Ship an Agent-Ready storefront.

AgentsBloom sits alongside your existing routes as middleware. When a human visits your site, they see your standard HTML. When an AI visits (or uses a browser extension), the SDK serves structured JSON and automatically registers WebMCP tools into the agent's context.

Core Capabilities

• WebMCP Injection

  Injects <meta name="webmcp" content="active"> and registers tools via navigator.ai.registerTool.

• ARD Discovery

  Auto-generates and serves /.well-known/agent-spec and /ai-catalog.json.

• LLM Context

  Serves a structured /llms.txt to train navigating bots.

• DDoS & CAPTCHA Defense

  Rate limits, Idempotency caching, and X-Agent-Signature validation for verified bots.

For headless storefronts and custom web apps, use our NPM packages to wrap your API.

Next.js — @agentsbloom/next-sdk

The easiest way to integrate with Next.js applications using Edge Middleware.

1. Install the package

1npm install @agentsbloom/next-sdk

2. Add to middleware.ts

1import { withAgentsBloom } from "@agentsbloom/next-sdk";
2
3export const config = {
4  matcher: [
5    '/.well-known/:path*',
6    '/ai-catalog.json',
7    '/llms.txt',
8    '/api/agentsbloom/:path*'
9  ]
10};
11
12export default withAgentsBloom({
13  name: "My Agent-Ready Store",
14  description: "An e-commerce store optimized for human and machine AI agents.",
15  agentSecret: process.env.AGENTSBLOOM_SECRET, // Used for CAPTCHA bypassing
16  actions: {
17    search: {
18      method: "POST",
19      description: "Search the product catalog.",
20      params: { query: "string", limit: "number" }
21    },
22    checkout: {
23      method: "POST",
24      description: "Complete an order.",
25      params: { items: "array", payment_intent: "string" }
26    }
27  }
28});

Node.js / Express — @agentsbloom/sdk

For standard Express / Node.js environments, use our vanilla middleware.

1import express from 'express';
2import { agentsbloom } from '@agentsbloom/sdk';
3
4const app = express();
5
6app.use(agentsbloom({
7  apiKey: "sk_live_your_api_key",
8  agentSecret: process.env.AGENTSBLOOM_SECRET,
9  actions: { /* ... same as above ... */ }
10}));

Skip the SDK when you run a standard CMS or e-commerce platform.

Once installed, AgentsBloom automatically routes AI traffic by exposing standard discovery endpoints. You don't need to build these manually.

CAPTCHA Bypassing (X-Agent-Signature)

Autonomous agents often get blocked by Cloudflare or standard CAPTCHAs. AgentsBloom lets verified agents bypass these checks securely using cryptographic signatures.

On write requests (POST, PUT, DELETE), agents must send:

• X-Agent-Identifier — unique string identifying the agent session.
• X-Agent-Signature — HMAC SHA-256 hash of the identifier, signed with your AGENTSBLOOM_SECRET.

Invalid or missing signatures return 403 Verification Failed or 401 Verification Required.

Rate Limiting (DDoS Protection)

In-memory IP rate limiting by default (30 requests per minute). Responses include:

• X-RateLimit-Limit
• X-RateLimit-Remaining
• X-RateLimit-Reset

Over-limit requests return 429 Too Many Requests with a Retry-After header.

Idempotency

All write actions accept an Idempotency-Key header. Retries within 5 minutes replay the cached response (with X-Cache: Idempotent-Hit) instead of re-executing the action — so agents never trigger duplicate purchases.

Use the AgentsBloom CLI to manage compliance locally or simulate agent behavior.

Installation

1npm install -g agentsbloom

Commands