--- title: "Verified bot programmes compared | Agent Ready Crawlers" description: "IP lists, reverse DNS, Web Bot Auth, Cloudflare signed agents, Visa TAP and Mastercard Agent Pay compared: what a site checks and which Index rows use each." canonical: https://agentreadycrawlers.com/verification/programmes-compared site: "Agent Ready Crawlers" last_updated: 2026-11-05 date: 2026-11-04 section: "Verification" --- # Verified bot programmes compared | Agent Ready Crawlers > IP lists, reverse DNS, Web Bot Auth, Cloudflare signed agents, Visa TAP and Mastercard Agent Pay compared: what a site checks and which Index rows use each. Source: https://agentreadycrawlers.com/verification/programmes-compared Site: Agent Ready Crawlers Last reviewed: 2026-11-05 # Verified bot programmes compared In short Of 70 Index rows, 17 publish an IP list, 9 a reverse DNS pattern, 8 sign with Web Bot Auth, and Cloudflare's signed agent list covers 1; 35 publish nothing a site can check. Visa and Mastercard run programmes whose registries are not public. A user-agent string proves nothing, since anyone can send it. The ways to check who sent a request fall into four groups of proof, plus two card-network programmes for agents that buy. This page sets them side by side and counts which of the 70 Index rows use each. ## Index rows by method Rows in the Crawler Index by the verification method the operator publishes, read 2026-11-04; Ora's OraBot, read 2026-11-05, counts as Web Bot Auth. | Method | What it proves | Rows | Which rows | Note | | --- | --- | --- | --- | --- | | Published IP list | The request came from an address on the operator's list. | 17 | GPTBot, OAI-SearchBot, ChatGPT-User, OAI-AdsBot, ClaudeBot and Claude-User and 11 more | 10 ledger operators publish one. | | Reverse DNS | The address resolves to the operator's domain and back to the same address. | 9 | Googlebot, Google-CloudVertexBot, GoogleOther, Storebot-Google, Applebot and Bingbot and 3 more | No list to fetch, and it needs a lookup per address. | | Web Bot Auth | The request carries a signature that verifies against a public key the operator publishes. | 8 | ChatGPT agent, Google-Agent, Amazon Bedrock AgentCore Browser, Apify Website Content Crawler, Browserbase cloud browsers and Cloudflare Browser Rendering and 2 more | 4 ledger operators serve a key directory. | | Cloudflare signed agents and verified bots | Cloudflare has confirmed the bot belongs to its operator and lists it for rules. | 1 | Goose | 6 ledger operators show a Cloudflare listing. | | Nothing published | Nothing: a site has the user-agent string and the source address, and no operator material to compare them with. | 35 | Includes the agents that run in a visitor's own browser. | 50 percent of the Index. | ## Programmes for agents that buy Two card-network programmes build on Web Bot Auth for agents that pay. Neither is a crawler, so neither is a row in the Index, and the ledger found no public list of registered agents for either. [Visa Trusted Agent Protocol](https://agentreadycrawlers.com/glossary/visa-trusted-agent-protocol/) Visa's specification for agents to present a signature with timestamps that merchants verify to tell a credentialed agent from an anonymous bot. In the ledger: reference implementation at github.com/visa/trusted-agent-protocol (agent-registry folder); no public list of registered agents found. [Mastercard Agent Pay](https://agentreadycrawlers.com/glossary/mastercard-agent-pay/) Mastercard's programme for registered agents to transact, which signs agent traffic with Web Bot Auth so merchants and CDNs can verify it. In the ledger: developer docs are a JavaScript shell to plain fetch; no public list of registered agents found (checked 2026-11-04). [How to let Visa TAP and Mastercard Agent Pay agents through](https://agentreadycrawlers.com/guides/let-tap-and-agent-pay-through/) covers the rules. A site that wants to admit these agents checks the signature, since there is no registry to look up. ## Which proof to ask for Ask for the strongest proof the operator offers. A signature survives a change of address; an IP list and reverse DNS depend on the sender's network. Where an operator offers none, a site is left with the string, and a rule on the string alone admits any copy of it. [How to verify Web Bot Auth signatures](https://agentreadycrawlers.com/guides/verify-web-bot-auth/) and [how to test whether agents can reach your site](https://agentreadycrawlers.com/guides/test-whether-ai-agents-can-reach-your-site/) show the checks. ## Sources - [The age of agents: cryptographically recognizing agent traffic](https://blog.cloudflare.com/signed-agents/) read 2026-11-04 - [Visa Trusted Agent Protocol (GitHub)](https://github.com/visa/trusted-agent-protocol) read 2026-11-04 - [Securing agentic commerce: helping AI Agents transact with Visa and Mastercard](https://blog.cloudflare.com/secure-agentic-commerce/) read 2026-11-04 - [Verify requests from Google](https://developers.google.com/crawling/docs/crawlers-fetchers/verify-google-requests) read 2026-11-04 - [openai.com: gptbot (JSON)](https://openai.com/gptbot.json) read 2026-11-04 - [Ora's scanner bot page (vendor)](https://ora.ai/bot?utm_source=agentreadycrawlers.com&utm_medium=referral&utm_campaign=comparison) read 2026-11-05 Last reviewed 2026-11-05