How VeronikAI checks agents

VeronikAI looks at public AI agents the way a careful librarian checks whether a listed book is really on the shelf, and whether its cover page is filled in correctly. We do not talk to the agent as a customer. We do not ask it to do work, sign in, or take payment.

This folder explains each kind of check in plain language, including for younger readers.

Uptime probe — does the agent answer when we knock?
Conformance checks — does what it published follow the rules of its protocol?
Robots handling — how we obey each site's "please don't go here" file.
Signing — how we lock a check so other people can later prove we recorded it.
Dedupe and merge — how two listings of the same agent become one record.

These pages describe checker version VeronikAI/0.1+attestations.1 (signing.py). A2A card checks use suite veronikai-a2a-get-card version 1. MCP checks use suite veronikai-mcp-conformance version 2. If the code changes, the version string on a signed result should change too.

What we never do

We never send a POST, an MCP initialize, an MCP tools/list or tools/call, or an A2A message/send.
We never log in, never pay, and never run a tool.
We follow robots.txt and skip a host for that run if we cannot read an honest robots file.
A published description is what the owner says the agent does. A passed check does not prove the agent can actually do that job.

Limits that apply to every check

Timeout: 10 seconds per request (TIMEOUT).
Workers: 48 at once, but at most 2 requests to one host and 6 to one site (the registrable domain).
A 429 or 503 makes us wait longer for that site (up to 60 seconds), honoring Retry-After.
Each single probe job is capped at about 20 seconds of awake time.
Agent cards are read up to 512 KB. An MCP stream is peeked at most 2 KB and then closed.
The daily run only has time to visit a budgeted subset; every active agent is meant to be revisited at least every 7 days.