{
 "name": "Crawler IP Verifier — AI Crawler Index",
 "description": "Verify at volume that an address really belongs to the crawler operator it claims. Hand it up to 500 addresses and it says, for each, which operator prefix contains it, from which published source and when that source was last mirrored; hand it a CIDR and it reports every published prefix that contains, is contained by or overlaps it; ask it for an allowlist and it returns a paste-ready nginx, apache, haproxy, Cloudflare, ipset, caddy or plain-CIDR config. It also says which operators can be verified by prefix at all and which need the two-step reverse-DNS check — which it hands you as a command and never runs, because it makes no outbound request of any kind. Absence from a range list is reported as a miss, never as proof of a forgery. Deterministic and read-only: there is no model behind it — every answer comes from a public dataset rebuilt every six hours from each operator's own published documentation and IP ranges, and the same skills are also available as MCP tools at https://www.pathwren.workers.dev/mcp/netcheck. No key, no signup, no quota. Independent and unaffiliated with any operator it documents. TO CALL IT: send `message/send` (v1.0 name `SendMessage`) — the first example on every skill below is a complete request you can POST unedited, and it comes back as a Task already in state `completed` in the same response, so there is nothing to poll. Nothing to hand over? The `whoami` skill takes no arguments and answers about you. Every skill on all eight agents of this host as a ready-to-send body: https://www.pathwren.workers.dev/a2a/example.json",
 "supportedInterfaces": [
  {
   "url": "https://www.pathwren.workers.dev/a2a/netcheck",
   "protocolBinding": "JSONRPC",
   "protocolVersion": "1.0"
  }
 ],
 "url": "https://www.pathwren.workers.dev/a2a/netcheck",
 "preferredTransport": "JSONRPC",
 "protocolVersion": "1.0",
 "provider": {
  "organization": "Pathwren",
  "url": "https://www.pathwren.workers.dev"
 },
 "version": "1.0.0",
 "documentationUrl": "https://www.pathwren.workers.dev/a2a.html",
 "iconUrl": "https://www.pathwren.workers.dev/icon.png",
 "capabilities": {
  "streaming": false,
  "pushNotifications": false,
  "extendedAgentCard": false,
  "extensions": [
   {
    "uri": "https://www.pathwren.workers.dev/changes.json",
    "description": "Since-cursor change feed over everything this agent answers from: GET /changes.json?since=<cursor> returns only what moved — operator IP-range lists that gained or lost prefixes, upstreams that failed or recovered, crawler records added or edited. Read `cursor` from the answer and send it back next time; it advances only on a real change, so an unchanged answer is proof and costs about 2.5 KB. The same feed is the changes_since skill on this endpoint.",
    "required": false,
    "params": {
     "cursorParameter": "since",
     "transport": "https-get",
     "minPollSeconds": 21600,
     "skill": "changes_since",
     "siblingDocument": "https://www.pathwren.workers.dev/data/agents.json"
    }
   },
   {
    "uri": "https://www.pathwren.workers.dev/mcp/netcheck",
    "description": "THE SAME AGENT ON THE OTHER PROTOCOL. Every skill on this card is also a tool on an MCP (Model Context Protocol) server at https://www.pathwren.workers.dev/mcp/netcheck — same name, same arguments, same answer, because one function answers both doors and a deploy that let them drift is refused. JSON-RPC 2.0 over a single HTTP POST: no session to open, no SSE stream to hold, no key, no signup, no quota. If your runtime speaks MCP rather than A2A, add that URL as a server and you have everything on this card without writing an A2A client. `params.initialize` and `params.callATool` are COMPLETE request bodies — POST either one unedited and it answers; `params.curl` is the same thing as one line. The tool named `example` takes no arguments at all and runs this server's own worked example end to end, so the first call needs nothing you do not already have.",
    "required": false,
    "params": {
     "protocol": "MCP (Model Context Protocol)",
     "endpoint": "https://www.pathwren.workers.dev/mcp/netcheck",
     "transport": "streamable-http (JSON-RPC 2.0 in one HTTP POST; the response is JSON, not a stream)",
     "protocolVersions": [
      "2026-07-28",
      "2025-11-25",
      "2025-06-18",
      "2025-03-26",
      "2024-11-05"
     ],
     "authentication": "none",
     "a2aTwin": "https://www.pathwren.workers.dev/a2a/netcheck",
     "toolNamesEqualSkillIds": true,
     "sameImplementation": "Each skill on this card and the tool of the same name on that server are answered by one function; the deploy gate compares them skill by skill.",
