CrawlCheck Skip to content

Menu

For agents

The door: what an agent should know before it acts on a site

Quickstart: ask before you act

MCP, curl, Python, OpenAI Agents, Claude tool use, LangChain

The signed answer about any domain, laid out for a person

How each named agent behaves on sites, from verified requests

Capability registry

What sites declare agents can do, and what was verified

Verify a record

Check any answer or bundle on your own machine

Before you act

One signed answer, no key.

Read, cite, connect or transact: ask first, verify the receipt offline, keep it with the action.

Start in a minute

For sites

The door: scan free, have it fixed, keep it fixed

The checks behind the audit, one at a time

Is your business record right where agents look?

Compare two sites

Two domains, side by side, same measurement

What search and answer engines read from a video

Browser extension

The second vantage point: from your own address, after JavaScript

The record on your phone, with receipts

Your site

Measured as agents see it.

A free A–F audit with every defect named, no account. Fix it, then prove it held.

Developers

The door: the API by lane, the specs, SDKs, keys and quotas

Every endpoint, with a worked example from production

Resolve protocol

The signed answer: what it holds, how to verify it

SDKs: npm and PyPI

Typed clients, the offline verifier, conformance fixtures

The Ed25519 keys every answer is signed with

Every finding the measurement can raise, with its revision

Run the suite against your own implementation

Data

The door: census, conduct, proof and datasets, each with a denominator

Signed decisions, scans and crawler visits, counted

Proof and timestamps

How every record is sealed and anchored

CC BY 4.0 snapshots and the archive

SEO and AI tools, measured

The vendors that measure sites, measured by the same rules

Registry: media kits, llms.txt, entity graphs

Verified machine-readable profiles of real organisations

Learn

The door: guides, findings and the glossary, from measurements

The scan, stage by stage, and what each grade means

How to check one thing, with the rate at which it fails

Dated cases from real scans, with the bytes behind them

Every term the product uses, defined

Who sends each agent, what it reads, how to verify it

Pricing Sign in

Glossary · Security and privacy

SSRF

Server-side request forgery, where attacker-controlled input makes a server request unintended internal or external resources.

What SSRF means

URL parsing, redirects, DNS changes, and metadata endpoints all matter.

Terms this definition uses

Related terms in Security and privacy

Where an agent, a tool or a page can be turned against its operator, and the controls that limit the damage without proving safety.

lookalike domain · homoglyph · incident switch · high-risk field · Indirect prompt injection · Direct prompt injection · Jailbreak · Data exfiltration · Sensitive information disclosure · Secret leakage · Insecure output handling · Excessive agency · Least privilege · Trust boundary · Input validation · Output validation · Allowlist · Denylist · RCE · Credential scope · OAuth scope · API key · Bearer token · mTLS · Rate-limit policy · Audit log · PII · Data minimization · Purpose limitation · Retention period · Data residency · Tenant isolation · Threat model · DMARC · DMARC alignment · SPF · DKIM · MTA-STS · TLS-RPT · CAA record · DNSSEC · hard bounce

Questions about SSRF

What is SSRF?

Server-side request forgery, where attacker-controlled input makes a server request unintended internal or external resources.

Which area of the glossary does SSRF belong to?

Security and privacy: Where an agent, a tool or a page can be turned against its operator, and the controls that limit the damage without proving safety.

← Denylist · RCE →

See it in the full glossary · 731 terms across 19 areas.