Agent Ready Crawlers

The field guide to every AI crawler and agent at the door, and the vendors who decide who gets in.

Bot from Ora

OraBot (Ora's scanner)

In short

OraBot is the scanner Ora runs on demand to score a site, filed under Other. Ora says it signs every request with Web Bot Auth, so a site can check a signature against Ora's key directory. Ora's bot page says nothing about how OraBot treats robots.txt, and no site in the crawl names it.

Operator
Ora
Purpose
Other All other rows. Link previews, ad checks, dataset crawls, SEO tools and legacy tokens that fit none of the five purposes.
User-agent string
OraBot/1.0 (+https://ora.ai/bot)
robots.txt token
OraBot Matched case-insensitively (RFC 9309). The token and the user-agent string are different things.
Respects robots.txt

No statement

Ora's bot page does not say whether OraBot reads robots.txt rules before it fetches a page. It says a site owner can ask Ora to exclude a domain from scans, and that a verified owner can turn active probes off in Ora Studio. Source, read 2026-11-05.

Verification

Web Bot Auth signature

Requests carry an HTTP message signature that can be checked against the operator's published key directory. Documentation, read 2026-11-05.

IP ranges
Not published.
Rate behaviour
On demand, not on a schedule: a scan is a bounded burst of requests with hard timeouts and body-size caps. Ora limits its Personal Agent Protocol probes to one round per target domain every 6 hours and 7 requests per round.
Block rate

Not measured: the crawl checked 31 AI and search tokens, and OraBot is not one of them.

Documentation
Ora's scanner bot page, read 2026-11-05.

Allow and refuse lines

The operator documents no robots.txt lines for this token. Verify its signature in your WAF or edge rules instead, then allow or refuse the verified identity.

Refusing or allowing in robots.txt states a preference. Enforcement of a refusal belongs in your WAF; see how to verify the identity above.

Ora in the Verification Ledger

Signs every OraBot request with Web Bot Auth; the key directory answered on 2026-11-05. All operators.

IP lists
publishes nothing
Reverse DNS
publishes nothing
Key directory
https://ora.ai/.well-known/http-message-signatures-directory
Cloudflare
not checked
Visa TAP registry
not applicable: Ora's bot page describes a scanner that does not shop or pay (read 2026-11-05)
Mastercard Agent Pay
not applicable: Ora's bot page describes a scanner that does not shop or pay (read 2026-11-05)

What a scan sends and how to check it

Signed requests
Ora says every request that carries the OraBot user agent is signed with HTTP Message Signatures (RFC 9421, the Web Bot Auth profile) using an Ed25519 key, and carries Signature, Signature-Input and Signature-Agent headers. It tells site owners to treat unsigned traffic on that user agent like any other unverified bot (Ora's bot page, read 2026-11-05).
Key directory
ora.ai/.well-known/http-message-signatures-directory answered 200 as application/http-message-signatures-directory+json on 2026-11-05 and lists one Ed25519 key, valid from 2026-08-27 to 2027-08-27. The directory is the one place a site can check a signature against; the user-agent string proves nothing, since anyone can copy it.
Unsigned requests
During a scan Ora also sends a handful of requests to the home page that carry other crawlers' user agents, such as GPTBot, ClaudeBot and PerplexityBot, and records how the site answers. Ora says these stay unsigned, because signing them as Ora would contradict the user agent they carry. A site that checks a claimed GPTBot against OpenAI's published addresses will see an address that is not OpenAI's.
Personal Agent Protocol reads
Every scan requests /.well-known/poppy.json on the scanned domain, and on its www or apex sibling when the host has none and its home page resolved to the sibling. Where that file lists them, OraBot also reads the issuer's RFC 8414 metadata and up to three each of other domains' poppy.json files, OpenAPI documents and MCP servers' RFC 9728 metadata. Junk-request probes to the endpoints the file lists run only when the scan asks for them. Ora says its scan page and report rescans ask, and that its MCP tools, scheduled jobs and bulk scans never do.
Limits Ora states
One probe round per target domain every 6 hours, at most 7 requests in a round and a 10 second budget for all of that work in one scan. A scan is on demand, not scheduled.
Turning it off
Ora says a verified owner can turn active probes off in Ora Studio, and that anyone else can write to the contact address on its bot page, after which Ora stops them for the domain or excludes the domain from scans. The page names no robots.txt route.
What the crawl shows
None of the 8,624 robots.txt files the crawl parsed names OraBot, so a site in the crawl can refuse it only through a * group that refuses everything. For scale, 245 of 5,938 top-10,000 sites, 4.1 percent, refuse the crawl's own control token through a * group alone (crawl of 2026-11-04). The crawl did not measure OraBot as a token of its own. The ora-scanner row in the Block Rate Report is a control name that is not Ora's user agent, and says nothing about OraBot.

Sources

Last reviewed 2026-11-05