     "initialize": {
      "jsonrpc": "2.0",
      "id": 1,
      "method": "initialize",
      "params": {
       "protocolVersion": "2026-07-28",
       "capabilities": {},
       "clientInfo": {
        "name": "example-client",
        "version": "1.0.0"
       }
      }
     },
     "callATool": {
      "jsonrpc": "2.0",
      "id": 2,
      "method": "tools/call",
      "params": {
       "name": "example",
       "arguments": {}
      }
     },
     "curl": "curl -s https://www.pathwren.workers.dev/mcp/netcheck -H 'content-type: application/json' -d '{\"jsonrpc\":\"2.0\",\"id\":2,\"method\":\"tools/call\",\"params\":{\"name\":\"example\",\"arguments\":{}}}'",
     "everyToolAsABody": "https://www.pathwren.workers.dev/tools/",
     "discovery": "https://www.pathwren.workers.dev/.well-known/mcp.json"
    }
   }
  ]
 },
 "defaultInputModes": [
  "application/json",
  "text/plain"
 ],
 "defaultOutputModes": [
  "application/json",
  "text/plain"
 ],
 "skills": [
  {
   "id": "verify_batch",
   "name": "Verify many addresses at once",
   "description": "Check up to 500 addresses against every mirrored operator prefix list in one call. Returns, per address, the matching prefix, the source that published it and when it was mirrored, plus a rollup by operator. Accepts {ip, claim} pairs to test a claimed identity against the ranges, and says plainly that a miss is not evidence of a fake. Example: addresses=[{ip:'66.249.66.1', claim:'Googlebot'}, {ip:'203.0.113.9', claim:'GPTBot'}] — the first matches a published Google prefix, the second matches nothing. Also callable without MCP, same implementation: GET https://www.pathwren.workers.dev/tools/verify-crawler?ip=66.249.66.1&ua=Googlebot&s=client-dossiers",
   "tags": [
    "ip ranges",
    "verification",
    "bot detection",
    "batch"
   ],
   "examples": [
    "{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"message/send\",\"params\":{\"message\":{\"role\":\"ROLE_USER\",\"messageId\":\"1\",\"parts\":[{\"text\":\"{\\\"skill\\\":\\\"verify_batch\\\",\\\"addresses\\\":[\\\"20.171.206.5\\\",\\\"66.249.66.1\\\",\\\"203.0.113.9\\\"]}\"}]}}}",
    "{\"skill\":\"verify_batch\",\"addresses\":[\"20.171.206.5\",\"66.249.66.1\",\"203.0.113.9\"]}",
    "is 20.171.206.5 or 66.249.66.1 a published crawler address"
   ],
   "inputModes": [
    "application/json",
    "text/plain"
   ],
   "outputModes": [
    "application/json",
    "text/plain"
   ]
  },
  {
   "id": "lookup_prefix",
   "name": "Prefix arithmetic against published ranges",
   "description": "Give a CIDR and get every published operator prefix that contains it, is contained by it, or partially overlaps it — the check for 'does my network collide with a crawler range' and for auditing an allowlist somebody handed you. Give an operator or source slug instead and get everything that source publishes. Example: cidr='66.249.66.0/24'.",
   "tags": [
    "cidr",
    "ip ranges",
    "network",
    "lookup"
   ],
   "examples": [
    "{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"message/send\",\"params\":{\"message\":{\"role\":\"ROLE_USER\",\"messageId\":\"1\",\"parts\":[{\"text\":\"{\\\"skill\\\":\\\"lookup_prefix\\\",\\\"cidr\\\":\\\"66.249.64.0/19\\\"}\"}]}}}",
    "{\"skill\":\"lookup_prefix\",\"cidr\":\"66.249.64.0/19\"}",
    "lookup_prefix 20.171.206.0/24"
   ],
   "inputModes": [
    "application/json",
    "text/plain"
   ],
   "outputModes": [
    "application/json",
    "text/plain"
   ]
  },
  {
   "id": "export_ip_acl",
   "name": "Paste-ready allowlist or denylist",
   "description": "Turn a set of operators into a config you can paste: nginx geo, nginx allow/deny, Apache, HAProxy, a Cloudflare firewall expression, an ipset script, a Caddy matcher, or a plain CIDR list. Every export carries a provenance header naming each source URL and the mirror time, and reports the rule cost. Example: operators='all', format='cidr-list', action='allow'.",
   "tags": [
    "firewall",
    "nginx",
    "allowlist",
    "configuration"
   ],
   "examples": [
    "{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"message/send\",\"params\":{\"message\":{\"role\":\"ROLE_USER\",\"messageId\":\"1\",\"parts\":[{\"text\":\"{\\\"skill\\\":\\\"export_ip_acl\\\",\\\"operators\\\":[\\\"openai\\\"],\\\"format\\\":\\\"nginx-allow-deny\\\",\\\"action\\\":\\\"allow\\\"}\"}]}}}",
    "{\"skill\":\"export_ip_acl\",\"operators\":[\"openai\"],\"format\":\"nginx-allow-deny\",\"action\":\"allow\"}"
   ],
   "inputModes": [
    "application/json",
    "text/plain"
   ],
   "outputModes": [
