MCPcopy Index your code
hub / github.com/cloudflare/web-bot-auth

github.com/cloudflare/web-bot-auth @v0.1.3

Chat with this repo
repository ↗ · DeepWiki ↗ · release v0.1.3 ↗ · + Follow
755 symbols 1,087 edges 41 files 66 documented · 9%
What it actually does AI analysis from the code graph — generated when you open this
loading…
README

Web Bot Auth

GitHub License

Repository presenting authentication for orchestrated agents navigating the web. It implements all components required by Web Bot Authentication defined by draft-meunier-web-bot-auth-architecture, and presents examples.

Tables of Content

Examples

Live deployment

Cloudflare Research provides a live environment at http-message-signatures-example.research.cloudflare.com.

This deployment allows to test your implementation.

  1. It validates the presence of a Signature header signed RFC9421 ed25519 test key,
  2. It exposes a bot directory on /.well-known/http-message-signatures-directory,
  3. It provides explanation about the protocol.

Signing

Example Description
Browser extension Adds a Signature on every outgoing request
Rust Signs a hardcoded test request

Verifying

Example Description
Cloudflare Workers Verify RFC 9421 Signature for every incoming request
Caddy Plugin Verify RFC 9421 Signature for every incoming request
Rust Verify a sample test request

HTTP Signature Directories

Example Description
Cloudflare Workers Host a signature directory on Cloudflare Workers, using the signature agent card and registry format

Development

This repository uses npm and cargo workspaces. There are several packages which it provides:

Package Language Description
http-message-sig TypeScript HTTP Message Signatures as defined in RFC 9421
jsonwebkey-thumbprint TypeScript JWK Thumbprint as defined in RFC 7638
web-bot-auth TypeScript HTTP Message Signatures for Bots as defined in draft-meunier-web-bot-auth-architecture
web-bot-auth Rust HTTP Message Signatures for Bots as defined in draft-meunier-web-bot-auth-architecture
http-signature-directory Rust Validates whether an HTTP message signature directory is correctly signed and valid

Security Considerations

This software has not been audited. Please use at your sole discretion.

License

This project is under the Apache 2.0 license.

Contribution

Unless you explicitly state otherwise, any contribution intentionally submitted for inclusion in the work by you shall be Apache 2.0 licensed as above, without any additional terms or conditions.

Extension points exported contracts — how you extend this code

SignedMessage (Interface)
Trait that messages seeking verification should implement to facilitate looking up raw values from the underlying messag [10 …
crates/web-bot-auth/src/message_signatures.rs
SendEmail (Interface)
* A binding that allows a Worker to send email messages. [1 implementers]
examples/verification-workers/worker-configuration.d.ts
Signer (Interface)
(no doc) [2 implementers]
packages/http-message-sig/src/types.ts
SignatureParams (Interface)
(no doc)
packages/web-bot-auth/src/index.ts
UnsignedMessage (Interface)
Trait that messages seeking signing should implement to generate `Signature-Input` and `Signature` header contents. [4 …
crates/web-bot-auth/src/message_signatures.rs
ServiceWorkerGlobalScope (Interface)
* This ServiceWorker API interface represents the global execution context of a service worker. * Available only in sec
examples/verification-workers/worker-configuration.d.ts
SignatureParams (Interface)
(no doc)
packages/http-message-sig/src/directory.ts
VerificationParams (Interface)
(no doc)
packages/web-bot-auth/src/index.ts

Core symbols most depended-on inside this repo

clone
called by 23
examples/verification-workers/worker-configuration.d.ts
log
called by 15
examples/verification-workers/worker-configuration.d.ts
get
called by 12
packages/http-message-sig/src/types.ts
replace
called by 11
examples/verification-workers/worker-configuration.d.ts
extractComponent
called by 10
packages/http-message-sig/src/build.ts
generateNonce
called by 10
packages/web-bot-auth/src/index.ts
extractHeader
called by 8
packages/http-message-sig/src/build.ts
validateNonce
called by 8
packages/web-bot-auth/src/index.ts

Shape

Interface 283
Method 246
Class 123
Function 88
Enum 12
Struct 3

Languages

TypeScript84%
Rust14%
Go1%
Python1%

Modules by API surface

examples/verification-workers/worker-configuration.d.ts535 symbols
crates/web-bot-auth/src/message_signatures.rs30 symbols
crates/web-bot-auth/src/lib.rs20 symbols
crates/web-bot-auth/src/components.rs18 symbols
crates/web-bot-auth/src/keyring.rs16 symbols
packages/web-bot-auth/src/crypto.ts13 symbols
packages/http-message-sig/src/types.ts12 symbols
packages/web-bot-auth/src/index.ts10 symbols
packages/http-message-sig/src/build.ts9 symbols
crates/http-signature-directory/src/main.rs8 symbols
packages/jsonwebkey-thumbprint/test/index.bench.ts7 symbols
examples/verification-workers/src/index.ts7 symbols

For agents

$ claude mcp add web-bot-auth \
  -- python -m otcore.mcp_server <graph>

⬇ download graph artifact