Agent card purpose

What this check verifies

The Signature Agent Card is optional metadata describing the agent behind a Web Bot Auth deployment, defined in the web-bot-auth registry draft (draft-meunier-webbotauth-registry-03). It is separate from the JWKS directory and has no fixed well-known path.

This check looks for a purpose member and confirms it is a non-empty string. In the registry-03 shape it sits inside the web_bot_auth object; in the older registry-02 shape it sits at the top level. The checker reads either, preferring web_bot_auth.

The value describes the intended use of the data the agent collects. The draft asks for values from a controlled vocabulary, such as the AI preferences vocabulary, and gives search and tdm as examples (section 3.2.5).

This check is advisory. A missing purpose lowers the score slightly and raises a warning, but it never caps the grade and never changes the verdict. A directory with valid keys is VALID even with no card at all.

Why it matters

Knowing who runs an agent does not tell a site operator why it visits. The purpose answers that, so an operator can decide whether to allow, rate-limit, or block the agent based on what it is for rather than guessing from traffic. A stated purpose also sets an expectation the operator can hold the agent to.

How to fix it

Add a purpose string to the web_bot_auth object:

{ "web_bot_auth": { "purpose": "search" } }

Use a vocabulary term where one fits, so a reader can tell whether they want this agent on their site.

References

• The web-bot-auth registry draft (draft-meunier-webbotauth-registry-03), section 3.2.5, defines the purpose member of the web_bot_auth object.
• What is a Signature Agent Card? explains the card and how it differs from an A2A or MCP agent card.
• How grading works explains why card checks are advisory.