SecAI-Agent

SecAI-Agent is the user agent on every request SecAI sends. SecAI monitors the servers and websites of the businesses that use it, and the only requests it sends to a website are uptime checks. They run only for a site a SecAI customer has added to their uptime monitoring, which is normally a site on their own servers.

What it requests

• One GET for the address the customer added, usually the home page, on the schedule their plan allows: every few minutes, and as often as every 30 seconds on higher plans.
• Up to five redirects from that address. Nothing else: no crawling, no links followed, no forms, no logins, no page assets.
• It does not read robots.txt, because it only ever requests the one page a customer asked SecAI to watch.

How to recognise it

Every uptime check carries this user agent. The SecAI-Agent token does not change:

SecAI-Agent/1.0 (uptime check; +https://secai.techsteps.ae/secai-agent)

Each check is also signed with Web Bot Auth (HTTP Message Signatures, RFC 9421). It carries Signature-Agent: "https://secai.techsteps.ae" and an Ed25519 signature over the host it was sent to, and the public key is published at https://secai.techsteps.ae/.well-known/http-message-signatures-directory. Anyone can copy a user agent; only SecAI can produce the signature.

If your website blocks it

When a site behind Cloudflare answers the check with a challenge page, SecAI shows the site as "Cloudflare challenge" instead of up or down, and the Uptime page's "How to fix" opens step-by-step instructions: find the setting that challenged the check in Cloudflare's Security Events, then either turn Bot Fight Mode off or add a Skip rule for SecAI-Agent limited to the page SecAI checks.

If you did not ask for it

A request from SecAI-Agent means someone added your site to SecAI's uptime monitoring. If that was not you or someone working for you, tell us through the Contact page with the site's address, and SecAI will stop checking it.