About the ATX scanner

If you found this page from a ATXScanner/0.1 entry in your logs, this explains exactly what we did and how to make it stop.

What it does

ATX publishes independent trust evidence about services that AI agents can call — MCP servers and HTTP APIs. When someone submits an endpoint, we observe it and record what we saw.

Per submitted endpoint we make at most three unauthenticatedGET requests: your/robots.txt, the submitted URL, and/.well-known/oauth-protected-resource. We follow at most three redirects.

If the endpoint looks like an MCP server — the path contains/mcp or /sse, or a public registry lists it as one — we additionally make twoPOST requests carrying standard JSON-RPC:initialize and tools/list. Both are read-only discovery calls defined by the protocol. We record which tools exist and a hash of each tool's input schema, so we can detect when a capability set changes.

What it never does

No port scanning. We only request the endpoint we were given.
No authentication attempts, no credentials, no login forms.
No exploitation, fuzzing, or vulnerability probing.
We never invoke a tool. We sendtools/list, nevertools/call. Listing a capability is not using it, and nothing we send can change your state.
No writes. The only non-GET requests are the two JSON-RPC discovery calls above.
No JavaScript execution and no crawling beyond the paths listed above.
No requests to private, loopback, link-local, or cloud-metadata addresses — these are refused before a connection opens.

Rate limits

One request at a time per host, with a minimum gap between requests. We honorCrawl-delay in your robots.txt and back off on 429 or 503 withRetry-After. If our traffic is still a problem for you, tell us and we will lower it or stop.

How to opt out

Option 1 — robots.txt. We obey it. To exclude us specifically:

User-agent: ATXScanner
Disallow: /

Option 2 — email us. Write toadmin@taladari.com from an address at the domain, or point us at a published security contact. We will add the domain and its subdomains to a verified exclusion list and stop, whether or not you also change robots.txt.

Opt-out requests do not require a justification and we do not negotiate them.

Corrections

Observations are recorded immutably, so we do not delete history — but we do publish corrections that supersede earlier records, and we will rescan on request. If something we published about your service is wrong, email the address above and say what is inaccurate.