About Ghost Agents

Ghost Agents are AI agents that test whether a site's key journeys, such as search, checkout or sign-up, work for AI agents. A Ghost Agent Labs customer sets up each test for a site they've added to their account and chooses when it runs.

How it identifies itself

Ghost Agents use a normal Chrome browser user agent with this added at the end:

GhostAgent/1.0 (+https://ghostagentlab.com/ghost-agent)

How to check it's really us

Ghost Agent requests are signed with Web Bot Auth (HTTP Message Signatures). Each carries a Signature-Agent header pointing to https://app.ghostagentlab.com, where our public key is published at /.well-known/http-message-signatures-directory. Anyone can copy a user agent, but only we can produce the signature, so services that check it, such as Cloudflare's verified bots, can tell our traffic from impostors.

We don't use fixed IP addresses yet, so please allow us by signature or user agent rather than by IP.

What it does

• Works through one journey per run, like a customer would: reading pages, clicking, typing and filling in forms.
• Types only the test data the customer supplies for the test, such as a test email address.
• Stops when it reaches a payment form, and never enters card details.
• Refuses buttons that place orders, pay, or delete or cancel accounts.
• Stays on the site it's testing.
• Stops after 40 steps or 5 minutes per run, whichever comes first.

How to opt out

If Ghost Agents are testing your site and you didn't set that up, email bot@ghostagentlab.com from an address at your domain and we'll stop the tests.