Ora measures how ready a website is for AI agents. When someone requests a score for your domain, our scanner fetches your public pages and the artifacts agents rely on: robots.txt, llms.txt, OpenAPI specs, MCP manifests, structured data. It visits on demand rather than on a schedule, and a scan is a bounded burst of requests with hard timeouts and body-size caps.
How to verify it
A User-Agent string proves nothing, since anyone can copy it. So we are adopting HTTP Message Signatures (RFC 9421, the Web Bot Auth profile): our scanner will sign its requests with an Ed25519 key, and each request will carry Signature, Signature-Input and Signature-Agent headers.Our public keys are published now, ahead of the signing itself, so verifiers can list us before any of our traffic changes. Until signing is live our requests carry no signature, and nothing that claims to be Ora can be verified - so treat unsigned traffic on our User-Agent with the same suspicion you would treat any other unverified bot.The keys themselves live at https://ora.ai/.well-known/http-message-signatures-directory. Anything claiming to be us that fails verification against those keys is not us, and you should treat it like any other unidentified bot.
The requests we do not sign
One part of a scan checks whether your site is reachable to AI crawlers at all, so during a scan we send a handful of requests carrying other crawlers' User-Agent strings (GPTBot, ClaudeBot, PerplexityBot and similar) at your homepage, and we record how your site answers.Those requests will stay unsigned even once signing is live. Signing them as Ora would contradict the User-Agent they carry and destroy the measurement, which is the whole point of sending them. We would rather state this plainly than have you discover crawler traffic from our range and read it as evasion. It is a small number of requests per scan, only ever against the homepage.
If we are causing you trouble
Write to hello@ora.ai. If you would rather we did not scan your site at all, say so and we will exclude the domain.