Skip to content
Log in
mDOS home

Legal

mDOS-Bot

Last updated 1 October 2026

On this page

In short: mDOS-Bot reads public web pages for our customers' marketing checks. It obeys robots.txt and Content Signals, reads slowly, never logs in or gets round a block, and you can stop it with two lines in your robots.txt. This summary does not replace the full text below, which is what applies.

Who we are

mDOS-Bot is the website reader used by mDOS, a software platform for hospitality businesses (hotels, pubs, restaurants and venues), run by MDOS AI LTD. It identifies itself on every request with this User-Agent:

Mozilla/5.0 (compatible; mDOS-Bot/2.0; +https://mdos.ai/bots; bot-support@mdos.ai)

What it reads and why

It reads public business web pages on behalf of our customers, for hospitality marketing research and website checks:

  • Pages on our customers’ own websites, when they ask for an SEO, link or tracking check.
  • A small number of public pages that rank in search for a customer’s topic, to compare headings and coverage.
  • Pages a customer asks us to read, such as a news article or a press contact page.

The Agent Browser. Some public pages only show their content once a browser runs them (menus, offers, room rates). For those, our AI assistants use the mDOS Agent Browser: a hosted browser that opens the public page, reads it and closes. It’s used only for named marketing research tasks, such as how a competitor describes itself, published prices and menus, or a customer’s own site as a guest sees it. It sends the same User-Agent above and follows every rule on this page.

We read pages that anyone can see without logging in. We don’t collect information about individual people.

How it obeys your site

  • It reads your robots.txt first and never reads a page it disallows. It answers to the token mdos-bot, and falls back to your User-agent: * rules.
  • If your robots.txt can’t be read (a server error or no answer), it treats your whole site as off-limits and reads nothing.
  • It honours Crawl-delay.
  • It honours Content Signals. If your robots.txt says Content-Signal: ai-input=no (for the whole site or a path), anything that would hand the page to an AI model leaves it unread. Ordinary checks that don’t feed AI, such as a broken-link check, still follow your Allow and Disallow rules as normal.
  • If a page answers with a block, an access-denied page or a “verify you are human” check, that’s your answer. We report the page as protected and move on.
  • One exception to robots.txt: before a customer publishes a campaign, we send a single header-only (HEAD) request to each link in it to confirm the page is live. It reads no content and follows the same pacing.

How fast it reads

  • At most one request every 1 second to your site, across all of our servers together, and never two at once. A longer Crawl-delay slows it further.
  • It slows down when you answer 429 or 503, for as long as your Retry-After asks. If your site keeps refusing it, it stops asking for a while.
  • The Agent Browser has a daily limit on how many pages it opens on any one website, counted across all of our customers together, and it reuses one shared copy of a page rather than opening it once per customer.
  • After any block or opt-out, the Agent Browser leaves your site alone for 7 days, for every customer.

What it never does

  • It never logs in, fills in or submits forms, or reads anything behind a password.
  • It never solves CAPTCHAs or “verify you are human” checks.
  • It never uses rotating or residential proxies to get round a block.
  • It never uses stealth tools and never pretends to be a person’s web browser.

Signed requests

Requests mDOS-Bot sends directly are signed with Web Bot Auth (HTTP Message Signatures, RFC 9421) whenever our signing key is active, so you can check cryptographically that a request really came from us. Signed requests carry these headers:

  • Signature-Agent: sig1="https://mdos.ai"
  • Signature-Input with tag="web-bot-auth" and an Ed25519 key id
  • Signature

Our public keys are published at https://mdos.ai/.well-known/http-message-signatures-directory, which always lists the keys currently in use (an empty list means we aren’t signing at the moment). A request carrying an mDOS-Bot signature that doesn’t verify against those keys isn’t from us. Pages opened in the Agent Browser’s hosted browser carry the same User-Agent but aren’t signed with this key; where it is enabled, they may carry our browser provider’s own signature instead.

Block or slow it

To stop mDOS-Bot reading your site, add this to your robots.txt (older names we still obey: mdos-seo, mdosbot):

User-agent: mdos-bot
Disallow: /

To let us check your site but keep your content out of AI use, add this instead:

User-agent: mdos-bot
Content-Signal: ai-input=no

To slow it down, add Crawl-delay: 10 (seconds) to that group. Changes take effect within 12 hours, which is how long we keep a copy of your robots.txt.

Contact and opt-out

Email bot-support@mdos.ai with your domain to ask us to stop reading your site, to report a problem, or to ask a question.

The robots.txt lines above are the fastest and surest way to opt out: they apply automatically, to every one of our customers, without waiting for us to act on an email.