Neutral third-party Web Bot Auth verification. An origin — or the PDP
deciding for it — received a request from a claimed agent carrying the
Web Bot Auth headers (Signature, Signature-Input, Signature-Agent).
Relay those headers here, plus the authority the request was addressed
to, and TunnelMind verifies the Ed25519 signature against the agent's
own published key directory
(https://<agent>/.well-known/http-message-signatures-directory).
Facts, not a verdict: `state: verified` means "this signature
cryptographically verifies against that directory" — whether to trust
the agent behind it is your policy engine's call.
Use this tool when:
- A request claims a cryptographic agent identity (Signature-Agent
header present) and you must check the claim before serving it.
- You want signature verification independent of your CDN — or you are
not behind a CDN that implements Web Bot Auth at all.
Inputs (JSON body):
- `signature` (required): the received Signature header value.
- `signature_input` (required): the received Signature-Input header value.
- `signature_agent` (required): the received Signature-Agent header
value (quoted https origin).
- `authority` (required): the host the request was addressed to.
- `method`, `path`, `scheme` (optional): only needed if the signature's
covered components include them.
Returns:
- `state`: one of
- `verified` — Ed25519 signature verifies against a key in the
agent's published directory.
- `invalid_signature` — key found, signature does not verify
(tampered or forged).
- `unknown_key` — directory reachable but contains no key with the
claimed thumbprint.
- `directory_unreachable` — the claimed key directory did not answer;
an honest degraded state, not evidence of forgery.
- `expired` — the signature's `expires` timestamp has passed.
- `malformed` — headers do not parse as a Web Bot Auth signature.
- `key_id`: the claimed RFC 7638 JWK thumbprint.
- `directory_url`: the resolved well-known directory URL.
- `params`: created/expires/alg/tag as sent.
- `checks[]`: per-check {name, pass, detail} facts a PDP can gate on.
Cost:
- Counts as one request against the daily rate limit.
Latency:
- Typical: <100ms when the agent's directory is KV-cached (1h TTL);
up to ~5s on first sight of a new directory.
ConnectorNo auth