# AgentGrade

What this client asked https://www.pathwren.workers.dev for, from that host's own request log.
Window: 2026-09-01 02:53:17Z to 2026-09-03 02:53:44Z UTC. Generated 2026-09-14.

## User-agent strings, exactly as they arrived

- `AgentGrade/1.0 (security research; agentgrade.net)` — 155 request(s), 1 address(es), 2026-09-01 02:53:17Z to 2026-09-03 02:53:44Z

- Requests: 155
- Distinct addresses (salted hashes, never published): 1
- Distinct paths: 22
- Visits (30-minute gap rule): 3
- Status codes: 404×98, 200×57
- Accept headers: */*
- Our classifier called it: agent×155 (ours, from the user-agent)

## What it asked for, in order

1. `/mcp` — 2026-09-01 02:53:17Z — 200
2. `/admin` — 2026-09-01 02:53:17Z — 404
3. `/dashboard` — 2026-09-01 02:53:17Z — 404
4. `/_internal` — 2026-09-01 02:53:17Z — 404
5. `/` — 2026-09-01 02:53:18Z — 200
6. `/.env` — 2026-09-01 02:53:19Z — 404
7. `/.git/config` — 2026-09-01 02:53:19Z — 404
8. `/.git/HEAD` — 2026-09-01 02:53:19Z — 404
9. `/debug` — 2026-09-01 02:53:19Z — 404
10. `/server-status` — 2026-09-01 02:53:19Z — 404
11. `/.env.local` — 2026-09-01 02:53:19Z — 404
12. `/config.json` — 2026-09-01 02:53:19Z — 404
13. `/appsettings.json` — 2026-09-01 02:53:19Z — 404
14. `/package.json` — 2026-09-01 02:53:20Z — 404
15. `/agentgrade-404-check-xyz` — 2026-09-01 02:53:20Z — 404
16. `/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA` — 2026-09-01 02:53:20Z — 404
17. `/c/mcp-registry-official/mcp` — 2026-09-01 02:53:21Z — 200
18. `/c/mcp-registry-official/mcp/triage` — 2026-09-01 02:53:25Z — 200
19. `/c/mcp-registry-official/mcp/doctor` — 2026-09-02 02:46:45Z — 200
20. `/c/mcp-registry-official/mcp/netcheck` — 2026-09-02 02:46:46Z — 200
21. `/c/mcp-registry-official/mcp/robots` — 2026-09-02 02:46:48Z — 200
22. `/c/mcp-registry-official/mcp/lint` — 2026-09-03 02:53:43Z — 200

## What it asked for that did not exist

- `/admin` — 404×7 — first asked 2026-09-01 02:53:17Z; still absent, on purpose — There is no admin interface, because there is nothing to administer at the edge: content is rebuilt and redeployed wholesale, never edited in place. (https://www.pathwren.workers.dev/security.html)
- `/dashboard` — 404×7 — first asked 2026-09-01 02:53:17Z; still absent, on purpose — Same: no dashboard exists (https://www.pathwren.workers.dev/security.html)
- `/_internal` — 404×7 — first asked 2026-09-01 02:53:17Z; still absent, on purpose — No route on this host is internal (https://www.pathwren.workers.dev/security.html)
- `/.env` — 404×7 — first asked 2026-09-01 02:53:19Z; still absent, on purpose — Secrets are Cloudflare Worker secrets, never files in the served directory (https://www.pathwren.workers.dev/security.html)
- `/.git/config` — 404×7 — first asked 2026-09-01 02:53:19Z; still absent, on purpose — No repository is deployed (https://www.pathwren.workers.dev/security.html)
- `/.git/HEAD` — 404×7 — first asked 2026-09-01 02:53:19Z; still absent, on purpose — Same as /.git/config. (https://www.pathwren.workers.dev/security.html)
- `/debug` — 404×7 — first asked 2026-09-01 02:53:19Z; still absent, on purpose — No framework, no interpreter, no debug mode (https://www.pathwren.workers.dev/security.html)
- `/server-status` — 404×7 — first asked 2026-09-01 02:53:19Z; still absent, on purpose — There is no Apache here — this is a Cloudflare Worker in front of static assets, so mod_status does not exist to expose (https://www.pathwren.workers.dev/security.html)
- `/.env.local` — 404×7 — first asked 2026-09-01 02:53:19Z; still absent, on purpose — Same as /.env. (https://www.pathwren.workers.dev/security.html)
- `/config.json` — 404×7 — first asked 2026-09-01 02:53:19Z; still absent, on purpose — No configuration is served (https://www.pathwren.workers.dev/security.html)
- `/appsettings.json` — 404×7 — first asked 2026-09-01 02:53:19Z; still absent, on purpose — No .NET, and no configuration served. (https://www.pathwren.workers.dev/security.html)
- `/package.json` — 404×7 — first asked 2026-09-01 02:53:20Z; still absent, on purpose — The build's manifest is not deployed to the assets host. (https://www.pathwren.workers.dev/security.html)
- `/agentgrade-404-check-xyz` — 404×7 — first asked 2026-09-01 02:53:20Z; still absent
- `/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA` — 404×7 — first asked 2026-09-01 02:53:20Z; still absent

## Verification

not observed.Checked 2026-09-01 against our own request log.

## Ask this page a question, with one GET

A question about this page, answered by a call you can make right now — no key, no account, no JSON-RPC, nothing to assemble. The query string is already filled in with this page's own subject.

- **What is AgentGrade/1.0 (security research; agentgrade…?**  
  `curl -s 'https://www.pathwren.workers.dev/tools/classify-ua?ua=AgentGrade%2F1.0%20%28security%20research%3B%20agentgrade.net%29&s=client-dossiers'`  
  This exact user-agent run through the catalogue: which crawler it is, who operates it, what the crawl is for, what blocking it costs — or an honest "not recognised" if it is nobody we know.

Every parameter above is a value the endpoint reads, not an address it visits: nothing is fetched on your behalf. Called without any parameter, each endpoint returns its own specification instead of an error.


## What it publishes about you

Not observed. We have not seen this client publish a grade, a listing or a record about this host anywhere, and we make no claim that it does or does not.

## Documentation it names

not observed — no URL in its user-agent

JSON: https://www.pathwren.workers.dev/bot/agentgrade.json · all clients: https://www.pathwren.workers.dev/data/observed-clients.json