TrueSourceBot/3.4 Active
You are reading this because our crawler appeared in your server logs.
This page explains exactly what it does, the rate at which it operates,
and how to allow or deny it. We respect robots.txt; if you'd rather
we go away, three lines of text are enough.
At a glance.
The facts you most likely came here for. Copy the user-agent string into your
firewall's allow-list, or paste the robots.txt block below into your
site's /robots.txt.
TrueSourceBot/3.4 (+https://truesource.studio/bot)
TrueSourceBot and the wildcard * rules apply.What it does.
TrueSourceBot is the crawler component of TrueSource AI's
generative-engine-optimization audit. When a TrueSource customer
commissions an audit of a domain, the bot performs a single,
bounded scan of that domain's public assets:
robots.txt, sitemap.xml,
llms.txt, a curated set of well-known JSON manifests
under /.well-known/, and roughly twenty pages selected
from the sitemap or discovered through homepage links.
The output is a structural assessment — schema completeness, discovery-file presence, response hygiene, WAF behaviour — that helps operators understand how generative-AI systems perceive their site. We do not extract content for training. We do not store full page bodies beyond the duration of the audit.
If our customer is auditing your domain without your knowledge — for example, a competitor benchmark — and you want that audit to stop, write to abuse@truesource.studio. We honour these requests without dispute.
In your logs.
A representative access-log line, in combined-log format. The user-agent string is stable across versions of the same major release.
203.0.113.42 - - [15/May/2026:09:14:22 +0000] "GET /llms.txt HTTP/2.0" 200 1247 "-" "TrueSourceBot/3.4 (+https://truesource.studio/bot)"
We crawl from rotating cloud egress, so there is no stable source-IP range to allow-list and reverse-DNS verification does not apply. Verify us cryptographically instead — see § 06.
Allow or block.
Both rules go in /robots.txt at the root of your site.
Our crawler reads the file before each audit and aborts cleanly if disallowed.
User-agent: TrueSourceBot Disallow: /
User-agent: TrueSourceBot Disallow: /admin/ Disallow: /private/ Allow: /
User-agent: TrueSourceBot Crawl-delay: 5
We already default to ~1 request per second per host. A crawl-delay extends the gap to the value you specify (in seconds).
What we collect.
HTTP response headers, status codes, response sizes. The raw
content of robots.txt, sitemap.xml,
llms.txt, and well-known JSON manifests. The HTML of
pages selected for the audit, parsed for structured data
(JSON-LD, microdata, RDFa) and Open Graph tags.
We do not collect: personal data of site visitors, form submissions, content behind authentication, or anything reachable only via JavaScript interaction we did not initiate.
Audit artefacts are retained for the duration of the customer engagement plus a short audit window for verification, then purged. Customers receive the structural report, not the raw HTML.
Verification.
A user-agent string is a claim, not proof — AI-bot identities are impersonated at scale, and ours can be too. Until cryptographic verification ships, verify us by behaviour: TrueSourceBot never retries after a 403, never solves or bypasses a challenge, never switches to a browser user-agent, and never rotates IPs to get around a block. A request that does any of those things is not us, whatever its user-agent string says.
Our
Web Bot Auth
public key is published as of 6 August 2026 at
/.well-known/http-message-signatures-directory.
It is a single Ed25519 key for RFC 9421 HTTP Message
Signatures; its kid is the RFC 7638 JWK
thumbprint:
oywN5-1wHzA9o1AJbb05Fw8tjFdntf6XXF_s6Cn98KY
Request signing is implemented and is being switched on as the
edge providers list this key in their bot directories — an
unregistered key is treated as an unknown one, so signing every
request before then would prove nothing to your firewall. Until
this page says otherwise, assume our requests are
unsigned and identify us by user-agent and by the
behaviour above. When signing goes live you will see
Signature, Signature-Input and
Signature-Agent: "https://truesource.studio" on
every request, and this paragraph will carry the date.
If you operate behind Cloudflare, Akamai, or a similar edge, you'll see this user-agent reach your origin only if your bot management permits it. We do not attempt to bypass WAF challenges. A 403 response simply ends the audit for that asset.