Give your agent access to Agents Allowed

Whether you use an assistant like Claude, ChatGPT, Grok or Perplexity, a coding tool like Cursor or VS Code, or build your own agent, it can check this database itself before it shops, books or logs in somewhere. One free request returns whether the site allows agents, which actions work, what to do instead, the official way in, and our sources.

Free · read-only · JSON · no account or key · CORS open · schema_version 1.2.0

Connect it to your agent

Data and discovery files

These files let agents and tools find, download and keep the data in sync automatically. People browsing the site don't need them.

Using the API means you accept the Terms. That includes the MCP server and A2A agent (free, fair use, licence with attribution, no warranty); every API, MCP and A2A response also carries a Link: </terms/>; rel="terms-of-service" header. Results are informational; see the disclaimer.

Quick start

curl "https://agentsallowed.io/api/v1/check?domain=https://www.delta.com/flights"

Then read recommended_action. It's a suggestion based on public sources, not permission; the website's own terms always take priority.

Endpoints

worker = answered dynamically. Everything else is plain static files.

The record

Every endpoint (REST, batch, bulk, MCP, A2A) returns the same record shape, defined by record.schema.json (JSON Schema 2020-12).

{
  "$schema": "https://agentsallowed.io/api/v1/schema/record.schema.json",
  "query": "www.delta.com",
  "matched": "delta.com",
  "schema_version": "1.2.0",
  "found": true,
  "domain": "delta.com",
  "aliases": [],
  "brand": "Delta Air Lines",
  "slug": "delta",
  "category": "travel",
  "status": "none",
  "status_label": "No current access",
  "evidence": "brand_statement",
  "recommended_action": "do_not_proceed",
  "advice": "Agents can't currently use this site for the listed tasks (per its terms or technical measures, as sourced). Don't attempt them through the website on the user's behalf. If a listed official route covers the task, use it; otherwise let the user know they'll need to do it themselves.",
  "allowed_actions": {
    "browse": "unknown",
    "shop": "no",
    "book": "no",
    "login": "no"
  },
  "official_routes": [],
  "agents_affected": [
    "Meta Muse",
    "Personal booking agents generally"
  ],
  "summary": "Third-party AI agents can't currently shop for or book Delta flights on Delta's website or app. Delta says it is protecting customers from unauthorized automated activity and is still evaluating agents.",
  "observed": [
    "Delta told TechCrunch it has no partnership or integration letting a third-party AI agent shop for or book Delta flights on a customer's behalf."
  ],
  "last_checked": "2026-11-03",
  "sources": [
    {
      "title": "Websites are closing their doors to AI agents",
      "publisher": "The Verge",
      "date": "2026-10-17",
      "url": "https://www.theverge.com/ai-artificial-intelligence/1013195/ai-agents-blocked-web"
    },
    {
      "title": "Terms of Use",
      "publisher": "Delta Air Lines",
      "date": "2026-11-03",
      "url": "https://www.delta.com/us/en/legal/terms-of-use"
    },
    {
      "title": "The next hurdle for AI agents: getting websites to let them in",
      "publisher": "TechCrunch",
      "date": "2026-10-06",
      "url": "https://techcrunch.com/2026/10/06/the-next-hurdle-for-ai-agents-getting-websites-to-let-them-in/"
    }
  ],
  "history": [
    {
      "date": "2026-10-22",
      "change": "added",
      "status": "none",
      "note": "Initial record."
    },
    {
      "date": "2026-11-03",
      "change": "updated",
      "status": "none",
      "note": "Added Delta's Terms of Use as a source."
    }
  ],
  "page_url": "https://agentsallowed.io/brands/delta/",
  "api_url": "https://agentsallowed.io/api/v1/domains/delta.com.json",
  "disclaimer": "Informational only, not guaranteed and not legal advice. Not affiliated with Delta Air Lines. Always follow the site's own terms. See https://agentsallowed.io/disclaimer/"
}

Enums

Only verified records are published: evidence is always one of the values above. Domains without a verified record return status:"unknown".

Versioning

schema_version follows semver. Minor versions only add optional fields or enum values (clients should ignore unknown fields and treat unknown enum values as unknown). Breaking changes move to /api/v2/.

Syncing and caching

• Bulk-load /api/v1/all.json once, then poll /api/v1/index.json: if dataset_version is unchanged, nothing changed.
• Otherwise read /api/v1/changes.json (or ?since=) and refetch the listed api_urls. Change ids are stable.
• Send If-None-Match / If-Modified-Since; you'll get 304 when nothing changed. Responses are cacheable for 5 minutes; cache records for up to 24 hours.

MCP

Endpoint POST https://agentsallowed.io/mcp (streamable HTTP). Supports MCP 2026-07-28 (stateless; server/discover, per-request _meta, MCP-Protocol-Version / Mcp-Method / Mcp-Name headers) and legacy 2025-11-25 / 2025-06-18 / 2025-03-26 clients via initialize. Tools: check_domain, check_domains, submit_update, report_block. Manifest: /.well-known/mcp/server.json (MCP registry format).

POST https://agentsallowed.io/mcp
MCP-Protocol-Version: 2026-07-28
Mcp-Method: tools/call
Mcp-Name: check_domains
Content-Type: application/json
Accept: application/json, text/event-stream

{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"check_domains","arguments":{"domains":["amazon.com","target.com"]},
 "_meta":{"io.modelcontextprotocol/protocolVersion":"2026-07-28","io.modelcontextprotocol/clientCapabilities":{}}}}

A2A

Agent card: /.well-known/agent-card.json (A2A 1.0 with 0.3 compatibility fields; also at /.well-known/agent.json). JSON-RPC endpoint POST https://agentsallowed.io/a2a: SendMessage (1.0) or message/send (0.3). Put domains in text or a data part; the reply is a direct message with a text summary and a data part {results:[record]}. No tasks, streaming or push.

{"jsonrpc":"2.0","id":1,"method":"SendMessage","params":{"message":{"messageId":"m1","role":"ROLE_USER",
 "parts":[{"text":"Can I book on delta.com or should I use expedia.com?"}]}}}

Fair use and rate limits

Free to use under the terms. Limits are enforced per IP address: 60 requests per minute per IP (per /64 network for IPv6) across every /api/ path (static JSON and CSV included), /mcp and /a2a, and 10 submissions per hour per IP (REST or the MCP submit tools). A batch check counts as one request. Pages, llms.txt, robots.txt and /.well-known/ files aren't limited.

Over a limit you get 429 with a Retry-After header (seconds), RateLimit and RateLimit-Policy headers, and a JSON body: {"error": "rate_limited", "scope": "default", "limit": 60, "window_seconds": 60, "retry_after_seconds": 60, "message": "…"}. Wait Retry-After seconds, then retry. Successful responses carry RateLimit-Policy. Limits are counted per Cloudflare location, so they're approximate. For bulk needs, download all.json once and poll the changes feed instead of looping over check.

How agents find us

• Every page's <head> links the changes feed, llms.txt, the agent card, the OpenAPI description, the API catalog and the terms; robots.txt and the sitemap point to the same files. See Data and discovery files.
• Legal: Terms of Use · Privacy · Disclaimer (also linked from the OpenAPI termsOfService, the API catalog and the agent card description).
• Every brand page links its JSON with <link rel="alternate" type="application/json"> and an HTTP Link header, and carries schema.org JSON-LD.