Theme

Free agent inbox checker

Agent inbox checker

Paste a business's website. We find its agent inbox, check the manifest field by field against the published spec, and see whether each door answers.

Free, no sign-up, no email. Most answers take a few seconds.

buegelbrettbezuege-eisele.de

We haven't checked buegelbrettbezuege-eisele.de with this tool yet. Press the button above to check it now.

Where we look

Where an agent that knows just your domain looks: /.well-known/agent-inbox.json on your site and on inbox.yoursite.com, the DNS record _agent-inbox, and your llms.txt.

What we check

The manifest, field by field, against the published spec (surfingdog-inbox/0), with the same rules as the spec's own checker. Then whether each door it names answers: an MCP door by its tool list, an API by one read.

Check before you publish

To check a manifest you haven't published, paste it on the spec's checker: it runs in your browser and nothing leaves the page.

Questions

What is an agent inbox?

A business's own address where customers' AI assistants can send messages, quote requests, bookings and orders. It publishes one file, /.well-known/agent-inbox.json, saying what it takes and where each door is.

Where must the manifest be?

At https://<the inbox's host>/.well-known/agent-inbox.json, as JSON. A business can point to it from its main domain with a DNS TXT record: _agent-inbox.<domain> v=sdi1; manifest=<URL>.

Which fields are required?

spec, instance, item_types, protocols, agent_policy.tiers, receipt_keys and review_services. Readers ignore fields they don't know.

Why does it say my key is unsafe?

A receipt key must hold its public part alone. If the manifest carries the private part (d), anyone can sign as you: replace the key.

Can I check a manifest without publishing it?

Yes: paste it on /spec/check/. It runs in your browser and nothing leaves the page.

More free tools

Guides