JarvisClaw Bot & Agent Identity
This page is the public reference for automated traffic originating from JarvisClaw. Site operators, security teams, and bot-verification programs can use it to confirm that a request is genuinely ours before allowing or blocking it.
Contact for any question about this traffic: mkt [at] jarvisclaw.ai (written that way so it stays readable without JavaScript).
What the bot is
JarvisClaw is an AI API gateway. Part of the platform is a federation layer (Agent Intent Protocol, AIP): peer gateways publish machine-readable capability descriptors, and JarvisClaw fetches them so that an agent request can be routed to the peer that can actually serve it.
That federation layer is the only component that makes outbound requests to third-party sites. It fetches:
- capability and discovery descriptors from peer AIP gateways
- health endpoints of peers already registered
- the specific endpoint a user's agent request resolves to
It does not perform broad web crawling, it does not collect training data, and it does not index sites for search.
How to identify our traffic
User-Agent
Federation requests, descriptor sync, and endpoint execution:
JarvisClaw-Federation/1.0Two further strings come from the same platform and are worth listing so they are not mistaken for unrelated traffic:
JarvisClaw-HealthCheck/1.0
new-api-federation/1.0JarvisClaw-HealthCheck/1.0 is used for peer health probes. new-api-federation/1.0 is used by the x402 price probe, which sends a single unpaid request to read the 402 Payment Required price challenge.
The User-Agent alone is not proof of identity — anyone can copy a string. Use the signature below for verification.
Web Bot Auth (HTTP Message Signatures)
Outbound requests are signed with RFC 9421 HTTP Message Signatures using Ed25519 (RFC 8037). Each request carries Signature, Signature-Input, and Signature-Agent headers, with tag="web-bot-auth".
The signature covers @authority and signature-agent, which binds the signature to the host being requested. A signature captured from one site cannot be replayed against another.
Public key directory
Our Ed25519 public keys are published at:
https://api.jarvisclaw.ai/.well-known/http-message-signatures-directoryhttps://jarvisclaw.ai/.well-known/http-message-signatures-directory
The directory response is itself signed (tag="http-message-signatures-directory"), so the response can be verified before its keys are trusted.
Current signing key:
| Field | Value |
|---|---|
kty | OKP |
crv / alg | Ed25519 |
kid | aokU3fZEzMA2ugv1pI8gWOQJyHi_tuakchnzOSW1NSI |
use | sig |
Verify a request by reading Signature-Agent, fetching that origin's directory, selecting the key matching the keyid in Signature-Input, and checking the signature over the listed components.
How we behave
- Request rates are low and fixed by a schedule rather than by crawl depth: peer discovery runs every 30 minutes, health checks every 5 minutes. Each poll is a single request per peer, and per-request timeouts are short (8s for the price probe).
- Requests are made only to hosts a peer has itself registered with us, or to the endpoint a user's request resolves to. We do not follow links into the wider web.
- No attempt is made to bypass blocks, rate limits, or bot management. Failures are never retried faster: a host that returns an error is marked unhealthy and keeps being polled on the same fixed schedule above, never more often.
- Our own crawl preferences are published at https://jarvisclaw.ai/robots.txt, including
Content-Signaldirectives.
If you want to block us
Block on the verified signature rather than the User-Agent string, so that impersonators are not accidentally allowed. On Cloudflare, once JarvisClaw appears in the Verified Bots directory, it can be matched as a verified bot in WAF rules.
Note that our federation traffic does not currently read your robots.txt: it only requests the specific well-known and price endpoints listed above, on hosts that already registered with us. If you need it stopped, block or deny those requests at the edge and they will simply fail. Mail us at the address above and we will remove the host from our peer list.