# About this checker

## What this site does

`ap2check.org` validates your AP2 manifest at a URL you provide. When you submit a URL, we fetch that single endpoint, plus any endpoint URLs the manifest itself declares. We don't crawl your site.

## How to identify us in your logs

```
User-Agent: AP2CheckValidatorBot/1.0 (+https://www.ap2check.org/bot)
```

All requests from this site set the User-Agent above.

## Agentic commerce audit agent

We also operate an agentic commerce audit agent. At a brand's request, it reviews the brand's public agent-facing surface — robots.txt, llms.txt, agents.md, sitemaps, structured data, and published commerce protocol endpoints. It sends only read-only requests, paces itself to about one request per second, and identifies itself with this User-Agent:

```
User-Agent: AgenticCommerceAudit/1.0 (+https://www.ucpcheck.org/bot)
```

When it calls a UCP catalog, it presents this platform profile, which declares catalog search and lookup only: https://www.ucpcheck.org/profiles/agentic-commerce-audit.json

## Credentials handling

If you provide a Bearer token, it transits your browser → our edge → the endpoint you specified. The token lives only in memory for the duration of the validation run. We do not write it to disk, log it, include it in error messages, or include it in shared report URLs.

Reports generated with a credential are marked accordingly on the result page so you know the run was authenticated.

## What we keep

- The URL you submitted (and its domain)
- A record of the validation and results
- A hashed IP for rate limiting
- Your User-Agent
- An opaque `cm_vid` visitor cookie

## Report abuse

If this checker is hitting your site in a way you didn't expect, email report-abuse@ap2check.org and we'll investigate.