AgentDrives Agent

AgentDrives Agent is the AI agent of AgentDrives (agentdrives.com). It test-drives software products the way an AI agent would: it reads the docs, tries to sign up, get an API key, use the product, pay where a paid test is ordered, cancel and delete its account. AgentDrives publishes how far it got, with the evidence; owners can reply before publication and ask for a re-drive.

How it behaves

One careful user. One drive per product at a time, at a person's pace (about one page action every few seconds); up to three drives at once across different products, about a hundred a day. Its own test account, its own test inbox, no load tests, no messages to real people, no spending beyond a capped test card.
Not a crawler. It visits what a user would to sign up and use the product. It does not index sites, does not train models on what it reads, and keeps only what a report needs as evidence (screenshots and short quotes of the steps it took).
robots.txt. Before a drive it reads the product's robots.txt. If the product's address is disallowed for AgentDrivesAgent (or for all user agents), it does not drive that product, unless the owner ordered the drive.
Bot checks. It never solves, skips or bypasses a CAPTCHA or bot check, never uses a solving service, never retries around a block (403, 429 or a challenge) and never hides that it is automated. A bot check stops the drive at that step, and the report says so. In some drives a person from our team then continues by hand in a manual session; the report marks every such step as done by a human, not by the agent.
Opt-out is honoured. Write to us and we stop driving your product.

How to recognise it

User-Agent (HTTP)	`AgentDrivesAgent/1.0 (+https://agent.agentdrives.com/bot)`
User-Agent (browser)	Chrome's string followed by `AgentDrivesAgent/1.0 (+https://agent.agentdrives.com/bot)`
robots.txt token	`AgentDrivesAgent`
Signature-Agent	`"https://agent.agentdrives.com"`
Key directory	`https://agent.agentdrives.com/.well-known/http-message-signatures-directory`
Machine-readable	`https://agent.agentdrives.com/agent.json`
Egress addresses	`167.235.152.186`, `2a01:4f8:1c16:9996::1` (for information; not exclusive to the agent)

Its browser and its HTTP client sign every request with Web Bot Auth (HTTP Message Signatures, RFC 9421, Ed25519, tag="web-bot-auth"). The signature covers @authority and signature-agent and is valid for 60 seconds. Not signed: calls a product's own SDK, CLI or MCP client makes (they go out as that client sends them), and reading public docs through a search or fetch tool. Trust the signature, not the User-Agent or the address: anyone can copy those.

Verify, allow or block it

Cloudflare, Vercel, Akamai, HUMAN, DataDome and other bot managers that support Web Bot Auth verify the signature against our key directory. To let it through, allow verified agents (or this agent by name) in your bot settings.
Your own code: fetch the key directory, check that the Signature-Agent header is "https://agent.agentdrives.com", and verify the signature with any RFC 9421 library, e.g. cloudflare/web-bot-auth.
Block it: add to robots.txt:
```
User-agent: AgentDrivesAgent
Disallow: /
```
or write to us.

Operator and contact

AgentDrives, the Netherlands. Questions, corrections, abuse reports or an opt-out: hello@agentdrives.com.