knowngood.sh
menu
KnownGood-Verifier/0.3 honours robots.txt respects ai-input=no /bot.md

You found this from your server logs

What KnownGood-Verifier is, and how to control it.

You're probably here because you saw KnownGood-Verifier in your access logs. This page tells you exactly what it does, what it fetched, how to slow it down or block it entirely, and how to confirm it's really us. No dark patterns — the opt-out is right at the top.

01Block or limit us — right now, no waiting

If you want us gone, add this to your robots.txt. We check it on every visit and honour it immediately; a disallow takes effect on our next request, and we cache your rules so we won't re-probe you.

robots.txt — block entirely
User-agent: KnownGood-Verifier
Disallow: /

Prefer to stay listed but slow us down? Set a crawl delay:

User-agent: KnownGood-Verifier
Crawl-delay: 30

And if your only concern is AI use of your content generally, the Content Signals standard lets you say so once, to every AI crawler at once. We treat ai-input=no as a hard stop: we will not list or re-probe a site that declares it, regardless of anything else on the page.

Every “no” we honour, in order. robots.txt Disallow for our user-agent — binding (RFC 9309); a robots.txt that answers 5xx or 429, or cannot be reached, is treated as a “no” too. ai-input=no — the Content Signals convention; we treat it as binding. Content-Usage: search=n as a header or a robots.txt line — the IETF AI Preferences draft, not yet an RFC, honoured now. X-Robots-Tag: noai or the equivalent meta tag — informal, no standard behind it, honoured as a courtesy because a site that wrote it meant it.

How a site comes to be checked. We check a site when it declares agents welcome in robots.txt, or publishes an agent endpoint — an MCP server card, an API catalog, an llms.txt — or appears in a public MCP registry, or an owner asks at /submit. Publishing an endpoint for agents is an invitation to agents; we treat it as one. If that is not what you meant, the lines above stop us.

02What it actually does

KnownGood-Verifier checks whether an AI agent — the kind a real person now sends to browse, compare, and act on their behalf — can actually read and use your site. It's how we build Known Good, an index of the sites that pass. It is a verifier, not a scraper: it reads a handful of standard files to assess readiness. It does not harvest your content, your prices, or your customer data.

User-agent
KnownGood-Verifier/0.3 (+https://knowngood.sh/bot)
What it fetches
GET requests, in this order, stopping at the first “no”: /robots.txt first, always; then your homepage /; then these sixteen paths: /llms.txt, /agents.md, /openapi.json, /.well-known/agent-card.json, /.well-known/agent-skills/index.json, /.well-known/api-catalog, /.well-known/mcp/server-card.json, /.well-known/auth.md, /.well-known/oauth-protected-resource, /.well-known/oauth-authorization-server, /.well-known/ucp, /.well-known/acp.json, /.well-known/http-message-signatures-directory, /.well-known/ard.json, /.well-known/ai-catalog.json, /.well-known/skills/index.json; then /api and /api/v1, only to record whether they answer 402 Payment Required — we record the price and never pay. Nothing else: no contact page, no crawl of your links.
What it sends
POST requests only to an endpoint your own files advertise — an MCP endpoint named in /.well-known/ucp, in your MCP server card or in /llms.txt, or /api/mcp on a Shopify storefront — and only these JSON-RPC calls: MCP initialize, notifications/initialized, tools/list (if initialize is answered “method not found”, one tools/list on its own). We never call a tool. A2A, to an interface in your agent card’s supportedInterfaces: one tasks/get for a task id that cannot exist. We never send a message (message/send is never called). If the endpoint is on another host, we read that host’s /robots.txt first and obey it.
Limits
At most 24 requests to your site in one check, each tried once — no retries. At most one request in flight to your server (by IP address) at a time, and at least one second between requests to your site, longer if you set Crawl-delay. 10 s to connect, 20 s per request. HTTPS only. Redirects: robots.txt up to five, pages up to two and only within your own domain.
When it stops
Nothing further is fetched when robots.txt disallows / for KnownGood-Verifier (or for * when there is no group for us), declares ai-input=no or Content-Usage: search=n, answers 5xx or 429, or cannot be reached — if we cannot ask, we do not fetch. X-Robots-Tag: noai and a robots noai meta tag can only be seen on a response, so we stop at the first response that carries one. A Disallow on a single path skips that path only.
Frequency
A first check, then periodic re-checks on a schedule so your listing stays current. Not continuous.
JavaScript
We read what your server returns. We don't render, click, or fill anything on a live check.
Personal data
None collected. We assess site structure, not content.

03Verify it's really us

Anyone can put our name in a user-agent string. To confirm a request is genuinely from KnownGood-Verifier and not an impostor borrowing our name, check that the source IP falls within our published range — spoofed traffic wearing our UA will not.

IP ranges
published at /bot/ips.json — verify any request against this list
Reverse DNS
Our requests come from the AWS Elastic IP listed in /bot/ips.json; its reverse DNS is AWS’s (ec2-3-216-221-135.compute-1.amazonaws.com), not a knowngood.sh name. Verify by the IP list.

Seeing our name from an IP outside that range? That's someone spoofing us — block it, and if you like, tell us at the address below so we can flag it.

04Our commitments

  • We honour robots.txt for our user-agent, every visit.
  • We treat ai-input=no as a hard opt-out — never listed, never re-probed.
  • We identify ourselves honestly and never disguise our user-agent.
  • We rate-limit ourselves to stay a negligible load on your server.
  • We collect no personal data and store no content beyond readiness signals.
  • If we ever get something wrong, one email stops us.

05How this site lists its own pages

Our own pages are built for crawlers the way we ask others to build theirs.

  • A listing shows 25 sites a page, or 100 when that would take more than 25 pages; a listing still longer splits by the first letter of the domain, and a letter still longer by its second, so every page bar shows every page number and never scrolls.
  • The sitemap index lists the strongest report pages first, and the next file of them is listed when Google’s smartphone crawler has averaged more than 100 requests a day to this site over seven days and fewer than half of the report pages already listed are still reported as discovered but not indexed.

06Contact

Questions, complaints, or a request to stop entirely — reach a human at bot@knowngood.sh. We answer, and we act on it.

Book a free 30-minute agent-readiness review over video: cal.com/knowngood.sh/30min