relvato.com
Web Bot Auth report
- 25 pass
- 2 warn
- 0 fail
Score 88/100
How grading works
JWKS Directory
/.well-known/http-message-signatures-directory The published set of public keys (a JSON Web Key Set) used to verify signatures.
- Pass Directory URL uses HTTPS
- Pass Reachable (HTTP 200)
- Warn Reached through a redirect from https://relvato.com/.well-known/http-message-signatures-directory to https://www.relvato.com/.well-known/http-message-signatures-directory. Verifiers do not follow redirects, so they find these keys only if your Signature-Agent names https://www.relvato.com directly. Why this matters
- Pass Content-Type: application/http-message-signatures-directory+json
- Pass Body is valid JSON
- Pass Body is a key set
- Pass 1 key(s)
- Pass Key set size within bound
- Pass Cache-Control: public, max-age=300
- Pass All kty = OKP
- Pass All crv = Ed25519
- Pass All x decode to 32 bytes
- Pass No private key material
- Pass Every kid present is the key thumbprint (for example -EV0nMSsKi_EPw3EO4Eq_oVhhU-5Nv5E5vfZBeR7YU8)
- Pass No published test keys
- Pass No duplicate kids
- Pass Key validity windows coherent
- Warn Directory response is self-signed, but the signature does not cover content-digest. The draft requires "@authority";req and content-digest (ietf-protocol-00 Appendix B.1), so the signature does not bind the keys in the body Why this matters
Agent Card
Optional metadata about the agent (operator identity, contacts, robots.txt compliance, rate expectations). It is linked from the site or directory; web-bot-auth defines no fixed well-known path for it, and it is not the same as an A2A or MCP agent card. What is this?
- Pass Agent Card linked: https://relvato.com/.well-known/web-bot-auth-agent-card
- Pass client_name present
- Pass client_uri present
- Pass No client_id; it is required only when the card is fetched through its client_id
- Pass contacts present
- Pass jwks_uri present
- Pass purpose declared
- Pass robots.txt (RFC 9309) compliance declared
- Pass rate expectation declared
Response details / debug
- Directory URL fetched
- https://www.relvato.com/.well-known/http-message-signatures-directory
- HTTP status
- 200
- Content-Type
- application/http-message-signatures-directory+json
- Bytes
- 90
- Agent Card
- https://relvato.com/.well-known/web-bot-auth-agent-card
Raw response snippet (first 4 KB)
{"keys":[{"kty":"OKP","crv":"Ed25519","x":"-N-t5pktcDph7cXOPKTJyyC0FeY4PtSoRpXtr09bqRM"}]}