training-center/start \ -H "Content-Type: application/json" \ -d '{"bot_name":"MyAgent","operator":"me","scenarios":["C1","C3"]}'
The free middleware shares aggregated bot behavioral data with the public registry. This is what allows cross-market reputation — patterns only visible when multiple sites report. No personal data of your human visitors is collected. IPs are hashed. UAs are truncated.
Bot behavioral data contributes to the public registry. You see your traffic. The network sees aggregate patterns. Better detection for all.
No data leaves your server. Full privacy. You lose cross-market reputation but retain complete control. Set data-mode="local".
Free middleware. Open source. Runs on your server. Takes two minutes to install.
Install now — free