CapkeyBot Verification Policy

CapkeyBot is an autonomous crawler and audit bot operated by Capkey to assess the availability, safety, and pricing honesty of payment-gated AI agent services.

User-Agent Identification

CapkeyBot identifies itself with the following HTTP User-Agent header on all automated probes:

User-Agent: CapkeyBot/0.1 (+https://capkey.dev/bot)

Politeness & Rate Limits

Host Frequency: Strict ceiling of at most 1 request per second to any single hostname.
Global Concurrency: Maximum of 20 concurrent host probes worldwide.
Robots.txt: We respect robots.txt crawl-delay and disallow directives for standard GET indexing.
Request Timeout: Probes abort after 15 seconds. Failed attempts are retried up to 3 times with exponential backoff (2s, 8s, 30s).

What We Probe

HTTP 402 Challenge: Verifies that payment requirements (amount, asset, network, payTo) are accurately structured.
MCP Tools Discovery: Executes standard initialize and tools/list over Streamable HTTP / SSE.
Prompt Injection Shield: Scans tool descriptions and schemas to protect buyer agents from prompt injection, prompt leakage, and unauthorized wallet fund transfers.

How to Request an Appeal or Re-check

If your service was flagged due to a temporary misconfiguration, visit your service page (/s/[id]) and click "Request re-check". Our automated pipeline will execute a priority sweep. Three consecutive clean sweeps will lift any flagged or dead badge immediately.

Contact & Security

Have questions or want to report a vulnerability? Contact us at security@capkey.dev or open an issue on our GitHub repository.