About KARUMA-Scanner

User-Agent: KARUMA-Scanner/3.1

KARUMA-Scanner is the technical diagnostic crawler utilized by KARUMA UCP to verify whether an online store properly publishes public signals required for agentic commerce and the Universal Commerce Protocol (UCP) standard.

1. Purpose of Diagnosis

Every scan runs solely on-demand upon explicit user request. The scanner inspects only public, standard resources:

• Crawl permissions defined in robots.txt.
• Public XML sitemaps declared by the website.
• Canonical HTML metadata and structured product markup (Schema.org / JSON-LD / Microdata).
• Presence and schema validity of the business profile at /.well-known/ucp.

2. Ethical Limits and Traffic Controls

KARUMA-Scanner operates under strict guidelines ensuring safe and non-disruptive inspection:

• Read-only operations: It never adds items to shopping carts, never submits forms, never initiates checkouts, and never mutates merchant state.
• Strict scan budget: Each audit is capped at a maximum of 24 HTTP requests and a global deadline of 25 seconds.
• Zero evasion: It does not disguise its User-Agent, rotate headers, or attempt to circumvent WAFs or CAPTCHAs. If robots.txt or the entry page returns 401, 403 or a detected security challenge, the block is reported and no further resources are requested from that site.
• robots.txt compliance: Before requesting each resource (entry page, sitemaps, product pages, /.well-known/ucp, OAuth metadata and UCP reference documents) it reads the exclusion rules of that resource's origin and follows them. If robots.txt cannot be read, the resource is not requested.
• Scoped UCP references: It only downloads reference documents hosted on the exact same host as the analysed store (not on other subdomains or related domains) or on ucp.dev, and never follows redirects to another origin. Anything else is reported as “not checked”.

3. How to Block KARUMA-Scanner

If you are a store administrator and do not want KARUMA-Scanner to inspect your store, you can disallow it entirely in your robots.txt:

User-agent: KARUMA-Scanner
Disallow: /

Or disallow only specific sensitive or internal paths:

User-agent: KARUMA-Scanner
Disallow: /checkout/
Disallow: /cart/
Disallow: /private/

4. Contact & Inquiries

If you have questions regarding requests observed in your server logs or require technical clarification, please reach out via the contact channels provided on our main site.