KalicartGlobalBot
The crawler of KaliCart Global, a federated product catalog for AI shopping agents.
What it does
KalicartGlobalBot reads the machine-readable catalog of WooCommerce stores that installed the KaliCart Bridge plugin and explicitly opted in to KaliCart Global from their own admin panel. It never crawls stores that did not opt in, and a store can revoke consent at any time from the same panel.
It is operated directly by KaliCart Global (one operator, not an intermediary for third parties). It does not train models, does not fetch pages on behalf of end users, and never buys, logs in or submits forms.
What it requests
| Path on the store | Why | How often |
|---|---|---|
/robots.txt | checked before any other request | about once a day per store |
/wp-json/kalicart/v1/discovery | is the Bridge installed, and is consent on | about every 6 hours |
/wp-json/kalicart/v1/catalog/* | catalog sync (pages of 100 products) | scheduled sync, a few times a day |
/wp-json/kalicart/v1/catalog/product/{id} | live price and stock when an agent opens a product | on demand, cached 2 minutes, at most 4 concurrent requests per store |
How to recognize it
User-Agent:
KalicartGlobalBot/1.0 (+https://global.kalicart.com/bot)
Every request is signed with Web Bot Auth (HTTP Message Signatures, RFC 9421). The headers are Signature-Agent: "https://global.kalicart.com", Signature-Input and Signature (Ed25519, tag web-bot-auth, 60-second validity). The public keys are published at:
https://global.kalicart.com/.well-known/http-message-signatures-directory
robots.txt
KalicartGlobalBot follows RFC 9309. It obeys a group for User-agent: KalicartGlobalBot if present, otherwise the * group. To stop it on your site, you can add:
User-agent: KalicartGlobalBot Disallow: /
If you run KaliCart Bridge, you can also simply revoke consent in the plugin settings: the store leaves KaliCart Global immediately.
Contact
Questions or problems: giuso@kalicart.com · GitHub issues.