This is the canonical documentation for ParleoAuditBot.
ParleoAuditBot
Operator: Parleo (parleo.io)
Purpose: agentic-commerce audits — reading public product pages the
way AI shopping agents do, to measure and improve agent readiness.
Last updated: September 22, 2026
User-Agent string (sent on every request, unchanged):
Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ParleoAuditBot/1.0; +https://bots.parleo.io
How to confirm a request is really us
Every request from ParleoAuditBot is cryptographically signed per
RFC 9421 (HTTP Message Signatures), using the emerging
Web Bot Auth profile — an Ed25519 signature over the request,
carried in the Signature/Signature-Input headers, plus a
Signature-Agent header pointing at our published key directory:
https://bots.parleo.io/.well-known/http-message-signatures-directory
We prefer Web Bot Auth verification over IP allowlists. A signature proves identity independent of which address a request came from. A request claiming to be ParleoAuditBot that isn't signed, or doesn't verify against the key directory above, should not be trusted as us.
Egress IP addresses
ParleoAuditBot makes outbound requests from a fixed set of IPv4 addresses. The current list is published at https://bots.parleo.io/ips.txt, one address per line, and is updated whenever the set changes.
Treat the IP list as a secondary signal for allowlist tooling that requires one. The primary identity mechanism is the Web Bot Auth request signature verified against the key directory above.
What we read
- Public product pages and their metadata
- Schema.org structured data (Product, Offer, and related types)
- Sitemap and robots.txt signals
- Public agent-protocol surfaces — llms.txt, MCP well-known manifests, UCP discovery
What we don't do
- Never reads authenticated, paywalled, or otherwise private content
- Never collects personal shopper data
- A bounded per-site fetch budget — about a dozen pages per audit (currently 12)
- Honors robots.txt, including Crawl-delay
- Not a search-engine indexer — nothing we read is published or resold as a search index
Controlling access
Allow every path (the default — no rule needed, but shown explicitly here):
User-agent: ParleoAuditBot Allow: /
Block specific paths, e.g. account and checkout flows:
User-agent: ParleoAuditBot Disallow: /account/ Disallow: /checkout/
Block us entirely:
User-agent: ParleoAuditBot Disallow: /