Most bot detection tells you a User-Agent looks like a bot. DutyRadar tells you it actually is, with a single API call and a three-state verdict you can act on.
curl -X POST https://api.dutyradar.com/v1/classify \
-H 'content-type: application/json' \
-d '{"user_agent":"...GPTBot/1.0...","ip":"20.171.207.1"}'Over a third of all web requests are bots*, and AI crawlers from OpenAI, Anthropic, and Perplexity are the fastest-growing category. On most content sites, AI bots are now the second-largest source of traffic, behind only Google. You don't get to opt out of being crawled, only of being crawled blind.
The label a bot sends with each request is just a string. Anyone can type "GPTBot," and many scrapers do, because the rules you use to let bots in increasingly allowlist it. Your analytics, your robots.txt, and your bot defense tools are all running on a name tag that doesn't have to be true.
Reddit and Stack Overflow have publicly licensed their content to AI labs. The EU AI Act, California SB-942, and the UK AI bill are turning AI transparency into a legal obligation. Audits land. Regulators ask. Your content gets trained on. The answer "we think it was OpenAI" costs more than "we have verified logs."
One API call per request you care about: bot-claiming traffic, sensitive endpoints, whatever you scope it to. The verdict gets logged alongside your existing data: no separate pipeline, no data leaving your infrastructure. Over time, your logs grow a column that knows the difference between "GPTBot says so" and "GPTBot actually is."
* Per Cloudflare Radar's public bot traffic reports.
Each major operator publishes a different way to prove their bot. DutyRadar runs the right check for the right operator and tells you which tier the verdict came from. The honest read for the no-source bots is part of the product, not a footnote.
Cryptographic signature on the request, verified against the operator's published key directory.
Source IP matched against the operator's published allow-list.
Forward-confirmed reverse DNS into operator-controlled hostnames. The fallback when no allow-list is published.
No vendor-published source. Stays unverified, no matter the UA.
The full set of operators we recognize, scrolled by tier. Click a card for the per-bot research notes.
DutyRadar is the positive-ID layer for declared AI bots. For stealth bots on residential proxies, keep your existing bot vendor. Lower switching cost, lower internal politics.
Hits the same classifier the paid API does. No signup needed for the demo here. For production use, grab a free key. URL hash permalinks the result.
verify_bot tool.npx -y @dutyradar/agent-intel-mcpLands on npm shortly. Email hi@dutyradar.com to get notified the moment it ships.
One verification = one /v1/classify call that returned a non-error response. Production traffic burns through 500/month in an afternoon, and that's a feature, not a bug.
dutyradar verifies declared AI bots only. It does not detect headless Chrome on residential proxies, does not score 0–100, does not block traffic, and does not fingerprint end users. Compose with your existing bot-management vendor for stealth scoring.
One POST, zero deps. fetch is the SDK; copy the snippet above, swap your env var, ship it.
Every classification gets logged. Exports are tamper-evident and can be checked independently, without trusting us. Built for the kind of dispute where "we logged it" is the load-bearing fact.