← Back to the main page

Bot documentation

M-Agents

M-Agents is the cloud browser of the M360M platform. It opens a website only when a signed-in M360M user asks it to carry out a specific task, such as a purchase, a booking or filling in a form.

Last updated: October 22, 2026

What it does

  • Acts for one signed-in person, on a task that person asked for.
  • Asks the person to confirm before any sensitive action, such as paying or sending.
  • Is not a crawler: it does not index sites and does not use site content to train AI models.
  • Does not solve CAPTCHAs or get around bot challenges: CAPTCHAs, two-factor codes and confirmations are handed to the person in a live view.

How it identifies itself

Every request the cloud browser makes (pages, frames, images, scripts and XHR/fetch) carries HTTP Message Signatures (RFC 9421) in the Web Bot Auth format that Cloudflare verifies.

Signature-Agent: "https://m360m.ai/.well-known/http-message-signatures-directory"
Signature-Input: sig1=("@authority" "signature-agent");created=…;keyid="…";alg="ed25519";expires=…;nonce="…";tag="web-bot-auth"
Signature: sig1=:…:
Signature-Agent
https://m360m.ai/.well-known/http-message-signatures-directory
Signature-Input
tag="web-bot-auth" Covers @authority and signature-agent; Ed25519; valid for 60 seconds, with a nonce; keyid = JWK thumbprint of the key (RFC 7638).
Signature
The Ed25519 signature of those components.
Key directory
https://m360m.ai/.well-known/http-message-signatures-directory Public keys (JWKS), served as application/http-message-signatures-directory+json and signed by each key.
User-Agent
The unmodified User-Agent of its Chromium engine (Linux), with no product token. Identify M-Agents by the signature, not by the User-Agent or the IP address.

Keys are Ed25519 and rotate: a new key appears in the directory before it starts signing, and an old key stays there until it expires.

Control it with robots.txt

M-Agents is a user-initiated agent (like ChatGPT-User): it opens a page only when a person asks for it in the chat, so it is not a crawler. Before it opens a page, it honors the robots.txt rules addressed to the M-Agents token (generic User-agent: * crawler rules do not apply to a single request made by a person). To block it, add to your robots.txt:

User-agent: M-Agents
Disallow: /

Verifying its traffic: signature and IP addresses

Verify

Check the signature against the key directory above. On Cloudflare, once M-Agents is accepted as a signed agent, its traffic shows as verified in these fields: cf.bot_management.verified_bot, cf.verified_bot_category, cf.bot_management.signed_agent

Where it runs

  • In the M360M cloud on AWS: a real, windowed Chromium per session.
  • When a site needs a local connection, requests may leave through an IP address of a commercial proxy provider in the person's current area. They carry the same signature.
  • Optionally, on the person's own computer through the M360M browser extension. Those requests never carry our signature: they are the person's own browser, IP address and sign-ins.

Decide

Allow, challenge, rate-limit or block it with your own rules, for example a WAF rule or an AI bot policy for the Agent category. You decide; we do not try to get around your rules.

Report

If you see a problem or want to tell us how M-Agents should treat your site, write to the address below.

Behaviour

  • Opens only the pages the task needs, with at most three simultaneous browser sessions per person.
  • Acts at a human pace: pointer movement, typing and scrolling happen step by step.
  • An agent set up for one site can only open that site and its sign-in pages; any other navigation is blocked.

Contact

Security, abuse and bot questions. Please include the URL, the time (UTC) and, if you have it, the keyid of the signature: dpo@m360m.ai