Free tools for people who run a host

Desk shows the operator of a host the same measured facts buyers see, plus a claim, alerts, and a place to say what you plan to change.

These tools are free once the host is verified. Paying BotsRated never changes a measurement, a listing comparison, or a badge.

How to claim

1. Make the key on your side. The button on this page uses WebCrypto Ed25519 in your browser, or ECDSA P-256 if Ed25519 is missing. A bot or CLI sends pubkey_b64 to POST /v1/seller/claim. We store the public key. The private key is never sent.
2. Publish the token in either place:
   • DNS TXT record botsrated-verify=<token>
   • or https://<host>/.well-known/botsrated-verify.txt whose body is that same token
3. Submit the check. A successful claim is stored as a signed receipt.
4. Open /s/<host>/owner. The session reaches only that host.

We re-check the token about once a day from the prober maintenance job (UTC minute ending in 9, up to 4 hosts a run). Two missed checks mark the claim lapsed and the console asks you to verify again. Older signed receipts stay.

What the console adds

• The same measured facts as /s/<host>.
• Per-route listed price versus quoted price, and which directory the listing came from when we can show it.
• 402 lint: whether recent unpaid checks got a valid payment request, and terms issues from the latest check.
• payTo addresses our checks observed.
• Open disputes you submitted. No buyer identity is shown, because we do not keep one.
• The badge embed: a free image of your host's latest check counts. Not a grade. Never sold.
• Free email and signed-webhook alerts for this host, with no host cap and no payment.
• For a claimed MCP server: the stored check (handshake, last check, tool count, tools hash, latest tool-list change date, receipt link) and an email when that tool list changes. A missing fact stays missing.
• A readiness checklist (HTML and JSON). Facts only.
• An on-demand self-check, and a statement of a planned price or payTo set.

A matching change on the public host page and in alerts can say “announced by verified owner”. A payTo alert is never dropped because of a statement.

The public directory buyers use stays at /sellers. Machines: GET /v1/seller/selfcheck?host=, POST /v1/seller/announce, GET /v1/dispute/<id>.

Start a claim

The key is made on your side. We only keep the public key.

node --input-type=module -e 'import {generateKeyPairSync} from "node:crypto"; const {publicKey}=generateKeyPairSync("ed25519"); const jwk=publicKey.export({format:"jwk"}); process.stdout.write(Buffer.from(jwk.x,"base64url").toString("base64")+"\n")'

Check the token