> ## Documentation Index
> Fetch the complete documentation index at: https://docs.verisoul.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# AI Agent Detection

> How we identify AI agents, crawlers and automation tools

When we identify the AI agent, assistant, crawler or automation tool behind a session, we surface it in the API. The [Agent Atlas](https://agents.verisoul.ai) lists every agent we can identify and how we detect each one.

> **[Agent Atlas](https://agents.verisoul.ai)**
>
> Browse every agent we can identify, filter by type and detection method, and see a sample API response for each one.

## AI agents and bot score

[Bot score](https://docs.verisoul.ai/signals-scores/bot.md) tells you how likely it is that a session is automated. Agent detection tells you which agent is driving the session.

* Most sessions with an identified agent also have a high bot score.
* There will be some cases where we can tell a session is automated without being able to name the agent behind it.

## Agent intent

Agents differ in intent. Some work for a real person, such as an assistant booking a reservation at a restaurant. Others are more malicious and lean toward high risk.

We name the agent so you have the flexibility to decide how to handle each type. For example, you might allow a trusted shopping assistant on checkout while blocking headless automation at account creation.

## How we identify agents

There are three methods we use to detect AI agents.

| Method | How it works | Examples |
| - | - | - |
| **Signed** | The agent signs its requests with [Web Bot Auth](https://datatracker.ietf.org/doc/draft-meunier-web-bot-auth-architecture/), a standard that lets us confirm who sent them. | ChatGPT agent, Grok Bot, Exa |
| **Self-declared** | The agent names itself in its user agent. For most agents, we also check its network or behavior to confirm it. | Googlebot, ClaudeBot, Claude Duet |
| **Inferred** | The agent keeps its name to itself. We recognize it from a combination of signals that match what we have seen from it in our data and our own tests. | Meta Muse, Instinct |

## What we look at

| Signal | What we check |
| - | - |
| **Cryptographic** | A signed request that we verified |
| **Network** | Where the traffic comes from, such as the IP address and hosting provider |
| **Device** | The browser and device, including signs of automation tools |
| **Behavioral** | How the session clicks, types, moves and navigates |

## Agent types

| Type | What it does |
| - | - |
| **AI agent** | Carries out tasks in a browser or on a computer |
| **AI assistant** | Browses or fetches pages for a person |
| **AI crawler** | Collects pages for AI training or AI search |
| **Crawler** | Indexes or checks pages for search, SEO, ads and site tools |
| **Headless automation** | Scripted or hosted browsers |
| **Other** | Link previews, read-aloud tools, safety scanners and uptime monitors |

## What you see in the API

When we identify an agent, the session response includes its details:

```json theme={null}
"agent": {
  "id": "meta_muse",
  "name": "Meta Muse",
  "provider": "Meta",
  "type": "ai_assistant",
  "detection_method": "inferred",
  "detection_signals": ["network", "device", "behavioral"]
}
```

* **id**: a fixed label for the agent, such as `meta_muse` or `chatgpt_agent`. Use this in your rules.
* **name** and **provider**: the agent's display name and the company that runs it.
* **type**: the agent type, as `ai_agent`, `ai_assistant`, `ai_crawler`, `crawler`, `headless_automation` or `other`.
* **detection\_method**: how we identified it, as `signed`, `self_declared` or `inferred`.
* **detection\_signals**: the combination of signals used for detection, from `cryptographic`, `network`, `device` and `behavioral`.

Full field details are in the [Get Session](https://docs.verisoul.ai/api-reference/session/get.md) and [Authenticate](https://docs.verisoul.ai/api-reference/session/authenticate.md) references.

## Using it in your rules

* Build rules on the id, type and detection method. Names and providers can change when an agent rebrands.
* Signed agents carry the strongest proof of identity. Inferred agents are a pattern match.
* A few common setups:
  * Allow signed agents you trust, such as a partner's shopping assistant, and review the rest.
  * Send inferred agents to manual review on sensitive steps, such as signups or payouts.
  * Block headless automation at account creation.

## When an agent shows up

Sometimes we need to watch a session for a while before we can name the agent. A session can show no agent at first and an agent later on. Once we identify an agent, it stays on that session.

## Related

* [Agent Atlas](https://agents.verisoul.ai): every agent we identify, with sample API responses
* [Bot](https://docs.verisoul.ai/signals-scores/bot.md): bot score and the signals behind it
* [Risk Signals](https://docs.verisoul.ai/signals-scores/risk-signals.md): the other signals in the session response


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.