Bot management vendor
Castle
In short
Castle's agent object carries the agent's name, operator and category, and records how it knew, in order of strength: a verified Web Bot Auth signature, a browser fingerprint, then the user agent string. Its docs warn that a missing object does not prove a human sent the request, and the Free plan covers about 1,000 Risk API calls.
- Type
- Bot management
- Homepage
- castle.io
- In one line
- Bot and account abuse API whose risk responses include an agent object that names AI agents and browser automation, identified by a verified Web Bot Auth signature, a browser fingerprint or a user-agent string.
- Last read
- 2026-11-05
What Castle does for this layer
From the vendor's own pages
Castle adds an optional agent object to its API response with name, operator, category (ai_agent, browser_automation or ai_browser) and identified_by. (docs.castle.io) Castle's identified_by values are web_bot_auth, fingerprint and user_agent; a verified signature takes precedence over a fingerprint match, which takes precedence over a user-agent match. (docs.castle.io) Castle names Meta Muse, Grok Bot, ChatGPT agent and Manus among the personal AI agents it identifies. (docs.castle.io) To verify Web Bot Auth, Castle asks customers to forward the Signature-Input, Signature, Signature-Agent and original Host headers in context.headers. (docs.castle.io)
Castle's docs warn that an omitted agent object does not establish that a request came from a human. (docs.castle.io) Castle's Free plan includes USD 5 of API usage, about 5,000 IP lookups or 1,000 Risk API calls, and Pro costs USD 200 a month with USD 200 of usage. (castle.io) Castle's homepage marks AI agent detection as new and describes it as identifying AI agents and browser automation tools in an application. (castle.io)
Products and plans
| Product | What it does | Price model | From | As of |
|---|---|---|---|---|
| Castle Risk API with AI agent identification | Bot and abuse scores plus an agent object naming the agent and how it was identified. | usage-based plans | USD 0 | 2026-11-05 |
Standards
| Standard | Status | Evidence |
|---|---|---|
| Web Bot Auth | Supports | Castle verifies Web Bot Auth signatures for supported signers. (docs.castle.io) |
| Visa Trusted Agent Protocol | No statement | No statement in the Castle docs read 2026-11-05. |
| Mastercard Agent Pay | No statement | No statement in the Castle docs read 2026-11-05. |
Our checks
| Check | Result | Method | Date |
|---|---|---|---|
| Homepage fetch | HTTP 200 | GET with the crawl user agent after a robots.txt check | 2026-11-05 |
What Castle does not do
- Castle does not block requests at the edge; it returns scores and agent identity to the customer's backend, which decides.
- Castle does not use agent identity to change its bot or abuse scores.
Related pages on this site
Sources
Last reviewed 2026-11-05