    "application/json",
    "text/plain"
   ]
  },
  {
   "id": "verification_methods",
   "name": "Can this crawler be verified at all, and how?",
   "description": "Per crawler: whether the operator publishes IP ranges, documents reverse DNS, or publishes no verification method at all — with the exact source URL or the exact dig commands, and how fresh this mirror is. Call it before reading anything into an address that matched nothing. Reverse DNS is never run here; the command is handed back instead. Example: crawler='claudebot'. Also callable without MCP, same implementation: GET https://www.pathwren.workers.dev/tools/verification-methods?crawler=claudebot&s=client-dossiers",
   "tags": [
    "verification",
    "reverse dns",
    "operators",
    "method"
   ],
   "examples": [
    "{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"message/send\",\"params\":{\"message\":{\"role\":\"ROLE_USER\",\"messageId\":\"1\",\"parts\":[{\"text\":\"{\\\"skill\\\":\\\"verification_methods\\\",\\\"crawler\\\":\\\"gptbot\\\"}\"}]}}}",
    "{\"skill\":\"verification_methods\",\"crawler\":\"gptbot\"}",
    "how do I verify claudebot"
   ],
   "inputModes": [
    "application/json",
    "text/plain"
   ],
   "outputModes": [
    "application/json",
    "text/plain"
   ]
  },
  {
   "id": "range_stats",
   "name": "The state of the mirror",
   "description": "Takes no arguments. Safe to call. Deterministic. Touches no third party. Per source: prefix counts, total addresses and /24-equivalents, smallest and largest prefix, the publishing URL and when it was last fetched; plus prefixes published by more than one operator. This is the sizing and freshness information an allowlist decision needs. Example: {} — no arguments at all.",
   "tags": [
    "freshness",
    "monitoring",
    "data quality",
    "mirror"
   ],
   "examples": [
    "{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"message/send\",\"params\":{\"message\":{\"role\":\"ROLE_USER\",\"messageId\":\"1\",\"parts\":[{\"text\":\"{\\\"skill\\\":\\\"range_stats\\\"}\"}]}}}",
    "{\"skill\":\"range_stats\"}",
    "how fresh is the ip range mirror"
   ],
   "inputModes": [
    "application/json",
    "text/plain"
   ],
   "outputModes": [
    "application/json",
    "text/plain"
   ]
  },
  {
   "id": "whoami",
   "name": "Who is calling? (no arguments)",
   "description": "Takes no arguments. Safe to call. Deterministic. Touches no third party. Classifies the request you just sent: the user-agent you claim, the address you came from, the class this host's own instrument books you as, whether we have seen you here before and what you fetched, and what this host's robots policy says about you. Every fact comes from the headers on your own request or from a file this host already publishes — nothing is fetched, nothing about you is invented, no argument exists. Example: arguments={} returns your user-agent, your address, the class we book you as and whether we have seen you here before.",
   "tags": [
    "identify",
    "no arguments",
    "diagnostics",
    "user-agent"
   ],
   "examples": [
    "{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"message/send\",\"params\":{\"message\":{\"role\":\"ROLE_USER\",\"messageId\":\"1\",\"parts\":[{\"text\":\"{\\\"skill\\\":\\\"whoami\\\"}\"}]}}}",
    "{\"skill\":\"whoami\"}",
    "whoami",
    "who am i to you"
   ],
   "inputModes": [
    "application/json",
    "text/plain"
   ],
   "outputModes": [
    "application/json",
    "text/plain"
   ]
  },
  {
   "id": "example",
   "name": "Run this server's worked example (no arguments)",
   "description": "Takes no arguments. Safe to call. Deterministic. Touches no third party. Runs this server's own worked example end to end — one of its real tools, on a canned input taken from this host's own published data — and returns exactly the structuredContent a real call returns, not a mock and not a description of one. Use it to see the shape of an answer before you decide what to send. No URL of yours is fetched and no third party is touched. Example: arguments={} runs it and returns the real answer.",
   "tags": [
    "example",
    "no arguments",
    "demo",
    "getting started"
   ],
   "examples": [
    "{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"message/send\",\"params\":{\"message\":{\"role\":\"ROLE_USER\",\"messageId\":\"1\",\"parts\":[{\"text\":\"{\\\"skill\\\":\\\"example\\\"}\"}]}}}",
    "{\"skill\":\"example\"}",
    "example",
    "show me a worked example"
   ],
   "inputModes": [
    "application/json",
    "text/plain"
   ],
   "outputModes": [
    "application/json",
    "text/plain"
   ]
  }
 ]
}