AadharshBot
A small, transparent crawler operated by aadhar.sh. If you see it in your access logs, this page tells you who it is, what it does, and how to stop it from visiting if you don't want it to.
Identity
- User-Agent
- AadharshBot/1.0 (+https://aadhar.sh/bot)
- Signature-Agent
- https://aadhar.sh/
- JWKS
- /.well-known/http-message-signatures-directory
- Algorithm
- sig1: Ed25519 (EdDSA), per RFC 9421 + Web Bot Auth draft
- Operator
- coffee@aadhar.sh
What it does
This is Aadharsh Pannirselvam's bot for aadhar.sh, running on Cloudflare Workers. The /around dashboard checks a small list of public homepages daily. The music and reading sections fetch public playlist metadata and bookmarks. /lens fetches public pages and discovery documents when a visitor asks to inspect a URL, and can read published MCP tool catalogues and NLWeb answers.
Content is used for linked references, metadata, and on-demand inspection. It is not used to train or fine-tune AI models or build a search index. Requests use bounded fan-outs and cached results. The bot does not log in to third-party sites or read content behind a login.
Lens also compares responses to sample browser and crawler User-Agent strings. Those diagnostic requests do not claim a Web Bot Auth identity for the sampled bot, and still obey AadharshBot's robots.txt policy.
How to verify it's really AadharshBot
The signed HTTP readers for /around, music, bookmarks and Lens include Signature-Agent, Signature-Input, and Signature headers per RFC 9421 with the Web Bot Auth profile (tag="web-bot-auth"). Fetch the JWKS at the URL above, find the key with the matching kid (its RFC 7638 thumbprint), and verify the Ed25519 signature over the canonical components listed in Signature-Input. Treat an absent, expired or invalid signature as unverified. A User-Agent string alone does not prove who sent a request.
Browser rendering, webmention delivery and verification, and ancillary service calls can also use this User-Agent but do not currently carry Web Bot Auth signatures. They are outside the signed identity described here.
The second signature, retired
Between 2026-07-27 and 2026-08-15 every request carried a second label, sig2, a post-quantum ML-DSA-44 signature over the same covered components. It is gone, and its public key has been removed from the JWKS, so a request from this bot now carries sig1 alone.
It was removed for its CPU cost. Cloudflare's runtime has no ML-DSA in WebCrypto, so signing ran in pure JavaScript at roughly 8.5ms per request, against a 10ms per-invocation budget. One signature spent most of a request, and anything that fans out spent several requests' worth: the playlist scrape signs once per track, and the /lens discovery pass signs 28 probes. Both were failing because of it. Nothing on the internet verified sig2, so dropping it costs no verifier anything. /garage/pqc has the measurements and the full argument.
How to opt out
The RN music panel has one operator-configured exception: its public Spotify playlist, track, and artist embed requests skip robots.txt. They retain the signed bot identity, bounded batches, and caching. Other readers, including Lens requests to Spotify, follow the policy below.
Add to your robots.txt:
User-agent: AadharshBot
Disallow: /Outside that exception, the signed HTTP readers read the origin's robots.txt (cached for up to 12 hours). It skips paths disallowed for AadharshBot or *, including redirect destinations. If the policy is unreachable, rate-limited, or too large to read safely, the fetch is skipped. A positive Crawl-delay also makes this bot skip the origin. These rules apply to scheduled crawls and visitor-requested Lens HTTP reads. If you have a question or a complaint, email coffee@aadhar.sh and I'll reply by hand.
