Free AI agent check

Can AI shoppers buy from your store?

AI assistants like ChatGPT now shop for people. Type your store's address to see whether real AI shopping agents can get in, and whether a bot using ChatGPT's name gets in just as easily. Works for any store: Shopify, WooCommerce, BigCommerce or your own.

What we look at

Three ordinary requests: your home page as ourselves, your home page with ChatGPT's agent's name in our user agent but no signature (exactly what a fake would send), and your robots.txt. We compare how your site treats the first two. We don't post anything or change anything.

Each store's result is kept for an hour. Nothing about who asked is kept. Privacy

Why it matters

Real AI agents sign every request with a digital signature (the Web Bot Auth standard, being finished at the IETF), and publish the keys to check it. A store that checks the signature can let ChatGPT's agent buy, and stop a card tester that only borrows its name. A store that doesn't has two bad choices: block every AI agent and lose those sales, or let them all in, fakes included.

Already selling to AI agents? Ropeline Proof signs a receipt for every AI agent's purchase, for when a shopper disputes one.

For developers: check AI agents in your own code

Agent Gate, for any site on Cloudflare

One file that runs in front of your site as a Cloudflare Worker. It checks each AI agent's signature and tells your site who it really is, with two headers your site can trust: Ropeline-Agent (verified, untrusted or spoofed) and Ropeline-Agent-Operator (like chatgpt.com). Fakes that forge a known agent's signature are stopped with a 403.

1. Download ropeline-agent-gate.js.
2. In Cloudflare: Workers & Pages, Create, Worker. Paste the file and deploy.
3. Add a route for your site (Settings, Domains & Routes, like shop.com/*).

The verify API, for any server

Send us the request your server received (its address, method and headers) and get the verdict back. Send the signature headers and any headers they cover; there's no need to send cookies.

curl https://getropeline.com/api/agents/verify \
  -H 'content-type: application/json' \
  -d '{"method": "GET",
       "url": "https://shop.com/product/42",
       "headers": {
         "signature-agent": "\"https://chatgpt.com\"",
         "signature-input": "sig1=(\"@authority\" \"signature-agent\");created=...;keyid=\"...\";tag=\"web-bot-auth\"",
         "signature": "sig1=:...:"}}'

{"ok": true, "status": "verified", "operator": "chatgpt.com", "reason": "", "keyid": "...", "listed": "known"}

• verified: signed with a key its operator publishes. It is who it says it is.
• spoofed: claims to be a listed operator's agent, but the signature is forged or the key isn't theirs. A bot in disguise.
• untrusted: signed, but it couldn't be proven (an operator we don't list, an expired signature, a key directory that didn't answer). Treat it like any visitor; don't punish it.
• none: not signed.

Free while it's new: up to 3,000 checks an hour from one server. For more, or to run the check inside your own code, email hello@getropeline.com.

The agent registry

The operators whose agents we can verify. Known ones we checked by hand; registered ones proved they run their domain and hold their keys (their key directory is signed by its own keys), but we haven't vetted them.

• Loading…

Run an AI agent? List it

Publish your agent's keys at https://your-domain/.well-known/http-message-signatures-directory, signed by one of those keys, then add your domain here.