Agent card client name

What this check verifies

The Signature Agent Card is optional metadata that describes the agent behind a Web Bot Auth deployment. It is defined in the web-bot-auth registry draft (draft-meunier-webbotauth-registry), separate from the JWKS directory, and has no fixed well-known path: it is linked from the site or directory, or listed in a registry.

This check looks for a client_name member on the card and confirms it is a non-empty string. The value is the human-readable name of the operator or client behind the agent, for example the company or product that runs the bot.

This check is advisory. A missing client_name lowers the score slightly and raises a warning, but it never caps the grade and never changes the verdict. A directory with valid keys is VALID even with no card at all.

Why it matters

The keys in the directory prove that a request comes from whoever holds the private key. They do not say who that is in human terms. The client_name is the plain-language answer: it lets a site operator reading a card, or a registry listing it, see which operator is behind the signatures. Without it the card is harder to attribute to a real party.

How to fix it

Add a client_name string to the card with the operator or product name:

{ "client_name": "Example Crawler" }

Use a name that matches how you identify yourself elsewhere (the operator site, the User-Agent string), so the card is easy to tie back to a known party.

References

• The web-bot-auth registry draft (draft-meunier-webbotauth-registry) defines the Signature Agent Card and its client_name field.
• What is a Signature Agent Card? explains the card and how it differs from an A2A or MCP agent card.
• How grading works explains why card checks are advisory.