SecAI-Agent

SecAI-Agent is the user agent on every request SecAI sends. SecAI monitors the servers and websites of the businesses that use it, and the only requests it sends to a website are uptime checks. They run only for a site a SecAI customer has added to their uptime monitoring, which is normally a site on their own servers.

What it requests

• One GET for the address the customer added, usually the home page, on the schedule their plan allows: every few minutes, and as often as every 30 seconds on higher plans.
• Up to five redirects from that address. Nothing else: no crawling, no links followed, no forms, no logins, no page assets.
• It does not read robots.txt, because it only ever requests the one page a customer asked SecAI to watch.

How to recognise it

Every uptime check carries this user agent. The SecAI-Agent token does not change:

SecAI-Agent/1.0 (uptime check; +https://secai.techsteps.ae/secai-agent)

Each check is also signed with Web Bot Auth (HTTP Message Signatures, RFC 9421). It carries Signature-Agent: "https://secai.techsteps.ae" and an Ed25519 signature over the host it was sent to, and the public key is published at https://secai.techsteps.ae/.well-known/http-message-signatures-directory. Anyone can copy a user agent; only SecAI can produce the signature.

If your website blocks it

When a site behind Cloudflare answers the check with a challenge page, SecAI shows the site as "Cloudflare challenge" instead of up or down, and the Uptime page's "How to fix" opens step-by-step instructions: find the setting that challenged the check in Cloudflare's Security Events, then either turn Bot Fight Mode off or add a Skip rule for SecAI-Agent limited to the page SecAI checks.

If you did not ask for it

A request from SecAI-Agent means someone added your site to SecAI's uptime monitoring. If that was not you or someone working for you, email [email protected] with the site's address, and SecAI will stop checking it.