WebMCPIndexBot
If this crawler reached your site and you want it to stop, the fastest route is robots.txt. We honour it. If you would rather email us, write to contact@webmcpshield.com and we will remove your domain by hand.
What it does
WebMCPIndexBot measures how the web is adopting WebMCP — a browser API that lets a page register tools an AI agent can call. We publish the aggregate result at webmcpshield.com.
On a normal visit the bot performs one HTTP GET of your home page, reads the HTML, and leaves. It looks for the JavaScript that registers WebMCP tools. If a site declares none — which is almost all of them — nothing further happens.
What it does not do
- It does not scan ports, probe paths, or look for vulnerabilities. It requests the URL you would get by typing the domain into a browser.
- It does not attempt to log in, submit forms, or send data anywhere.
- It never invokes a tool it finds. We read declarations only.
- It does not follow links across your site to crawl it broadly.
How often
Most domains are visited once every 15 days. Sites that declare WebMCP tools are re-checked more often, because changes to those declarations are the thing we track. Requests to a single host are spaced at least one second apart.
How to block it
Add this to your robots.txt. It takes effect on the next visit.
User-agent: WebMCPIndexBot Disallow: /
We fetch and honour robots.txt before requesting anything else, and we treat a
disallow as final — the domain is skipped, not retried under a different name.
Blocking by User-Agent or by IP at your edge also works, and we will not attempt to circumvent it.
Identifying it
User-Agent: WebMCPIndexBot/0.1 (+https://webmcpshield.com/bot)
Nearly all requests come from a single address:
139.162.75.45
A small number of follow-up requests — the ones that load a page in a real browser to read its tool declarations — originate from other hosts we operate. If you see traffic identifying itself as WebMCPIndexBot from a different address and want it confirmed, email us and we will tell you whether it is ours.
Contact
Removal requests are actioned without argument. Please include the domain. We aim to reply within one business day.